@authup/server-core 1.0.0-beta.59 → 1.0.0-beta.61

package/dist/adapters/http/controllers/index.mjs

@@ -11,6 +11,7 @@ import { ClientScopeRequestValidator } from "./entities/client-scope/utils/valid
 import { ConsentController } from "./entities/consent/module.mjs";
 import { EventController } from "./entities/event/module.mjs";
 import { IdentityProviderController } from "./entities/identity-provider/module.mjs";
+import { IdentityProviderAccountController } from "./entities/identity-provider-account/module.mjs";
 import { IdentityProviderRoleMappingController } from "./entities/identity-provide-role/module.mjs";
 import { KeyController } from "./entities/key/module.mjs";
 import { PermissionController } from "./entities/permission/module.mjs";
@@ -41,6 +42,7 @@ import { PolicyAttributesValidator } from "./entities/policy/utils/attributes-va
 import { PolicyValidator } from "./entities/policy/utils/validation.mjs";
 import { ScopeController } from "./entities/scope/module.mjs";
 import { SessionController } from "./entities/session/module.mjs";
+import { SessionTokenController } from "./entities/session-token/module.mjs";
 import { TrustAnchorController } from "./entities/trust-anchor/module.mjs";
 import { UserController } from "./entities/user/module.mjs";
 import { UserAttributeController } from "./entities/user-attribute/module.mjs";
@@ -51,4 +53,4 @@ import { UserPermissionRequestValidator } from "./entities/user-permission/utils
 import { UserRoleController } from "./entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./entities/user-role/utils/validation.mjs";
 import "./entities/index.mjs";
-export { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };
+export { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderAccountController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, SessionTokenController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,kCAAkC,EAClC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,EAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAQxF,MAAM,MAAM,uCAAuC,GAAG;IAClD,OAAO,EAAE,yBAAyB,CAAC;IACnC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC5C,CAAC;AAEF,KAAK,cAAc,GAAG;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,qBAEa,gCAAgC;IACzC,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAE7C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;gBAEvC,GAAG,EAAE,uCAAuC;IAMxD;;;;;OAKG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,GAAI,cAAc;IAenD,MAAM,CACI,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,kCAAkC,CAAC;IAcxC,IAAI,CACG,IAAI,EAAE,qCAAqC,EACxC,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAqBvB,MAAM,CACC,IAAI,EAAE,uCAAuC,EAC1C,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wCAAwC,CAAC;CAsEvD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,kCAAkC,EAClC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,EAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAQxF,MAAM,MAAM,uCAAuC,GAAG;IAClD,OAAO,EAAE,yBAAyB,CAAC;IACnC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC5C,CAAC;AAEF,KAAK,cAAc,GAAG;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,qBAEa,gCAAgC;IACzC,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAE7C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;gBAEvC,GAAG,EAAE,uCAAuC;IAMxD;;;;;OAKG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,GAAI,cAAc;IAenD,MAAM,CACI,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,kCAAkC,CAAC;IAcxC,IAAI,CACG,IAAI,EAAE,qCAAqC,EACxC,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAqBvB,MAAM,CACC,IAAI,EAAE,uCAAuC,EAC1C,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wCAAwC,CAAC;CAuEvD"}

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs

@@ -82,6 +82,7 @@ var AuthenticatorChallengeController = class {
 			ipAddress: getRequestIP(event) ?? null,
 			userAgent: getRequestHeader(event, "user-agent") ?? null,
 			clientId: identity.clientId,
+			sessionId: sessionId ?? null,
 			...session ? { onVerified: async () => {
 				await this.sessionManager.markMfaVerified(session);
 			} } : {}

