npm - @authup/server-core - Versions diffs - 1.0.0-beta.61 → 1.0.0-beta.63 - Mend

@authup/server-core 1.0.0-beta.61 → 1.0.0-beta.63

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (216) hide show

package/dist/core/oauth2/authorization/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["EventName","EventRefType","EventScope","IdentityType","hasInstanceof","OAUTH2_ACCESS_DENIED_ERROR_INSTANCE","OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE","OAUTH2_MFA_REQUIRED_ERROR_INSTANCE","OAuth2AccessDeniedError","OAuth2AuthenticationContextClass","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2LoginRequiredError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2ResponseTypeError","toIdentityPolicyData","DEFAULT_PROMPT_LOGIN_MAX_AGE","DEFAULT_MFA_FRESHNESS_MAX_AGE","OAuth2Authorization","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","ctx","authorize","data","identity","options","result","authorizeInner","record","scope","OAUTH2","name","AUTHORIZE","refType","CLIENT","refId","client","id","client_id","clientId","sessionId","actorType","type","actorId","actorName","realmId","realm_id","reason","builtIn","recordAuthorize","e","AUTHORIZE_FAILED","responseTypes","response_type","Array","isArray","split","responseType","CODE","unsupported","includes","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","realmMismatch","nowSeconds","Math","floor","Date","now","authTime","session","findOneById","createdAt","getTime","USER","challenge","issueMaterial","required","mfaAt","challengeRequired","enrollmentRequired","acr_values","acrValues","MFA","mfaAtSeconds","stepUpRequired","prompts","prompt","LOGIN","reauthenticationRequired","max_age","maxAge","Number","isFinite","accessPolicyId","allowed","subject","evaluate","forClient","redirectUriVerified","undefined","codeEntity","issue","authMethod","authorizationCode"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type {\n Identity, \n OAuth2AuthorizationCode, \n OAuth2AuthorizationCodeRequest, \n Session,\n} from '@authup/core-kit';\nimport {\n EventName, \n EventRefType, \n EventScope, \n IdentityType,\n} from '@authup/core-kit';\nimport { hasInstanceof } from '@authup/errors';\nimport {\n OAUTH2_ACCESS_DENIED_ERROR_INSTANCE,\n OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE,\n OAUTH2_MFA_REQUIRED_ERROR_INSTANCE,\n OAuth2AccessDeniedError,\n OAuth2AuthenticationContextClass,\n OAuth2AuthorizationPrompt,\n OAuth2AuthorizationResponseType,\n OAuth2GrantError,\n OAuth2LoginRequiredError,\n OAuth2MfaRequiredError,\n OAuth2RequestError,\n OAuth2ResponseTypeError,\n} from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport { toIdentityPolicyData } from '../../identity/permission/identity-policy-data.ts';\nimport type {\n OAuth2AuthorizationManagerContext,\n OAuth2AuthorizationOptions,\n OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IEventService, IUserAuthenticatorChallengeProvider } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\n\nconst DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;\n\n// Deliberately 60 (not 0, deviating from the plan-050 sketch): the hosted\n// challenge round-trip (stamp mfa_at → retry POST /authorize) takes seconds,\n// so a 0-window step-up could never be satisfied and would loop the ladder.