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","DTags","IdentityType","UserAuthenticatorKind","BadRequestError","EntityCredentialsInvalidError","UnauthorizedError","getRequestHeader","getRequestIP","useRequestIdentity","useRequestLocale","useRequestMfaLoginTicket","useRequestSessionId","AuthenticatorChallengeController","service","sessionManager","mfaLoginService","ctx","resolveActor","event","identity","ticket","status","type","USER","required","enrollmentRequired","kinds","challenge","id","send","data","Object","values","includes","kind","sendChallenge","locale","success","verify","response","sessionId","payload","session_id","session","findOneById","verified","ipAddress","userAgent","clientId","onVerified","markMfaVerified","token","complete","userName","name"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport { IdentityType, UserAuthenticatorKind } from '@authup/core-kit';\nimport { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    UserAuthenticatorChallengeResponse,\n    UserAuthenticatorChallengeSendPayload,\n    UserAuthenticatorChallengeVerifyPayload,\n    UserAuthenticatorChallengeVerifyResponse,\n} from '@authup/core-http-kit';\nimport type { IOAuth2MfaLoginService, ISessionManager, IUserAuthenticatorService } from '../../../../../core/index.ts';\nimport type { RequestIdentity, RequestMfaLoginTicket } from '../../../request/index.ts';\nimport {\n    useRequestIdentity,\n    useRequestLocale,\n    useRequestMfaLoginTicket,\n    useRequestSessionId,\n} from '../../../request/index.ts';\n\nexport type AuthenticatorChallengeControllerContext = {\n    service: IUserAuthenticatorService,\n    sessionManager: ISessionManager,\n    mfaLoginService?: IOAuth2MfaLoginService,\n};\n\ntype ChallengeActor = {\n    identity: RequestIdentity,\n    ticket: RequestMfaLoginTicket | null,\n};\n\n/**\n * Login-time challenge surface, scoped to the CURRENT bearer identity.\n * GET reports whether (and how) the caller must present a second factor;\n * POST verifies a factor and stamps mfa_at onto the backing session so\n * the /authorize backstop passes.\n *\n * Besides a regular access bearer, these routes accept the \"MFA-pending\"\n * login ticket (kind: mfa_token, issue #3242) the password grant issues\n * for factor kinds that cannot ride the single grant POST (email /\n * WebAuthn). A ticket-authenticated verify additionally completes the\n * login: the response carries the full token grant for the now-MFA'd\n * pending session.\n */\n@DTags('userAuthenticator')\n@DController('/authenticators/challenge')\nexport class AuthenticatorChallengeController {\n    protected service: IUserAuthenticatorService;\n\n    protected sessionManager: ISessionManager;\n\n    protected mfaLoginService?: IOAuth2MfaLoginService;\n\n    constructor(ctx: AuthenticatorChallengeControllerContext) {\n        this.service = ctx.service;\n        this.sessionManager = ctx.sessionManager;\n        this.mfaLoginService = ctx.mfaLoginService;\n    }\n\n    /**\n     * Resolve the acting subject: the regular request identity (access\n     * bearer — the middleware never sets it for a ticket) or the stashed\n     * MFA-pending ticket. Anything else is unauthorized — the previous\n     * ForceLoggedInMiddleware contract, widened by exactly one bearer kind.\n     */\n    protected resolveActor(event: IAppEvent) : ChallengeActor {\n        const identity = useRequestIdentity(event);\n        if (identity) {\n            return { identity, ticket: null };\n        }\n\n        const ticket = useRequestMfaLoginTicket(event);\n        if (ticket) {\n            return { identity: ticket.identity, ticket };\n        }\n\n        throw new UnauthorizedError();\n    }\n\n    @DGet('')\n    async status(\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeResponse> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            return {\n                required: false,\n                enrollmentRequired: false,\n                kinds: [],\n            };\n        }\n\n        return this.service.challenge(identity.id);\n    }\n\n    @DPost('/send')\n    async send(\n        @DBody() data: UserAuthenticatorChallengeSendPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<{ success: true }> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can request a challenge.');\n        }\n\n        if (\n            !data ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind must be provided.');\n        }\n\n        await this.service.sendChallenge(identity.id, data.kind, { locale: useRequestLocale(event) });\n\n        // uniform 200 regardless of whether a code was actually mailed —\n        // no enrollment-status oracle for the caller.\n        return { success: true };\n    }\n\n    @DPost('')\n    async verify(\n        @DBody() data: UserAuthenticatorChallengeVerifyPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeVerifyResponse> {\n        const { identity, ticket } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can complete a challenge.');\n        }\n\n        if (\n            !data ||\n            typeof data.response !== 'string' ||\n            !data.response ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind and response must be provided.');\n        }\n\n        // Bind the proof to the backing session — the /authorize backstop\n        // reads session.mfa_at. The session id is server-derived (stashed\n        // by the authorization middleware / carried by the verified ticket),\n        // never client input. The stamp runs INSIDE the verify unit of work\n        // (before the code consumption persists), so a stamp failure never\n        // burns a single-use code.\n        const sessionId = ticket ?\n            ticket.payload.session_id :\n            useRequestSessionId(event);\n        const session = sessionId ?\n            await this.sessionManager.findOneById(sessionId) :\n            null;\n\n        // a ticket references exactly one pending session — without it\n        // (swept / expired mid-flight) the login can not complete.\n        if (ticket && !session) {\n            throw new UnauthorizedError();\n        }\n\n        const verified = await this.service.verify(\n            identity.id,\n            {\n                kind: data.kind,\n                response: data.response,\n            },\n            {\n                ipAddress: getRequestIP(event) ?? null,\n                userAgent: getRequestHeader(event, 'user-agent') ?? null,\n                clientId: identity.clientId,\n                ...(session ? {\n                    onVerified: async () => {\n                        await this.sessionManager.markMfaVerified(session);\n                    },\n                } : {}),\n            },\n        );\n        if (!verified) {\n            throw new EntityCredentialsInvalidError();\n        }\n\n        // Ticket flow: the factor is verified and mfa_at stamped — complete\n        // the login by minting the full grant for the pending session and\n        // consuming the ticket (single use).\n        if (ticket && session && this.mfaLoginService) {\n            const token = await this.mfaLoginService.complete({\n                session,\n                ticket: ticket.payload,\n                userName: identity.data.name,\n            });\n\n            return { verified: true, token };\n        }\n\n        return { verified: true };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,IAAaiB,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8C;EACtD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;IAQA,aAAuBG,OAAmC;EACtD,MAAMC,WAAWX,mBAAmBU,KAAAA;EACpC,IAAIC,UACA,OAAO;GAAEA;GAAUC,QAAQ;EAAK;EAGpC,MAAMA,SAASV,yBAAyBQ,KAAAA;EACxC,IAAIE,QACA,OAAO;GAAED,UAAUC,OAAOD;GAAUC;EAAO;EAG/C,MAAM,IAAIf,kBAAAA;CACd;CAEA,MACMgB,OACF,OAC2C;EAC3C,MAAM,EAAEF,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,OAAO;GACHC,UAAU;GACVC,oBAAoB;GACpBC,OAAO,CAAA;EACX;EAGJ,OAAO,KAAKb,QAAQc,UAAUR,SAASS,EAAE;CAC7C;CAEA,MACMC,KACF,MACA,OAC0B;EAC1B,MAAM,EAAEV,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,+CAAA;EAG9B,IACI,CAAC2B,QACD,CAACC,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,0BAAA;EAG9B,MAAM,KAAKU,QAAQsB,cAAchB,SAASS,IAAIE,KAAKI,MAAM,EAAEE,QAAQ3B,iBAAiBS,KAAAA,EAAO,CAAA;EAI3F,OAAO,EAAEmB,SAAS,KAAK;CAC3B;CAEA,MACMC,OACF,MACA,OACiD;EACjD,MAAM,EAAEnB,UAAUC,WAAW,KAAKH,aAAaC,KAAAA;EAC/C,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,gDAAA;EAG9B,IACI,CAAC2B,QACD,OAAOA,KAAKS,aAAa,YACzB,CAACT,KAAKS,YACN,CAACR,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,uCAAA;EAS9B,MAAMqC,YAAYpB,SACdA,OAAOqB,QAAQC,aACf/B,oBAAoBO,KAAAA;EACxB,MAAMyB,UAAUH,YACZ,MAAM,KAAK1B,eAAe8B,YAAYJ,SAAAA,IACtC;EAIJ,IAAIpB,UAAU,CAACuB,SACX,MAAM,IAAItC,kBAAAA;EAoBd,IAAI,CAACwC,MAjBkB,KAAKhC,QAAQyB,OAChCnB,SAASS,IACT;GACIM,MAAMJ,KAAKI;GACXK,UAAUT,KAAKS;EACnB,GACA;GACIO,WAAWvC,aAAaW,KAAAA,KAAU;GAClC6B,WAAWzC,iBAAiBY,OAAO,YAAA,KAAiB;GACpD8B,UAAU7B,SAAS6B;GACnB,GAAIL,UAAU,EACVM,YAAY,YAAA;IACR,MAAM,KAAKnC,eAAeoC,gBAAgBP,OAAAA;GAC9C,EACJ,IAAI,CAAC;EACT,CAAA,GAGA,MAAM,IAAIvC,8BAAAA;EAMd,IAAIgB,UAAUuB,WAAW,KAAK5B,iBAO1B,OAAO;GAAE8B,UAAU;GAAMM,OAAAA,MANL,KAAKpC,gBAAgBqC,SAAS;IAC9CT;IACAvB,QAAQA,OAAOqB;IACfY,UAAUlC,SAASW,KAAKwB;GAC5B,CAAA;EAE+B;EAGnC,OAAO,EAAET,UAAU,KAAK;CAC5B;AACJ"}
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","DTags","IdentityType","UserAuthenticatorKind","BadRequestError","EntityCredentialsInvalidError","UnauthorizedError","getRequestHeader","getRequestIP","useRequestIdentity","useRequestLocale","useRequestMfaLoginTicket","useRequestSessionId","AuthenticatorChallengeController","service","sessionManager","mfaLoginService","ctx","resolveActor","event","identity","ticket","status","type","USER","required","enrollmentRequired","kinds","challenge","id","send","data","Object","values","includes","kind","sendChallenge","locale","success","verify","response","sessionId","payload","session_id","session","findOneById","verified","ipAddress","userAgent","clientId","onVerified","markMfaVerified","token","complete","userName","name"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport { IdentityType, UserAuthenticatorKind } from '@authup/core-kit';\nimport { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    UserAuthenticatorChallengeResponse,\n    UserAuthenticatorChallengeSendPayload,\n    UserAuthenticatorChallengeVerifyPayload,\n    UserAuthenticatorChallengeVerifyResponse,\n} from '@authup/core-http-kit';\nimport type { IOAuth2MfaLoginService, ISessionManager, IUserAuthenticatorService } from '../../../../../core/index.ts';\nimport type { RequestIdentity, RequestMfaLoginTicket } from '../../../request/index.ts';\nimport {\n    useRequestIdentity,\n    useRequestLocale,\n    useRequestMfaLoginTicket,\n    useRequestSessionId,\n} from '../../../request/index.ts';\n\nexport type AuthenticatorChallengeControllerContext = {\n    service: IUserAuthenticatorService,\n    sessionManager: ISessionManager,\n    mfaLoginService?: IOAuth2MfaLoginService,\n};\n\ntype ChallengeActor = {\n    identity: RequestIdentity,\n    ticket: RequestMfaLoginTicket | null,\n};\n\n/**\n * Login-time challenge surface, scoped to the CURRENT bearer identity.\n * GET reports whether (and how) the caller must present a second factor;\n * POST verifies a factor and stamps mfa_at onto the backing session so\n * the /authorize backstop passes.\n *\n * Besides a regular access bearer, these routes accept the \"MFA-pending\"\n * login ticket (kind: mfa_token, issue #3242) the password grant issues\n * for factor kinds that cannot ride the single grant POST (email /\n * WebAuthn). A ticket-authenticated verify additionally completes the\n * login: the response carries the full token grant for the now-MFA'd\n * pending session.\n */\n@DTags('userAuthenticator')\n@DController('/authenticators/challenge')\nexport class AuthenticatorChallengeController {\n    protected service: IUserAuthenticatorService;\n\n    protected sessionManager: ISessionManager;\n\n    protected mfaLoginService?: IOAuth2MfaLoginService;\n\n    constructor(ctx: AuthenticatorChallengeControllerContext) {\n        this.service = ctx.service;\n        this.sessionManager = ctx.sessionManager;\n        this.mfaLoginService = ctx.mfaLoginService;\n    }\n\n    /**\n     * Resolve the acting subject: the regular request identity (access\n     * bearer — the middleware never sets it for a ticket) or the stashed\n     * MFA-pending ticket. Anything else is unauthorized — the previous\n     * ForceLoggedInMiddleware contract, widened by exactly one bearer kind.\n     */\n    protected resolveActor(event: IAppEvent) : ChallengeActor {\n        const identity = useRequestIdentity(event);\n        if (identity) {\n            return { identity, ticket: null };\n        }\n\n        const ticket = useRequestMfaLoginTicket(event);\n        if (ticket) {\n            return { identity: ticket.identity, ticket };\n        }\n\n        throw new UnauthorizedError();\n    }\n\n    @DGet('')\n    async status(\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeResponse> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            return {\n                required: false,\n                enrollmentRequired: false,\n                kinds: [],\n            };\n        }\n\n        return this.service.challenge(identity.id);\n    }\n\n    @DPost('/send')\n    async send(\n        @DBody() data: UserAuthenticatorChallengeSendPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<{ success: true }> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can request a challenge.');\n        }\n\n        if (\n            !data ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind must be provided.');\n        }\n\n        await this.service.sendChallenge(identity.id, data.kind, { locale: useRequestLocale(event) });\n\n        // uniform 200 regardless of whether a code was actually mailed —\n        // no enrollment-status oracle for the caller.\n        return { success: true };\n    }\n\n    @DPost('')\n    async verify(\n        @DBody() data: UserAuthenticatorChallengeVerifyPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeVerifyResponse> {\n        const { identity, ticket } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can complete a challenge.');\n        }\n\n        if (\n            !data ||\n            typeof data.response !== 'string' ||\n            !data.response ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind and response must be provided.');\n        }\n\n        // Bind the proof to the backing session — the /authorize backstop\n        // reads session.mfa_at. The session id is server-derived (stashed\n        // by the authorization middleware / carried by the verified ticket),\n        // never client input. The stamp runs INSIDE the verify unit of work\n        // (before the code consumption persists), so a stamp failure never\n        // burns a single-use code.\n        const sessionId = ticket ?\n            ticket.payload.session_id :\n            useRequestSessionId(event);\n        const session = sessionId ?\n            await this.sessionManager.findOneById(sessionId) :\n            null;\n\n        // a ticket references exactly one pending session — without it\n        // (swept / expired mid-flight) the login can not complete.\n        if (ticket && !session) {\n            throw new UnauthorizedError();\n        }\n\n        const verified = await this.service.verify(\n            identity.id,\n            {\n                kind: data.kind,\n                response: data.response,\n            },\n            {\n                ipAddress: getRequestIP(event) ?? null,\n                userAgent: getRequestHeader(event, 'user-agent') ?? null,\n                clientId: identity.clientId,\n                sessionId: sessionId ?? null,\n                ...(session ? {\n                    onVerified: async () => {\n                        await this.sessionManager.markMfaVerified(session);\n                    },\n                } : {}),\n            },\n        );\n        if (!verified) {\n            throw new EntityCredentialsInvalidError();\n        }\n\n        // Ticket flow: the factor is verified and mfa_at stamped — complete\n        // the login by minting the full grant for the pending session and\n        // consuming the ticket (single use).\n        if (ticket && session && this.mfaLoginService) {\n            const token = await this.mfaLoginService.complete({\n                session,\n                ticket: ticket.payload,\n                userName: identity.data.name,\n            });\n\n            return { verified: true, token };\n        }\n\n        return { verified: true };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,IAAaiB,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8C;EACtD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;IAQA,aAAuBG,OAAmC;EACtD,MAAMC,WAAWX,mBAAmBU,KAAAA;EACpC,IAAIC,UACA,OAAO;GAAEA;GAAUC,QAAQ;EAAK;EAGpC,MAAMA,SAASV,yBAAyBQ,KAAAA;EACxC,IAAIE,QACA,OAAO;GAAED,UAAUC,OAAOD;GAAUC;EAAO;EAG/C,MAAM,IAAIf,kBAAAA;CACd;CAEA,MACMgB,OACF,OAC2C;EAC3C,MAAM,EAAEF,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,OAAO;GACHC,UAAU;GACVC,oBAAoB;GACpBC,OAAO,CAAA;EACX;EAGJ,OAAO,KAAKb,QAAQc,UAAUR,SAASS,EAAE;CAC7C;CAEA,MACMC,KACF,MACA,OAC0B;EAC1B,MAAM,EAAEV,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,+CAAA;EAG9B,IACI,CAAC2B,QACD,CAACC,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,0BAAA;EAG9B,MAAM,KAAKU,QAAQsB,cAAchB,SAASS,IAAIE,KAAKI,MAAM,EAAEE,QAAQ3B,iBAAiBS,KAAAA,EAAO,CAAA;EAI3F,OAAO,EAAEmB,SAAS,KAAK;CAC3B;CAEA,MACMC,OACF,MACA,OACiD;EACjD,MAAM,EAAEnB,UAAUC,WAAW,KAAKH,aAAaC,KAAAA;EAC/C,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,gDAAA;EAG9B,IACI,CAAC2B,QACD,OAAOA,KAAKS,aAAa,YACzB,CAACT,KAAKS,YACN,CAACR,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,uCAAA;EAS9B,MAAMqC,YAAYpB,SACdA,OAAOqB,QAAQC,aACf/B,oBAAoBO,KAAAA;EACxB,MAAMyB,UAAUH,YACZ,MAAM,KAAK1B,eAAe8B,YAAYJ,SAAAA,IACtC;EAIJ,IAAIpB,UAAU,CAACuB,SACX,MAAM,IAAItC,kBAAAA;EAqBd,IAAI,CAACwC,MAlBkB,KAAKhC,QAAQyB,OAChCnB,SAASS,IACT;GACIM,MAAMJ,KAAKI;GACXK,UAAUT,KAAKS;EACnB,GACA;GACIO,WAAWvC,aAAaW,KAAAA,KAAU;GAClC6B,WAAWzC,iBAAiBY,OAAO,YAAA,KAAiB;GACpD8B,UAAU7B,SAAS6B;GACnBR,WAAWA,aAAa;GACxB,GAAIG,UAAU,EACVM,YAAY,YAAA;IACR,MAAM,KAAKnC,eAAeoC,gBAAgBP,OAAAA;GAC9C,EACJ,IAAI,CAAC;EACT,CAAA,GAGA,MAAM,IAAIvC,8BAAAA;EAMd,IAAIgB,UAAUuB,WAAW,KAAK5B,iBAO1B,OAAO;GAAE8B,UAAU;GAAMM,OAAAA,MANL,KAAKpC,gBAAgBqC,SAAS;IAC9CT;IACAvB,QAAQA,OAAOqB;IACfY,UAAUlC,SAASW,KAAKwB;GAC5B,CAAA;EAE+B;EAGnC,OAAO,EAAET,UAAU,KAAK;CAC5B;AACJ"}