\nconst DEFAULT_MFA_FRESHNESS_MAX_AGE = 60;\n\nexport class OAuth2Authorization {\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected sessionManager : ISessionManager;\n\n protected eventService? : IEventService;\n\n protected metrics? : IAuthFlowMetrics;\n\n protected promptLoginMaxAge : number;\n\n protected mfaFreshnessMaxAge : number;\n\n protected mfaChallengeProvider? : IUserAuthenticatorChallengeProvider;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n constructor(ctx: OAuth2AuthorizationManagerContext) {\n this.codeIssuer = ctx.codeIssuer;\n this.sessionManager = ctx.sessionManager;\n this.eventService = ctx.eventService;\n this.metrics = ctx.metrics;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;\n this.mfaFreshnessMaxAge = ctx.mfaFreshnessMaxAge ?? DEFAULT_MFA_FRESHNESS_MAX_AGE;\n this.mfaChallengeProvider = ctx.mfaChallengeProvider;\n }\n\n /\n Authorize with validated codeRequest.\n \n @param data\n * @param identity\n * @param options\n */\n async authorize(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n try {\n const result = await this.authorizeInner(data, identity, options);\n\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n sessionId: options.sessionId ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: {\n reason: options.client?.builtIn ? 'autoConsent' : 'consent',\n ...(data.scope ? { scope: data.scope } : {}),\n },\n });\n this.metrics?.recordAuthorize('issued');\n\n return result;\n } catch (e) {\n if (hasInstanceof(e, OAUTH2_ACCESS_DENIED_ERROR_INSTANCE)) {\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE_FAILED,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n sessionId: options.sessionId ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: { reason: 'accessPolicy' },\n });\n this.metrics?.recordAuthorize('denied');\n } else if (hasInstanceof(e, OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('login_required');\n } else if (hasInstanceof(e, OAUTH2_MFA_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('mfa_required');\n } else {\n this.metrics?.recordAuthorize('error');\n }\n\n throw e;\n }\n }\n\n protected async authorizeInner(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n // OAuth 2.1 posture: only the authorization-code response type is\n // supported — implicit/hybrid (token, id_token, none) were dropped\n // (plan 042 item 3). Defense in depth behind the request validator.\n let responseTypes : string[] = [];\n if (data.response_type) {\n responseTypes = Array.isArray(data.response_type) ?\n data.response_type :\n data.response_type.split(' ');\n }\n\n for (const responseType of responseTypes) {\n if (responseType !== OAuth2AuthorizationResponseType.CODE) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n }\n\n if (!responseTypes.includes(OAuth2AuthorizationResponseType.CODE)) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n\n if (!data.redirect_uri) {\n throw OAuth2GrantError.redirectUriMismatch();\n }\n\n const output : OAuth2AuthorizationResult = {\n redirectUri: data.redirect_uri,\n ...(data.state ? { state: data.state } : {}),\n };\n\n if (!identity) {\n throw OAuth2RequestError.identityInvalid();\n }\n\n // Realm binding: the code-request verifier stamped data.realm_id with the\n // resolved client's realm. The authenticated identity must belong to that\n // same realm — otherwise a lingering session for realm A could silently\n // mint a code/token for realm B's client (confused deputy). The error body\n // deliberately carries no identity data (no realm-enumeration oracle).\n // The comparison reads the scalar realmId column, NOT the realm\n // relation — the relation may simply not be loaded on the resolved\n // identity. An identity without a realmId fails closed the same way —\n // clean login_required, never a TypeError.\n if (\n data.realm_id &&\n identity.data.realmId !== data.realm_id\n ) {\n throw OAuth2LoginRequiredError.realmMismatch();\n }\n\n // Authentication time = the backing session's creation instant (NOT\n // refreshed_at — a token refresh must not reset it). Session-less flows\n // (e.g. HTTP Basic authorize) present live credentials on this request,\n // so the authentication time is \"now\".\n const nowSeconds = Math.floor(Date.now() / 1000);\n let authTime = nowSeconds;\n let session : Session \| null = null;\n if (options.sessionId) {\n session = await this.sessionManager.findOneById(options.sessionId);\n if (session && session.createdAt) {\n authTime = Math.floor(new Date(session.createdAt).getTime() / 1000);\n }\n }\n\n // MFA backstop (plan 049) — the authoritative server-side gate; the\n // hosted UI's challenge step is convenience. The proof is session-bound\n // (mfa_at — stamped by the challenge endpoint or the password grant's\n // otp param), so a session-less flow (HTTP Basic) cannot carry one and\n // fails closed while the user holds a confirmed device. A user without\n // a device under mfaRequired is routed to inline enrollment.\n if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {\n // requirement flags only — the interactive challenge material (the\n // webauthn nonce) is issued by the status endpoint, not this backstop.\n const challenge = await this.mfaChallengeProvider.challenge(\n identity.data.id,\n { issueMaterial: false },\n );\n if (challenge.required && !session?.mfaAt) {\n throw OAuth2MfaRequiredError.challengeRequired();\n }\n\n if (challenge.enrollmentRequired) {\n throw OAuth2MfaRequiredError.enrollmentRequired();\n }\n\n // Step-up (plan 050 stage 3): a requested `acr_values` containing\n // urn:authup:mfa is a TRIGGER (Auth0/Keycloak stance) — the proof\n // must additionally be FRESH (mfaFreshnessMaxAge window, mirroring\n // promptLoginMaxAge's absorb-the-round-trip semantics). Enforced\n // only while the user actually holds a factor — per OIDC Core\n // §5.5.1.1 acr is voluntary, so an unsatisfiable request degrades\n // to the achieved acr instead of bricking the RP.\n if (challenge.required && data.acr_values) {\n const acrValues = data.acr_values.split(' ');\n if (acrValues.includes(OAuth2AuthenticationContextClass.MFA)) {\n const mfaAtSeconds = session?.mfaAt ?\n Math.floor(new Date(session.mfaAt).getTime() / 1000) :\n null;\n if (mfaAtSeconds === null \|\| nowSeconds - mfaAtSeconds > this.mfaFreshnessMaxAge) {\n throw OAuth2MfaRequiredError.stepUpRequired();\n }\n }\n }\n }\n\n // OIDC §3.1.2.1 prompt=login / max_age freshness (enforced only when\n // requested — a plain authorize never throws here). The hosted page\n // renders the login form for prompt=login; this is the server backstop.\n const prompts = data.prompt ? data.prompt.split(' ') : [];\n if (\n prompts.includes(OAuth2AuthorizationPrompt.LOGIN) &&\n nowSeconds - authTime > this.promptLoginMaxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n\n if (\n typeof data.max_age !== 'undefined' &&\n data.max_age !== null\n ) {\n const maxAge = Number(data.max_age);\n if (\n Number.isFinite(maxAge) &&\n nowSeconds - authTime > maxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n }\n\n // Application access policy (plan 052) — the last gate before\n // issuance: a denial is only revealed to a fully-authenticated\n // (incl. second-factor) identity. A client carrying a policy id with\n // no wired evaluator denies too (never silently allow a configured\n // gate). The redirect target rides the error only when the\n // redirect_uri was pattern-verified (RFC 6749 §4.1.2.1).