package/dist/adapters/http/index.mjs

@@ -57,6 +57,7 @@ import { ClientScopeRequestValidator } from "./controllers/entities/client-scope
 import { ConsentController } from "./controllers/entities/consent/module.mjs";
 import { EventController } from "./controllers/entities/event/module.mjs";
 import { IdentityProviderController } from "./controllers/entities/identity-provider/module.mjs";
+import { IdentityProviderAccountController } from "./controllers/entities/identity-provider-account/module.mjs";
 import { IdentityProviderRoleMappingController } from "./controllers/entities/identity-provide-role/module.mjs";
 import { KeyController } from "./controllers/entities/key/module.mjs";
 import { PermissionController } from "./controllers/entities/permission/module.mjs";
@@ -86,6 +87,7 @@ import { PolicyAttributesValidator } from "./controllers/entities/policy/utils/a
 import { PolicyValidator } from "./controllers/entities/policy/utils/validation.mjs";
 import { ScopeController } from "./controllers/entities/scope/module.mjs";
 import { SessionController } from "./controllers/entities/session/module.mjs";
+import { SessionTokenController } from "./controllers/entities/session-token/module.mjs";
 import { TrustAnchorController } from "./controllers/entities/trust-anchor/module.mjs";
 import { UserController } from "./controllers/entities/user/module.mjs";
 import { UserAttributeController } from "./controllers/entities/user-attribute/module.mjs";
@@ -96,4 +98,4 @@ import { UserPermissionRequestValidator } from "./controllers/entities/user-perm
 import { UserRoleController } from "./controllers/entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./controllers/entities/user-role/utils/validation.mjs";
 import "./controllers/index.mjs";
-export { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, THEME_STORE_KEY, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestTheme, useRequestToken };
+export { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityProviderAccountController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, SessionTokenController, StatusController, THEME_STORE_KEY, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestTheme, useRequestToken };