\n if (options.client?.accessPolicyId) {\n let allowed = false;\n\n const subject = toIdentityPolicyData(identity);\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n options.client.accessPolicyId,\n subject,\n );\n }\n\n if (!allowed) {\n throw OAuth2AccessDeniedError.forClient(\n options.redirectUriVerified && data.redirect_uri ?\n { redirectUri: data.redirect_uri, state: data.state ?? null } :\n undefined,\n );\n }\n }\n\n // The id_token is NOT minted here — the /token exchange mints it after\n // resolving the real backing session, so its `sid` is authoritative\n // (plan 042 item 6). The code carries the authentication instant.\n const codeEntity : OAuth2AuthorizationCode = await this.codeIssuer.issue(\n data,\n identity,\n {\n sessionId: options.sessionId,\n authTime,\n authMethod: session?.authMethod ?? null,\n },\n );\n\n output.authorizationCode = codeEntity.id;\n\n return output;\n }\n}\n"],"mappings":";;;;;;;;AA8CA,MAAMkB,+BAA+B;AAKrC,MAAMC,gCAAgC;AAEtC,IAAaC,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKR,aAAaQ,IAAIR;EACtB,KAAKC,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,UAAUK,IAAIL;EACnB,KAAKI,wBAAwBC,IAAID;EACjC,KAAKH,oBAAoBI,IAAIJ,qBAAqBP;EAClD,KAAKQ,qBAAqBG,IAAIH,sBAAsBP;EACpD,KAAKQ,uBAAuBE,IAAIF;CACpC;;;;;;;IASA,MAAMG,UACFC,MACAC,UACAC,UAAsC,CAAC,GACJ;EACnC,IAAI;GACA,MAAMC,SAAS,MAAM,KAAKC,eAAeJ,MAAMC,UAAUC,OAAAA;GAEzD,MAAM,KAAKV,cAAca,OAAO;IAC5BC,OAAOnC,WAAWoC;IAClBC,MAAMvC,UAAUwC;IAChBC,SAASxC,aAAayC;IACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAClDE,WAAWf,QAAQe,aAAa;IAChCC,WAAWjB,SAASkB;IACpBC,SAASnB,SAASD,KAAKc;IACvBO,WAAWpB,SAASD,KAAKQ;IACzBc,SAAStB,KAAKuB,YAAY;IAC1BvB,MAAM;KACFwB,QAAQtB,QAAQW,QAAQY,UAAU,gBAAgB;KAClD,GAAIzB,KAAKM,QAAQ,EAAEA,OAAON,KAAKM,MAAM,IAAI,CAAC;IAC9C;GACJ,CAAA;GACA,KAAKb,SAASiC,gBAAgB,QAAA;GAE9B,OAAOvB;EACX,SAASwB,GAAG;GACR,IAAItD,cAAcsD,GAAGrD,mCAAAA,GAAsC;IACvD,MAAM,KAAKkB,cAAca,OAAO;KAC5BC,OAAOnC,WAAWoC;KAClBC,MAAMvC,UAAU2D;KAChBlB,SAASxC,aAAayC;KACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAClDE,WAAWf,QAAQe,aAAa;KAChCC,WAAWjB,SAASkB;KACpBC,SAASnB,SAASD,KAAKc;KACvBO,WAAWpB,SAASD,KAAKQ;KACzBc,SAAStB,KAAKuB,YAAY;KAC1BvB,MAAM,EAAEwB,QAAQ,eAAe;IACnC,CAAA;IACA,KAAK/B,SAASiC,gBAAgB,QAAA;GAClC,OAAO,IAAIrD,cAAcsD,GAAGpD,oCAAAA,GACxB,KAAKkB,SAASiC,gBAAgB,gBAAA;QAC3B,IAAIrD,cAAcsD,GAAGnD,kCAAAA,GACxB,KAAKiB,SAASiC,gBAAgB,cAAA;QAE9B,KAAKjC,SAASiC,gBAAgB,OAAA;GAGlC,MAAMC;EACV;CACJ;CAEA,MAAgBvB,eACZJ,MACAC,UACAC,UAAsC,CAAC,GACJ;EAInC,IAAI2B,gBAA2B,CAAA;EAC/B,IAAI7B,KAAK8B,eACLD,gBAAgBE,MAAMC,QAAQhC,KAAK8B,aAAa,IAC5C9B,KAAK8B,gBACL9B,KAAK8B,cAAcG,MAAM,GAAA;EAGjC,KAAK,MAAMC,gBAAgBL,eACvB,IAAIK,iBAAiBtD,gCAAgCuD,MACjD,MAAMlD,wBAAwBmD,YAAW;EAIjD,IAAI,CAACP,cAAcQ,SAASzD,gCAAgCuD,IAAI,GAC5D,MAAMlD,wBAAwBmD,YAAW;EAG7C,IAAI,CAACpC,KAAKsC,cACN,MAAMzD,iBAAiB0D,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAazC,KAAKsC;GAClB,GAAItC,KAAK0C,QAAQ,EAAEA,OAAO1C,KAAK0C,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACzC,UACD,MAAMjB,mBAAmB2D,gBAAe;EAY5C,IACI3C,KAAKuB,YACLtB,SAASD,KAAKsB,YAAYtB,KAAKuB,UAE/B,MAAMzC,yBAAyB8D,cAAa;EAOhD,MAAMC,aAAaC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;EAC3C,IAAIC,WAAWL;EACf,IAAIM,UAA2B;EAC/B,IAAIjD,QAAQe,WAAW;GACnBkC,UAAU,MAAM,KAAK5D,eAAe6D,YAAYlD,QAAQe,SAAS;GACjE,IAAIkC,WAAWA,QAAQE,WACnBH,WAAWJ,KAAKC,MAAM,IAAIC,KAAKG,QAAQE,SAAS,CAAA,CAAEC,QAAO,IAAK,GAAA;EAEtE;EAQA,IAAI,KAAK1D,wBAAwBK,SAASkB,SAAS/C,aAAamF,MAAM;GAGlE,MAAMC,YAAY,MAAM,KAAK5D,qBAAqB4D,UAC9CvD,SAASD,KAAKc,IACd,EAAE2C,eAAe,MAAM,CAAA;GAE3B,IAAID,UAAUE,YAAY,CAACP,SAASQ,OAChC,MAAM5E,uBAAuB6E,kBAAiB;GAGlD,IAAIJ,UAAUK,oBACV,MAAM9E,uBAAuB8E,mBAAkB;GAUnD,IAAIL,UAAUE,YAAY1D,KAAK8D,YACT9D;QAAAA,KAAK8D,WAAW7B,MAAM,GACpC8B,CAAAA,CAAU1B,SAAS3D,iCAAiCsF,GAAG,GAAG;KAC1D,MAAMC,eAAed,SAASQ,QAC1Bb,KAAKC,MAAM,IAAIC,KAAKG,QAAQQ,KAAK,CAAA,CAAEL,QAAO,IAAK,GAAA,IAC/C;KACJ,IAAIW,iBAAiB,QAAQpB,aAAaoB,eAAe,KAAKtE,oBAC1D,MAAMZ,uBAAuBmF,eAAc;IAEnD;;EAER;EAMA,KADgBlE,KAAKoE,SAASpE,KAAKoE,OAAOnC,MAAM,GAAA,IAAO,CAAA,EAAA,CAE3CI,SAAS1D,0BAA0B0F,KAAK,KAChDxB,aAAaK,WAAW,KAAKxD,mBAE7B,MAAMZ,yBAAyBwF,yBAAwB;EAG3D,IACI,OAAOtE,KAAKuE,YAAY,eACxBvE,KAAKuE,YAAY,MACnB;GACE,MAAMC,SAASC,OAAOzE,KAAKuE,OAAO;GAClC,IACIE,OAAOC,SAASF,MAAAA,KAChB3B,aAAaK,WAAWsB,QAExB,MAAM1F,yBAAyBwF,yBAAwB;EAE/D;EAQA,IAAIpE,QAAQW,QAAQ8D,gBAAgB;GAChC,IAAIC,UAAU;GAEd,MAAMC,UAAU3F,qBAAqBe,QAAAA;GACrC,IAAI,KAAKJ,yBAAyBgF,SAC9BD,UAAU,MAAM,KAAK/E,sBAAsBiF,SACvC5E,QAAQW,OAAO8D,gBACfE,OAAAA;GAIR,IAAI,CAACD,SACD,MAAMnG,wBAAwBsG,UAC1B7E,QAAQ8E,uBAAuBhF,KAAKsC,eAChC;IAAEG,aAAazC,KAAKsC;IAAcI,OAAO1C,KAAK0C,SAAS;GAAK,IAC5DuC,KAAAA,CAAAA;EAGhB;EAeAzC,OAAO6C,qBAAoBH,MAVwB,KAAK5F,WAAW6F,MAC/DnF,MACAC,UACA;GACIgB,WAAWf,QAAQe;GACnBiC;GACAkC,YAAYjC,SAASiC,cAAc;EACvC,CAAA,EAAA,CAGkCtE;EAEtC,OAAO0B;CACX;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["EventName","EventRefType","EventScope","IdentityType","SessionAuthMethod","hasInstanceof","OAUTH2_ACCESS_DENIED_ERROR_INSTANCE","OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE","OAUTH2_MFA_REQUIRED_ERROR_INSTANCE","OAuth2AccessDeniedError","OAuth2AuthenticationContextClass","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2LoginRequiredError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2ResponseTypeError","toIdentityPolicyData","DEFAULT_PROMPT_LOGIN_MAX_AGE","DEFAULT_MFA_FRESHNESS_MAX_AGE","OAuth2Authorization","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","ctx","authorize","data","identity","options","result","authorizeInner","record","scope","OAUTH2","name","AUTHORIZE","refType","CLIENT","refId","client","id","client_id","clientId","sessionId","actorType","type","actorId","actorName","realmId","realm_id","reason","builtIn","recordAuthorize","e","AUTHORIZE_FAILED","responseTypes","response_type","Array","isArray","split","responseType","CODE","unsupported","includes","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","realmMismatch","nowSeconds","Math","floor","Date","now","authTime","session","findOneById","createdAt","getTime","USER","challenge","issueMaterial","externallyAuthenticated","authMethod","EXTERNAL","required","mfaAt","challengeRequired","enrollmentRequired","acr_values","acrValues","MFA","mfaAtSeconds","stepUpRequired","prompts","prompt","LOGIN","reauthenticationRequired","max_age","maxAge","Number","isFinite","accessPolicyId","allowed","subject","evaluate","forClient","redirectUriVerified","undefined","codeEntity","issue","authorizationCode"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type {\n Identity, \n OAuth2AuthorizationCode, \n OAuth2AuthorizationCodeRequest, \n Session,\n} from '@authup/core-kit';\nimport {\n EventName, \n EventRefType, \n EventScope, \n IdentityType,\n SessionAuthMethod,\n} from '@authup/core-kit';\nimport { hasInstanceof } from '@authup/errors';\nimport {\n OAUTH2_ACCESS_DENIED_ERROR_INSTANCE,\n OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE,\n OAUTH2_MFA_REQUIRED_ERROR_INSTANCE,\n OAuth2AccessDeniedError,\n OAuth2AuthenticationContextClass,\n OAuth2AuthorizationPrompt,\n OAuth2AuthorizationResponseType,\n OAuth2GrantError,\n OAuth2LoginRequiredError,\n OAuth2MfaRequiredError,\n