package/dist/adapters/http/middleware/built-in/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAIjD,KAAK,sBAAsB,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,GAAE,sBAA2B,QAiBxF"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAIjD,KAAK,sBAAsB,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,GAAE,sBAA2B,QAyBxF"}

package/dist/adapters/http/middleware/built-in/error.mjs

@@ -1,18 +1,19 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { sanitizeError } from "../../../../utils/error.mjs";
+import { describeError, sanitizeError } from "../../../../utils/error.mjs";
 import "../../../../utils/index.mjs";
 import { httpStatusFromCode, serializeError } from "@authup/errors";
 import { defineErrorHandler } from "routup";
 //#region src/adapters/http/middleware/built-in/error.ts
 function registerErrorMiddleware(router, options = {}) {
 	router.use(defineErrorHandler((error, event) => {
-		const next = sanitizeError(error.cause ?? error);
+		const original = error.cause ?? error;
+		const next = sanitizeError(original);
 		const status = httpStatusFromCode(next.code);
 		const payload = serializeError(next);
 		if (status >= 500) {
-			if (options.logger) options.logger.error(next);
+			if (options.logger) options.logger.error(describeError(original));
 			payload.message = "An internal server error occurred.";
 		}
 		event.response.status = status;

package/dist/adapters/http/middleware/built-in/error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error.mjs","names":["defineErrorHandler","httpStatusFromCode","serializeError","sanitizeError","registerErrorMiddleware","router","options","use","error","event","next","cause","status","code","payload","logger","message","response"],"sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App } from 'routup';\nimport { defineErrorHandler } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { httpStatusFromCode, serializeError } from '@authup/errors';\nimport { sanitizeError } from '../../../../utils/index.ts';\n\ntype ErrorMiddlewareOptions = {\n    logger?: Logger\n};\n\nexport function registerErrorMiddleware(router: App, options: ErrorMiddlewareOptions = {}) {\n    router.use(defineErrorHandler((error, event) => {\n        const next = sanitizeError(error.cause ?? error);\n        const status = httpStatusFromCode(next.code);\n\n        const payload = serializeError(next);\n\n        if (status >= 500) {\n            if (options.logger) {\n                options.logger.error(next);\n            }\n            payload.message = 'An internal server error occurred.';\n        }\n\n        event.response.status = status;\n        return payload;\n    }));\n}\n"],"mappings":";;;;;;;;AAiBA,SAAgBI,wBAAwBC,QAAaC,UAAkC,CAAC,GAAC;CACrFD,OAAOE,IAAIP,oBAAoBQ,OAAOC,UAAAA;EAClC,MAAMC,OAAOP,cAAcK,MAAMG,SAASH,KAAAA;EAC1C,MAAMI,SAASX,mBAAmBS,KAAKG,IAAI;EAE3C,MAAMC,UAAUZ,eAAeQ,IAAAA;EAE/B,IAAIE,UAAU,KAAK;GACf,IAAIN,QAAQS,QACRT,QAAQS,OAAOP,MAAME,IAAAA;GAEzBI,QAAQE,UAAU;EACtB;EAEAP,MAAMQ,SAASL,SAASA;EACxB,OAAOE;CACX,CAAA,CAAA;AACJ"}
+{"version":3,"file":"error.mjs","names":["defineErrorHandler","httpStatusFromCode","serializeError","describeError","sanitizeError","registerErrorMiddleware","router","options","use","error","event","original","cause","next","status","code","payload","logger","message","response"],"sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App } from 'routup';\nimport { defineErrorHandler } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { httpStatusFromCode, serializeError } from '@authup/errors';\nimport { describeError, sanitizeError } from '../../../../utils/index.ts';\n\ntype ErrorMiddlewareOptions = {\n    logger?: Logger\n};\n\nexport function registerErrorMiddleware(router: App, options: ErrorMiddlewareOptions = {}) {\n    router.use(defineErrorHandler((error, event) => {\n        // routup wraps whatever a handler threw into an AppError carrying it\n        // as `cause`, so this is the error as it was actually raised.\n        const original = error.cause ?? error;\n\n        const next = sanitizeError(original);\n        const status = httpStatusFromCode(next.code);\n\n        const payload = serializeError(next);\n\n        if (status >= 500) {\n            if (options.logger) {\n                // The ORIGINAL error, never the sanitized copy. Sanitizing\n                // discards the transport reason and the upstream response\n                // body on purpose, and those are the only things that make\n                // an outbound failure diagnosable.\n                options.logger.error(describeError(original));\n            }\n            payload.message = 'An internal server error occurred.';\n        }\n\n        event.response.status = status;\n        return payload;\n    }));\n}\n"],"mappings":";;;;;;;;AAiBA,SAAgBK,wBAAwBC,QAAaC,UAAkC,CAAC,GAAC;CACrFD,OAAOE,IAAIR,oBAAoBS,OAAOC,UAAAA;EAGlC,MAAMC,WAAWF,MAAMG,SAASH;EAEhC,MAAMI,OAAOT,cAAcO,QAAAA;EAC3B,MAAMG,SAASb,mBAAmBY,KAAKE,IAAI;EAE3C,MAAMC,UAAUd,eAAeW,IAAAA;EAE/B,IAAIC,UAAU,KAAK;GACf,IAAIP,QAAQU,QAKRV,QAAQU,OAAOR,MAAMN,cAAcQ,QAAAA,CAAAA;GAEvCK,QAAQE,UAAU;EACtB;EAEAR,MAAMS,SAASL,SAASA;EACxB,OAAOE;CACX,CAAA,CAAA;AACJ"}

package/dist/adapters/http/request/event-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event-context.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/event-context.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGlE;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAItD,wBAAgB,0BAA0B,CAAC,CAAC,EACxC,GAAG,EAAE,mBAAmB,EACxB,EAAE,EAAE,MAAM,CAAC,GACZ,CAAC,CAEH;AAED,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,SAAS,CAExE;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,IAAK,OAAO,CAgB9D"}
+{"version":3,"file":"event-context.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/event-context.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGlE;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAItD,wBAAgB,0BAA0B,CAAC,CAAC,EACxC,GAAG,EAAE,mBAAmB,EACxB,EAAE,EAAE,MAAM,CAAC,GACZ,CAAC,CAEH;AAED,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,SAAS,CAExE;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,IAAK,OAAO,CAiB9D"}

package/dist/adapters/http/request/event-context.mjs

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { useRequestIdentity } from "./helpers/identity.mjs";
+import { useRequestSessionId } from "./helpers/session-id.mjs";
 import "./helpers/index.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { defineCoreHandler, getRequestHeader, getRequestIP } from "routup";
@@ -24,6 +25,7 @@ function useRequestEventContext() {
 			actorType: identity ? identity.type : null,
 			actorId: identity ? identity.id : null,
 			actorName: identity ? identity.data.name ?? null : null,
+			sessionId: useRequestSessionId(event) ?? null,
 			requestPath: event.path,
 			requestMethod: event.method,
 			requestIpAddress: getRequestIP(event) ?? null,