OAuth2RequestError,\n OAuth2ResponseTypeError,\n} from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport { toIdentityPolicyData } from '../../identity/permission/identity-policy-data.ts';\nimport type {\n OAuth2AuthorizationManagerContext,\n OAuth2AuthorizationOptions,\n OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IEventService, IUserAuthenticatorChallengeProvider } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\n\nconst DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;\n\n// Deliberately 60 (not 0, deviating from the plan-050 sketch): the hosted\n// challenge round-trip (stamp mfa_at → retry POST /authorize) takes seconds,\n// so a 0-window step-up could never be satisfied and would loop the ladder.\nconst DEFAULT_MFA_FRESHNESS_MAX_AGE = 60;\n\nexport class OAuth2Authorization {\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected sessionManager : ISessionManager;\n\n protected eventService? : IEventService;\n\n protected metrics? : IAuthFlowMetrics;\n\n protected promptLoginMaxAge : number;\n\n protected mfaFreshnessMaxAge : number;\n\n protected mfaChallengeProvider? : IUserAuthenticatorChallengeProvider;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n constructor(ctx: OAuth2AuthorizationManagerContext) {\n this.codeIssuer = ctx.codeIssuer;\n this.sessionManager = ctx.sessionManager;\n this.eventService = ctx.eventService;\n this.metrics = ctx.metrics;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;\n this.mfaFreshnessMaxAge = ctx.mfaFreshnessMaxAge ?? DEFAULT_MFA_FRESHNESS_MAX_AGE;\n this.mfaChallengeProvider = ctx.mfaChallengeProvider;\n }\n\n /\n Authorize with validated codeRequest.\n \n @param data\n * @param identity\n * @param options\n */\n async authorize(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n try {\n const result = await this.authorizeInner(data, identity, options);\n\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n sessionId: options.sessionId ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: {\n reason: options.client?.builtIn ? 'autoConsent' : 'consent',\n ...(data.scope ? { scope: data.scope } : {}),\n },\n });\n this.metrics?.recordAuthorize('issued');\n\n return result;\n } catch (e) {\n if (hasInstanceof(e, OAUTH2_ACCESS_DENIED_ERROR_INSTANCE)) {\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE_FAILED,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n sessionId: options.sessionId ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: { reason: 'accessPolicy' },\n });\n this.metrics?.recordAuthorize('denied');\n } else if (hasInstanceof(e, OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('login_required');\n } else if (hasInstanceof(e, OAUTH2_MFA_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('mfa_required');\n } else {\n this.metrics?.recordAuthorize('error');\n }\n\n throw e;\n }\n }\n\n protected async authorizeInner(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n // OAuth 2.1 posture: only the authorization-code response type is\n // supported — implicit/hybrid (token, id_token, none) were dropped\n // (plan 042 item 3). Defense in depth behind the request validator.\n let responseTypes : string[] = [];\n if (data.response_type) {\n responseTypes = Array.isArray(data.response_type) ?\n data.response_type :\n data.response_type.split(' ');\n }\n\n for (const responseType of responseTypes) {\n if (responseType !