package/dist/adapters/http/request/event-context.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"event-context.mjs","names":["AsyncLocalStorage","defineCoreHandler","getRequestHeader","getRequestIP","useRequestIdentity","storage","runWithRequestEventContext","ctx","fn","run","useRequestEventContext","getStore","createRequestEventContextMiddleware","event","identity","actorType","type","actorId","id","actorName","data","name","requestPath","path","requestMethod","method","requestIpAddress","requestUserAgent","next"],"sources":["../../../../src/adapters/http/request/event-context.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { defineCoreHandler, getRequestHeader, getRequestIP } from 'routup';\nimport type { Handler } from 'routup';\nimport type { EventRequestContext } from '../../../core/index.ts';\nimport { useRequestIdentity } from './helpers/index.ts';\n\n/**\n * Actor + request attribution snapshot for entity-CRUD audit rows, carried\n * across the request's async continuation via AsyncLocalStorage so the\n * database subscribers (which have no request handle) can attribute their\n * writes. Writes outside HTTP (provisioning, CLI, cron) have no store —\n * the getter returns undefined, the correct \"system\" semantics.\n */\nexport type RequestEventContext = EventRequestContext;\n\nconst storage = new AsyncLocalStorage<RequestEventContext>();\n\nexport function runWithRequestEventContext<R>(\n    ctx: RequestEventContext,\n    fn: () => R,\n): R {\n    return storage.run(ctx, fn);\n}\n\nexport function useRequestEventContext(): RequestEventContext | undefined {\n    return storage.getStore();\n}\n\n/**\n * Builds the {@link RequestEventContext} from the routup event and wraps the\n * downstream pipeline in it. Must be mounted AFTER the authorization\n * middleware — the identity has to be resolved for actor attribution.\n */\nexport function createRequestEventContextMiddleware() : Handler {\n    return defineCoreHandler(async (event) => {\n        const identity = useRequestIdentity(event);\n\n        const ctx : RequestEventContext = {\n            actorType: identity ? identity.type : null,\n            actorId: identity ? identity.id : null,\n            actorName: identity ? identity.data.name ?? null : null,\n            requestPath: event.path,\n            requestMethod: event.method,\n            requestIpAddress: getRequestIP(event) ?? null,\n            requestUserAgent: getRequestHeader(event, 'user-agent') ?? null,\n        };\n\n        return runWithRequestEventContext(ctx, () => event.next());\n    });\n}\n"],"mappings":";;;;;;;;AAsBA,MAAMK,UAAU,IAAIL,kBAAAA;AAEpB,SAAgBM,2BACZC,KACAC,IAAW;CAEX,OAAOH,QAAQI,IAAIF,KAAKC,EAAAA;AAC5B;AAEA,SAAgBE,yBAAAA;CACZ,OAAOL,QAAQM,SAAQ;AAC3B;;;;;GAOA,SAAgBC,sCAAAA;CACZ,OAAOX,kBAAkB,OAAOY,UAAAA;EAC5B,MAAMC,WAAWV,mBAAmBS,KAAAA;EAYpC,OAAOP,2BAA2BC;GAT9BQ,WAAWD,WAAWA,SAASE,OAAO;GACtCC,SAASH,WAAWA,SAASI,KAAK;GAClCC,WAAWL,WAAWA,SAASM,KAAKC,QAAQ,OAAO;GACnDC,aAAaT,MAAMU;GACnBC,eAAeX,MAAMY;GACrBC,kBAAkBvB,aAAaU,KAAAA,KAAU;GACzCc,kBAAkBzB,iBAAiBW,OAAO,YAAA,KAAiB;EAG7BN,SAAWM,MAAMe,KAAI,CAAA;CAC3D,CAAA;AACJ"}
+{"version":3,"file":"event-context.mjs","names":["AsyncLocalStorage","defineCoreHandler","getRequestHeader","getRequestIP","useRequestIdentity","useRequestSessionId","storage","runWithRequestEventContext","ctx","fn","run","useRequestEventContext","getStore","createRequestEventContextMiddleware","event","identity","actorType","type","actorId","id","actorName","data","name","sessionId","requestPath","path","requestMethod","method","requestIpAddress","requestUserAgent","next"],"sources":["../../../../src/adapters/http/request/event-context.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { defineCoreHandler, getRequestHeader, getRequestIP } from 'routup';\nimport type { Handler } from 'routup';\nimport type { EventRequestContext } from '../../../core/index.ts';\nimport { useRequestIdentity, useRequestSessionId } from './helpers/index.ts';\n\n/**\n * Actor + request attribution snapshot for entity-CRUD audit rows, carried\n * across the request's async continuation via AsyncLocalStorage so the\n * database subscribers (which have no request handle) can attribute their\n * writes. Writes outside HTTP (provisioning, CLI, cron) have no store —\n * the getter returns undefined, the correct \"system\" semantics.\n */\nexport type RequestEventContext = EventRequestContext;\n\nconst storage = new AsyncLocalStorage<RequestEventContext>();\n\nexport function runWithRequestEventContext<R>(\n    ctx: RequestEventContext,\n    fn: () => R,\n): R {\n    return storage.run(ctx, fn);\n}\n\nexport function useRequestEventContext(): RequestEventContext | undefined {\n    return storage.getStore();\n}\n\n/**\n * Builds the {@link RequestEventContext} from the routup event and wraps the\n * downstream pipeline in it. Must be mounted AFTER the authorization\n * middleware — the identity has to be resolved for actor attribution.\n */\nexport function createRequestEventContextMiddleware() : Handler {\n    return defineCoreHandler(async (event) => {\n        const identity = useRequestIdentity(event);\n\n        const ctx : RequestEventContext = {\n            actorType: identity ? identity.type : null,\n            actorId: identity ? identity.id : null,\n            actorName: identity ? identity.data.name ?? null : null,\n            sessionId: useRequestSessionId(event) ?? null,\n            requestPath: event.path,\n            requestMethod: event.method,\n            requestIpAddress: getRequestIP(event) ?? null,\n            requestUserAgent: getRequestHeader(event, 'user-agent') ?? null,\n        };\n\n        return runWithRequestEventContext(ctx, () => event.next());\n    });\n}\n"],"mappings":";;;;;;;;;AAsBA,MAAMM,UAAU,IAAIN,kBAAAA;AAEpB,SAAgBO,2BACZC,KACAC,IAAW;CAEX,OAAOH,QAAQI,IAAIF,KAAKC,EAAAA;AAC5B;AAEA,SAAgBE,yBAAAA;CACZ,OAAOL,QAAQM,SAAQ;AAC3B;;;;;GAOA,SAAgBC,sCAAAA;CACZ,OAAOZ,kBAAkB,OAAOa,UAAAA;EAC5B,MAAMC,WAAWX,mBAAmBU,KAAAA;EAapC,OAAOP,2BAA2BC;GAV9BQ,WAAWD,WAAWA,SAASE,OAAO;GACtCC,SAASH,WAAWA,SAASI,KAAK;GAClCC,WAAWL,WAAWA,SAASM,KAAKC,QAAQ,OAAO;GACnDC,WAAWlB,oBAAoBS,KAAAA,KAAU;GACzCU,aAAaV,MAAMW;GACnBC,eAAeZ,MAAMa;GACrBC,kBAAkBzB,aAAaW,KAAAA,KAAU;GACzCe,kBAAkB3B,iBAAiBY,OAAO,YAAA,KAAiB;EAG7BN,SAAWM,MAAMgB,KAAI,CAAA;CAC3D,CAAA;AACJ"}

package/dist/app/index.mjs

@@ -21,6 +21,7 @@ import { ClientRoleRepositoryAdapter } from "./modules/database/repositories/cli
 import { ClientScopeRepositoryAdapter } from "./modules/database/repositories/client-scope/repository.mjs";
 import { EventRepositoryAdapter } from "./modules/database/repositories/event/repository.mjs";
 import { IdentityProviderRepositoryAdapter } from "./modules/database/repositories/identity-provider/repository.mjs";
+import { IdentityProviderAccountRepositoryAdapter } from "./modules/database/repositories/identity-provider-account/repository.mjs";
 import { KeyRepositoryAdapter } from "./modules/database/repositories/key/repository.mjs";
 import { PermissionRepositoryAdapter } from "./modules/database/repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "./modules/database/repositories/permission-policy/repository.mjs";
@@ -47,10 +48,11 @@ import { MetricsInjectionKey } from "./modules/metrics/constants.mjs";
 import { PromAuthFlowMetrics } from "./modules/metrics/prom.mjs";
 import { OAuth2InjectionToken } from "./modules/oauth2/constants.mjs";
 import { IdentityInjectionKey } from "./modules/identity/constants.mjs";
-import { IdentityProviderAccountRepository } from "./modules/identity/repositories/provider/account/module.mjs";
 import { IdentityProviderAttributeMappingRepository } from "./modules/identity/repositories/provider/mapper/attribute.mjs";
 import { IdentityProviderPermissionMappingRepository } from "./modules/identity/repositories/provider/mapper/permission.mjs";
 import { IdentityProviderRoleMappingRepository } from "./modules/identity/repositories/provider/mapper/role.mjs";
+import { CacheIdentityPrefix } from "./modules/identity/repositories/constants.mjs";
+import { IdentityProviderAccountLinkStore } from "./modules/identity/repositories/provider/link.mjs";
 import { ClientIdentityRepository } from "./modules/identity/repositories/client.mjs";
 import { UserIdentityRepository } from "./modules/identity/repositories/user.mjs";
 import { LDAPInjectionKey } from "./modules/ldap/constants.mjs";
@@ -70,4 +72,4 @@ import { RuntimeModule } from "./modules/runtime/module.mjs";
 import "./modules/index.mjs";
 import { ApplicationBuilder } from "./builder.mjs";
 import { createApplication } from "./factory.mjs";
-export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };
+export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheIdentityPrefix, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountLinkStore, IdentityProviderAccountRepositoryAdapter, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };

package/dist/app/modules/database/index.mjs

@@ -8,6 +8,7 @@ import { ClientRoleRepositoryAdapter } from "./repositories/client-role/reposito
 import { ClientScopeRepositoryAdapter } from "./repositories/client-scope/repository.mjs";
 import { EventRepositoryAdapter } from "./repositories/event/repository.mjs";
 import { IdentityProviderRepositoryAdapter } from "./repositories/identity-provider/repository.mjs";
+import { IdentityProviderAccountRepositoryAdapter } from "./repositories/identity-provider-account/repository.mjs";
 import { KeyRepositoryAdapter } from "./repositories/key/repository.mjs";
 import { PermissionRepositoryAdapter } from "./repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "./repositories/permission-policy/repository.mjs";
@@ -27,4 +28,4 @@ import { IdentityProviderRoleMappingRepositoryAdapter } from "./repositories/ide
 import "./repositories/index.mjs";
 import { DatabaseInjectionKey } from "./constants.mjs";
 import { DatabaseModule } from "./module.mjs";
-export { ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, DatabaseInjectionKey, DatabaseModule, EventRepositoryAdapter, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, ScopeRepositoryAdapter, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter };
+export { ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, DatabaseInjectionKey, DatabaseModule, EventRepositoryAdapter, IdentityProviderAccountRepositoryAdapter, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, ScopeRepositoryAdapter, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter };

package/dist/app/modules/database/repositories/identity-provider-account/index.d.ts

@@ -0,0 +1,2 @@
+export * from './repository.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/database/repositories/identity-provider-account/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/identity-provider-account/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC"}

package/dist/app/modules/database/repositories/identity-provider-account/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderAccountRepositoryAdapter } from "./repository.mjs";
+export { IdentityProviderAccountRepositoryAdapter };

package/dist/app/modules/database/repositories/identity-provider-account/repository.d.ts

@@ -0,0 +1,18 @@
+import type { IdentityProviderAccount } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
+import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { DataSource, DeepPartial, Repository } from 'typeorm';
+import { IdentityProviderAccountEntity } from '../../../../../adapters/database/domains/index.ts';
+import type { IIdentityProviderAccountRepository, IdentityProviderAccountFindManyOptions, IdentityProviderIdentity } from '../../../../../core/index.ts';
+export declare class IdentityProviderAccountRepositoryAdapter implements IIdentityProviderAccountRepository {
+    protected dataSource: DataSource;
+    protected repository: Repository<IdentityProviderAccountEntity>;
+    constructor(dataSource: DataSource);
+    findMany(query: IQuery, options?: IdentityProviderAccountFindManyOptions): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>>;
+    findOneById(id: string): Promise<IdentityProviderAccount | null>;
+    removeGuarded(entity: IdentityProviderAccount, userHasOtherLogin: boolean): Promise<boolean>;
+    findOneByProviderIdentity(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount | null>;
+    save(entity: DeepPartial<IdentityProviderAccount>): Promise<IdentityProviderAccount>;
+    remove(entity: IdentityProviderAccount): Promise<void>;
+}
+//# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/database/repositories/identity-provider-account/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/identity-provider-account/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EACR,UAAU,EACV,WAAW,EACX,UAAU,EACb,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAElG,OAAO,KAAK,EACR,kCAAkC,EAClC,sCAAsC,EACtC,wBAAwB,EAC3B,MAAM,8BAA8B,CAAC;AAEtC,qBAAa,wCAAyC,YAAW,kCAAkC;IAC/F,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC;IAEjC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,6BAA6B,CAAC,CAAC;gBAEpD,UAAU,EAAE,UAAU;IAK5B,QAAQ,CACV,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,sCAA2C,GACrD,OAAO,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;IAuC7D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAIhE,aAAa,CAAC,MAAM,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAsC5F,yBAAyB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAUtG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,uBAAuB,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAIpF,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;CAG/D"}

package/dist/app/modules/database/repositories/identity-provider-account/repository.mjs

@@ -0,0 +1,69 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { isDatabaseTypeRowLockable } from "../../../../../adapters/database/helpers/is-supported.mjs";
+import "../../../../../adapters/database/helpers/index.mjs";
+import { IdentityProviderAccountEntity } from "../../../../../adapters/database/domains/identity-provider-account/entity.mjs";
+import "../../../../../adapters/database/domains/index.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
+//#region src/app/modules/database/repositories/identity-provider-account/repository.ts
+var IdentityProviderAccountRepositoryAdapter = class {
+	dataSource;
+	repository;
+	constructor(dataSource) {
+		this.dataSource = dataSource;
+		this.repository = dataSource.getRepository(IdentityProviderAccountEntity);
+	}
+	async findMany(query, options = {}) {
+		const qb = this.repository.createQueryBuilder("identityProviderAccount");
+		const { pagination } = applyQuery(qb, query);
+		const existing = new Set(qb.expressionMap.selects.map((select) => select.selection));
+		const selections = ["userId", "userRealmId"].map((column) => `identityProviderAccount.${column}`).filter((selection) => !existing.has(selection));
+		if (selections.length > 0) qb.addSelect(selections);
+		if (options.userId) qb.andWhere("identityProviderAccount.userId = :ownerUserId", { ownerUserId: options.userId });
+		if (options.realmId) qb.andWhere("identityProviderAccount.userRealmId = :ownerRealmId", { ownerRealmId: options.realmId });
+		const [entities, total] = await qb.getManyAndCount();
+		return {
+			data: redactFieldConditions(query, entities),
+			meta: {
+				total,
+				...pagination
+			}
+		};
+	}
+	async findOneById(id) {
+		return this.repository.findOneBy({ id });
+	}
+	async removeGuarded(entity, userHasOtherLogin) {
+		if (!isDatabaseTypeRowLockable(this.dataSource.options.type)) {
+			if (await this.repository.countBy({ userId: entity.userId }) <= 1 && !userHasOtherLogin) return false;
+			await this.repository.remove(entity);
+			return true;
+		}
+		return this.dataSource.transaction(async (manager) => {
+			const repository = manager.getRepository(IdentityProviderAccountEntity);
+			if ((await repository.createQueryBuilder("identityProviderAccount").select(["identityProviderAccount.id"]).where("identityProviderAccount.userId = :userId", { userId: entity.userId }).setLock("pessimistic_write").getMany()).length <= 1 && !userHasOtherLogin) return false;
+			await repository.remove(entity);
+			return true;
+		});
+	}
+	async findOneByProviderIdentity(identity) {
+		return this.repository.findOne({
+			where: {
+				providerUserId: identity.id,
+				providerId: identity.provider.id
+			},
+			relations: { user: true }
+		});
+	}
+	async save(entity) {
+		return this.repository.save(entity);
+	}
+	async remove(entity) {
+		await this.repository.remove(entity);
+	}
+};
+//#endregion
+export { IdentityProviderAccountRepositoryAdapter };
+
+//# sourceMappingURL=repository.mjs.map