== OAuth2AuthorizationResponseType.CODE) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n }\n\n if (!responseTypes.includes(OAuth2AuthorizationResponseType.CODE)) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n\n if (!data.redirect_uri) {\n throw OAuth2GrantError.redirectUriMismatch();\n }\n\n const output : OAuth2AuthorizationResult = {\n redirectUri: data.redirect_uri,\n ...(data.state ? { state: data.state } : {}),\n };\n\n if (!identity) {\n throw OAuth2RequestError.identityInvalid();\n }\n\n // Realm binding: the code-request verifier stamped data.realm_id with the\n // resolved client's realm. The authenticated identity must belong to that\n // same realm — otherwise a lingering session for realm A could silently\n // mint a code/token for realm B's client (confused deputy). The error body\n // deliberately carries no identity data (no realm-enumeration oracle).\n // The comparison reads the scalar realmId column, NOT the realm\n // relation — the relation may simply not be loaded on the resolved\n // identity. An identity without a realmId fails closed the same way —\n // clean login_required, never a TypeError.\n if (\n data.realm_id &&\n identity.data.realmId !== data.realm_id\n ) {\n throw OAuth2LoginRequiredError.realmMismatch();\n }\n\n // Authentication time = the backing session's creation instant (NOT\n // refreshed_at — a token refresh must not reset it). Session-less flows\n // (e.g. HTTP Basic authorize) present live credentials on this request,\n // so the authentication time is \"now\".\n const nowSeconds = Math.floor(Date.now() / 1000);\n let authTime = nowSeconds;\n let session : Session \| null = null;\n if (options.sessionId) {\n session = await this.sessionManager.findOneById(options.sessionId);\n if (session && session.createdAt) {\n authTime = Math.floor(new Date(session.createdAt).getTime() / 1000);\n }\n }\n\n // MFA backstop (plan 049) — the authoritative server-side gate; the\n // hosted UI's challenge step is convenience. The proof is session-bound\n // (mfa_at — stamped by the challenge endpoint or the password grant's\n // otp param), so a session-less flow (HTTP Basic) cannot carry one and\n // fails closed while the user holds a confirmed device. A user without\n // a device under mfaRequired is routed to inline enrollment.\n if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {\n // requirement flags only — the interactive challenge material (the\n // webauthn nonce) is issued by the status endpoint, not this backstop.\n const challenge = await this.mfaChallengeProvider.challenge(\n identity.data.id,\n { issueMaterial: false },\n );\n // The local second factor belongs to a local credential. A\n // session established by an external identity provider was\n // authenticated THERE, which is where MFA is configured and\n // enforced for it, so authup does not stack a factor of its own\n // on top and `mfaRequired` does not force local enrollment on\n // those users. The route is opt-in either way: an external\n // identity reaches an existing account only through the\n // bearer-authenticated link flow, since a first login provisions\n // a NEW user (plan 091). A session-less authorize (HTTP Basic) is\n // not external and keeps the gate.\n const externallyAuthenticated = session?.authMethod === SessionAuthMethod.EXTERNAL;\n\n if (!externallyAuthenticated) {\n if (challenge.required && !session?.mfaAt) {\n throw OAuth2MfaRequiredError.challengeRequired();\n }\n\n if (challenge.enrollmentRequired) {\n throw OAuth2MfaRequiredError.enrollmentRequired();\n }\n }\n\n // Step-up (plan 050 stage 3): a requested `acr_values` containing\n // urn:authup:mfa is a TRIGGER (Auth0/Keycloak stance) — the proof\n // must additionally be FRESH (mfaFreshnessMaxAge window, mirroring\n // promptLoginMaxAge's absorb-the-round-trip semantics). Enforced\n // only while the user actually holds a factor — per OIDC Core\n // §5.5.1.1 acr is voluntary, so an unsatisfiable request degrades\n // to the achieved acr instead of bricking the RP.