package/dist/app/modules/database/repositories/identity-provider-account/repository.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.mjs","names":["applyQuery","redactFieldConditions","IdentityProviderAccountEntity","isDatabaseTypeRowLockable","IdentityProviderAccountRepositoryAdapter","dataSource","repository","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","existing","Set","expressionMap","selects","map","select","selection","selections","column","filter","has","length","addSelect","userId","andWhere","ownerUserId","realmId","ownerRealmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","removeGuarded","entity","userHasOtherLogin","type","count","countBy","remove","transaction","manager","rows","where","setLock","getMany","findOneByProviderIdentity","identity","findOne","providerUserId","providerId","provider","relations","user","save"],"sources":["../../../../../../src/app/modules/database/repositories/identity-provider-account/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type {\n    DataSource, \n    DeepPartial, \n    Repository,\n} from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport { IdentityProviderAccountEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isDatabaseTypeRowLockable } from '../../../../../adapters/database/helpers/index.ts';\nimport type {\n    IIdentityProviderAccountRepository,\n    IdentityProviderAccountFindManyOptions,\n    IdentityProviderIdentity,\n} from '../../../../../core/index.ts';\n\nexport class IdentityProviderAccountRepositoryAdapter implements IIdentityProviderAccountRepository {\n    protected dataSource: DataSource;\n\n    protected repository: Repository<IdentityProviderAccountEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.dataSource = dataSource;\n        this.repository = dataSource.getRepository(IdentityProviderAccountEntity);\n    }\n\n    async findMany(\n        query: IQuery,\n        options: IdentityProviderAccountFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>> {\n        const qb = this.repository.createQueryBuilder('identityProviderAccount');\n\n        const { pagination } = applyQuery(qb, query);\n\n        // plan-039 force-select: the per-row gate reads userId (ownership)\n        // and userRealmId (realm reach). The shared applyRealmScopeSelect\n        // pins a `realmId` column this entity does not have, so dedupe and\n        // add the two columns the same way it would.\n        const existing = new Set(qb.expressionMap.selects.map((select) => select.selection));\n        const selections = ['userId', 'userRealmId']\n            .map((column) => `identityProviderAccount.${column}`)\n            .filter((selection) => !existing.has(selection));\n        if (selections.length > 0) {\n            qb.addSelect(selections);\n        }\n\n        if (options.userId) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('identityProviderAccount.userId = :ownerUserId', { ownerUserId: options.userId });\n        }\n\n        if (options.realmId) {\n            // nested `/realms/:realmId/identity-provider-accounts` mount —\n            // mandatory constraint, not overridable by a rapiq filter\n            qb.andWhere('identityProviderAccount.userRealmId = :ownerRealmId', { ownerRealmId: options.realmId });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<IdentityProviderAccount | null> {\n        return this.repository.findOneBy({ id });\n    }\n\n    async removeGuarded(entity: IdentityProviderAccount, userHasOtherLogin: boolean): Promise<boolean> {\n        if (!isDatabaseTypeRowLockable(this.dataSource.options.type)) {\n            // better-sqlite3: a single synchronous writer, so the\n            // count/delete race cannot manifest and no transaction is\n            // needed. Deliberately NOT wrapped in one — a held write\n            // transaction would contend the database lock (single-file\n            // driver) without buying any atomicity here. Plain\n            // count-then-remove, exactly as the un-guarded path did.\n            const count = await this.repository.countBy({ userId: entity.userId });\n            if (count <= 1 && !userHasOtherLogin) {\n                return false;\n            }\n\n            await this.repository.remove(entity as IdentityProviderAccountEntity);\n            return true;\n        }\n\n        // mysql / postgres: real concurrency. Lock the user's account rows,\n        // count, and delete in one transaction so two concurrent unlinks for\n        // the same user cannot both read > 1 and both delete.\n        return this.dataSource.transaction(async (manager) => {\n            const repository = manager.getRepository(IdentityProviderAccountEntity);\n\n            const rows = await repository.createQueryBuilder('identityProviderAccount')\n                .select(['identityProviderAccount.id'])\n                .where('identityProviderAccount.userId = :userId', { userId: entity.userId })\n                .setLock('pessimistic_write')\n                .getMany();\n\n            if (rows.length <= 1 && !userHasOtherLogin) {\n                return false;\n            }\n\n            await repository.remove(entity as IdentityProviderAccountEntity);\n            return true;\n        });\n    }\n\n    async findOneByProviderIdentity(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount | null> {\n        return this.repository.findOne({\n            where: {\n                providerUserId: identity.id,\n                providerId: identity.provider.id,\n            },\n            relations: { user: true },\n        });\n    }\n\n    async save(entity: DeepPartial<IdentityProviderAccount>): Promise<IdentityProviderAccount> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: IdentityProviderAccount): Promise<void> {\n        await this.repository.remove(entity as IdentityProviderAccountEntity);\n    }\n}\n"],"mappings":";;;;;;;;;AAwBA,IAAaI,2CAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,YAAwB;EAChC,KAAKA,aAAaA;EAClB,KAAKC,aAAaD,WAAWE,cAAcL,6BAAAA;CAC/C;CAEA,MAAMM,SACFC,OACAC,UAAkD,CAAC,GACa;EAChE,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,yBAAA;EAE9C,MAAM,EAAEC,eAAeb,WAAWW,IAAIF,KAAAA;EAMtC,MAAMK,WAAW,IAAIC,IAAIJ,GAAGK,cAAcC,QAAQC,KAAKC,WAAWA,OAAOC,SAAS,CAAA;EAClF,MAAMC,aAAa,CAAC,UAAU,aAAc,CAAA,CACvCH,KAAKI,WAAW,2BAA2BA,QAAQ,CAAA,CACnDC,QAAQH,cAAc,CAACN,SAASU,IAAIJ,SAAAA,CAAAA;EACzC,IAAIC,WAAWI,SAAS,GACpBd,GAAGe,UAAUL,UAAAA;EAGjB,IAAIX,QAAQiB,QAERhB,GAAGiB,SAAS,iDAAiD,EAAEC,aAAanB,QAAQiB,OAAO,CAAA;EAG/F,IAAIjB,QAAQoB,SAGRnB,GAAGiB,SAAS,uDAAuD,EAAEG,cAAcrB,QAAQoB,QAAQ,CAAA;EAGvG,MAAM,CAACE,UAAUC,SAAS,MAAMtB,GAAGuB,gBAAe;EAElD,OAAO;GACHC,MAAMlC,sBAAsBQ,OAAOuB,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGpB;GACP;EACJ;CACJ;CAEA,MAAMwB,YAAYC,IAAqD;EACnE,OAAO,KAAKhC,WAAWiC,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,cAAcC,QAAiCC,mBAA8C;EAC/F,IAAI,CAACvC,0BAA0B,KAAKE,WAAWK,QAAQiC,IAAI,GAAG;GAQ1D,IAAIC,MADgB,KAAKtC,WAAWuC,QAAQ,EAAElB,QAAQc,OAAOd,OAAO,CAAA,KACvD,KAAK,CAACe,mBACf,OAAO;GAGX,MAAM,KAAKpC,WAAWwC,OAAOL,MAAAA;GAC7B,OAAO;EACX;EAKA,OAAO,KAAKpC,WAAW0C,YAAY,OAAOC,YAAAA;GACtC,MAAM1C,aAAa0C,QAAQzC,cAAcL,6BAAAA;GAQzC,KAAI+C,MANe3C,WAAWM,mBAAmB,yBAAA,CAAA,CAC5CO,OAAO,CAAC,4BAA6B,CAAA,CAAA,CACrC+B,MAAM,4CAA4C,EAAEvB,QAAQc,OAAOd,OAAO,CAAA,CAAA,CAC1EwB,QAAQ,mBAAA,CAAA,CACRC,QAAO,EAAA,CAEH3B,UAAU,KAAK,CAACiB,mBACrB,OAAO;GAGX,MAAMpC,WAAWwC,OAAOL,MAAAA;GACxB,OAAO;EACX,CAAA;CACJ;CAEA,MAAMY,0BAA0BC,UAA6E;EACzG,OAAO,KAAKhD,WAAWiD,QAAQ;GAC3BL,OAAO;IACHM,gBAAgBF,SAAShB;IACzBmB,YAAYH,SAASI,SAASpB;GAClC;GACAqB,WAAW,EAAEC,MAAM,KAAK;EAC5B,CAAA;CACJ;CAEA,MAAMC,KAAKpB,QAAgF;EACvF,OAAO,KAAKnC,WAAWuD,KAAKpB,MAAAA;CAChC;CAEA,MAAMK,OAAOL,QAAgD;EACzD,MAAM,KAAKnC,WAAWwC,OAAOL,MAAAA;CACjC;AACJ"}

package/dist/app/modules/database/repositories/index.d.ts

@@ -4,6 +4,7 @@ export * from './client-role/index.ts';
 export * from './client-scope/index.ts';
 export * from './event/index.ts';
 export * from './identity-provider/index.ts';
+export * from './identity-provider-account/index.ts';
 export * from './key/index.ts';
 export * from './permission/index.ts';
 export * from './permission-policy/index.ts';

package/dist/app/modules/database/repositories/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}

package/dist/app/modules/database/repositories/index.mjs

@@ -14,6 +14,8 @@ import { EventRepositoryAdapter } from "./event/repository.mjs";
 import "./event/index.mjs";
 import { IdentityProviderRepositoryAdapter } from "./identity-provider/repository.mjs";
 import "./identity-provider/index.mjs";
+import { IdentityProviderAccountRepositoryAdapter } from "./identity-provider-account/repository.mjs";
+import "./identity-provider-account/index.mjs";
 import { KeyRepositoryAdapter } from "./key/repository.mjs";
 import "./key/index.mjs";
 import { PermissionRepositoryAdapter } from "./permission/repository.mjs";
@@ -47,4 +49,4 @@ import { UserRoleRepositoryAdapter } from "./user-role/repository.mjs";
 import "./user-role/index.mjs";
 import { IdentityProviderRoleMappingRepositoryAdapter } from "./identity-provider-role-mapping/repository.mjs";
 import "./identity-provider-role-mapping/index.mjs";
-export { ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, EventRepositoryAdapter, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, ScopeRepositoryAdapter, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter };
+export { ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, EventRepositoryAdapter, IdentityProviderAccountRepositoryAdapter, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, ScopeRepositoryAdapter, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter };

package/dist/app/modules/database/repositories/key/repository.d.ts

@@ -24,9 +24,32 @@ export declare class KeyRepositoryAdapter implements IKeyRepository, IKeyStore {
     protected secretsCipher: ISymmetricCipher | null;
     protected realmRepository: IRealmRepository;
     protected logger?: Logger;
+    /**
+     * In-flight mints keyed `<realmId>:<use>` — see {@link mintExclusive}.
+     */
+    protected mints: Map<string, Promise<Key>>;
     constructor(dataSource: DataSource, options?: KeyRepositoryAdapterOptions);
     protected get repository(): Repository<KeyEntity>;
+    protected findActiveKey(realmId: string, use: `${JWKUse}`): Promise<KeyEntity | null>;
     resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key>;
+    /**
+     * Minting is check-then-act (read, count, insert), and the callers are
+     * hot paths — the token signer resolves a signature key for EVERY
+     * issuance, the realm cipher an encryption key for every MFA seed — so
+     * a freshly created realm routinely takes several simultaneous calls
+     * and each one would insert its own key. Concurrent mints for one
+     * (realm, use) therefore share a single in-flight promise.
+     *
+     * The map is per adapter instance, and the store is a DI singleton, so
+     * it is scoped to one application: two applications in one process
+     * (the test suite) never share mint state. Separate PROCESSES can still
+     * race, which is why the duplicate stays tolerable rather than fatal —
+     * both keys are published in JWKS and verify, and `findActiveKey`
+     * orders deterministically, so a duplicate costs a redundant row, not
+     * a broken token.
+     */
+    protected mintExclusive(realmId: string, use: `${JWKUse}`): Promise<Key>;
+    protected mint(realmId: string, use: `${JWKUse}`): Promise<Key>;
     resolveById(id: string): Promise<Key | null>;
     protected createSignatureKey(repository: Repository<KeyEntity>, realmId: string): Promise<Key>;
     protected createEncryptionKey(repository: Repository<KeyEntity>, realmId: string): Promise<Key>;

package/dist/app/modules/database/repositories/key/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/key/repository.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,EAGH,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACrB,KAAK,MAAM,EAEd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAW,MAAM,EAAgB,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAoB,UAAU,EAAE,MAAM,SAAS,CAAC;AAKxE,OAAO,EAEH,SAAS,EAGZ,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAUhG,MAAM,MAAM,2BAA2B,GAAG;IACtC;;;OAGG;IACH,aAAa,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,cAAc,EAAE,SAAS;IAClE,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC;IAElC,SAAS,CAAC,aAAa,EAAG,gBAAgB,GAAG,IAAI,CAAC;IAElD,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAEf,UAAU,EAAE,UAAU,EAAE,OAAO,GAAE,2BAAgC;IAO7E,SAAS,KAAK,UAAU,IAAK,UAAU,CAAC,SAAS,CAAC,CAEjD;IAMK,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAmDhE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;cAkClC,kBAAkB,CAC9B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC;cA2BA,mBAAmB,CAC/B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC;IAwBhB,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,MAAM;cAIjC,SAAS,CACrB,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,MAAM,EAAE,SAAS,GACjB,OAAO,CAAC,GAAG,CAAC;cA6BA,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC;IAYrD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC;IAmBrE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAI5C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAenE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAMxE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAItD,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAIhE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG;IAI/B,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG;IAIrC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAgB/B,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAalE,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGlF"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/key/repository.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,EAGH,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACrB,KAAK,MAAM,EAEd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAW,MAAM,EAAgB,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAoB,UAAU,EAAE,MAAM,SAAS,CAAC;AAKxE,OAAO,EAEH,SAAS,EAGZ,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAUhG,MAAM,MAAM,2BAA2B,GAAG;IACtC;;;OAGG;IACH,aAAa,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,cAAc,EAAE,SAAS;IAClE,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC;IAElC,SAAS,CAAC,aAAa,EAAG,gBAAgB,GAAG,IAAI,CAAC;IAElD,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAE3B;;OAEG;IACH,SAAS,CAAC,KAAK,EAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAa;gBAE5C,UAAU,EAAE,UAAU,EAAE,OAAO,GAAE,2BAAgC;IAO7E,SAAS,KAAK,UAAU,IAAK,UAAU,CAAC,SAAS,CAAC,CAEjD;IAMD,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IA6BhF,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAStE;;;;;;;;;;;;;;;OAeG;IACH,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,OAAO,CAAC,GAAG,CAAC;cAgBzD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,OAAO,CAAC,GAAG,CAAC;IA4BhE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;cAkClC,kBAAkB,CAC9B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC;cA2BA,mBAAmB,CAC/B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC;IAwBhB,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,MAAM;cAIjC,SAAS,CACrB,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,MAAM,EAAE,SAAS,GACjB,OAAO,CAAC,GAAG,CAAC;cA6BA,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC;IAYrD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC;IAmBrE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAI5C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAenE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAMxE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAItD,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAIhE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG;IAI/B,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG;IAIrC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAgB/B,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAalE,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGlF"}

package/dist/app/modules/database/repositories/key/repository.mjs

@@ -31,6 +31,9 @@ import { validateEntityJoinColumns } from "typeorm-extension";
 	secretsCipher;
 	realmRepository;
 	logger;
+	/**
+	* In-flight mints keyed `<realmId>:<use>` — see {@link mintExclusive}.
+	*/ mints = /* @__PURE__ */ new Map();
 	constructor(dataSource, options = {}) {
 		this.dataSource = dataSource;
 		this.secretsCipher = options.secretsCipher ?? null;
@@ -40,9 +43,8 @@ import { validateEntityJoinColumns } from "typeorm-extension";
 	get repository() {
 		return this.dataSource.getRepository(KeyEntity);
 	}
-	async resolveOrCreate(realmId, use) {
-		const { repository } = this;
-		const entity = await repository.findOne({
+	findActiveKey(realmId, use) {
+		return this.repository.findOne({
 			select: {
 				id: true,
 				name: true,
@@ -65,6 +67,40 @@ import { validateEntityJoinColumns } from "typeorm-extension";
 				id: "ASC"
 			}
 		});
+	}
+	async resolveOrCreate(realmId, use) {
+		const entity = await this.findActiveKey(realmId, use);
+		if (entity) return this.afterLoad(this.repository, entity);
+		return this.mintExclusive(realmId, use);
+	}
+	/**
+	* Minting is check-then-act (read, count, insert), and the callers are
+	* hot paths — the token signer resolves a signature key for EVERY
+	* issuance, the realm cipher an encryption key for every MFA seed — so
+	* a freshly created realm routinely takes several simultaneous calls
+	* and each one would insert its own key. Concurrent mints for one
+	* (realm, use) therefore share a single in-flight promise.
+	*
+	* The map is per adapter instance, and the store is a DI singleton, so
+	* it is scoped to one application: two applications in one process
+	* (the test suite) never share mint state. Separate PROCESSES can still
+	* race, which is why the duplicate stays tolerable rather than fatal —
+	* both keys are published in JWKS and verify, and `findActiveKey`
+	* orders deterministically, so a duplicate costs a redundant row, not
+	* a broken token.
+	*/ mintExclusive(realmId, use) {
+		const cacheKey = `${realmId}:${use}`;
+		const inFlight = this.mints.get(cacheKey);
+		if (inFlight) return inFlight;
+		const promise = this.mint(realmId, use);
+		this.mints.set(cacheKey, promise);
+		return promise.finally(() => {
+			this.mints.delete(cacheKey);
+		});
+	}
+	async mint(realmId, use) {
+		const { repository } = this;
+		const entity = await this.findActiveKey(realmId, use);
 		if (entity) return this.afterLoad(repository, entity);
 		const total = await repository.countBy({
 			realmId,