\n //\n // This one DOES apply to an externally authenticated session: the\n // application asked for MFA explicitly, and a local factor the\n // user holds is the only way authup can answer that. Trusting the\n // upstream is the default, not a refusal to prove anything.\n if (challenge.required && data.acr_values) {\n const acrValues = data.acr_values.split(' ');\n if (acrValues.includes(OAuth2AuthenticationContextClass.MFA)) {\n const mfaAtSeconds = session?.mfaAt ?\n Math.floor(new Date(session.mfaAt).getTime() / 1000) :\n null;\n if (mfaAtSeconds === null \|\| nowSeconds - mfaAtSeconds > this.mfaFreshnessMaxAge) {\n throw OAuth2MfaRequiredError.stepUpRequired();\n }\n }\n }\n }\n\n // OIDC §3.1.2.1 prompt=login / max_age freshness (enforced only when\n // requested — a plain authorize never throws here). The hosted page\n // renders the login form for prompt=login; this is the server backstop.\n const prompts = data.prompt ? data.prompt.split(' ') : [];\n if (\n prompts.includes(OAuth2AuthorizationPrompt.LOGIN) &&\n nowSeconds - authTime > this.promptLoginMaxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n\n if (\n typeof data.max_age !== 'undefined' &&\n data.max_age !== null\n ) {\n const maxAge = Number(data.max_age);\n if (\n Number.isFinite(maxAge) &&\n nowSeconds - authTime > maxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n }\n\n // Application access policy (plan 052) — the last gate before\n // issuance: a denial is only revealed to a fully-authenticated\n // (incl. second-factor) identity. A client carrying a policy id with\n // no wired evaluator denies too (never silently allow a configured\n // gate). The redirect target rides the error only when the\n // redirect_uri was pattern-verified (RFC 6749 §4.1.2.1).\n if (options.client?.accessPolicyId) {\n let allowed = false;\n\n const subject = toIdentityPolicyData(identity);\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n options.client.accessPolicyId,\n subject,\n );\n }\n\n if (!allowed) {\n throw OAuth2AccessDeniedError.forClient(\n options.redirectUriVerified && data.redirect_uri ?\n { redirectUri: data.redirect_uri, state: data.state ?? null } :\n undefined,\n );\n }\n }\n\n // The id_token is NOT minted here — the /token exchange mints it after\n // resolving the real backing session, so its `sid` is authoritative\n // (plan 042 item 6). The code carries the authentication instant.\n const codeEntity : OAuth2AuthorizationCode = await this.codeIssuer.issue(\n data,\n identity,\n {\n sessionId: options.sessionId,\n authTime,\n authMethod: session?.authMethod ?? null,\n },\n );\n\n output.authorizationCode = codeEntity.id;\n\n return output;\n }\n}\n"],"mappings":";;;;;;;;AA+CA,MAAMmB,+BAA+B;AAKrC,MAAMC,gCAAgC;AAEtC,IAAaC,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKR,aAAaQ,IAAIR;EACtB,KAAKC,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,UAAUK,IAAIL;EACnB,KAAKI,wBAAwBC,IAAID;EACjC,KAAKH,oBAAoBI,IAAIJ,qBAAqBP;EAClD,KAAKQ,qBAAqBG,IAAIH,sBAAsBP;EACpD,KAAKQ,uBAAuBE,IAAIF;CACpC;;;;;;;IASA,MAAMG,UACFC,MACAC,UACAC,UAAsC,CAAC,GACJ;EACnC,IAAI;GACA,MAAMC,SAAS,MAAM,KAAKC,eAAeJ,MAAMC,UAAUC,OAAAA;GAEzD,MAAM,KAAKV,cAAca,OAAO;IAC5BC,OAAOpC,WAAWqC;IAClBC,MAAMxC,UAAUyC;IAChBC,SAASzC,aAAa0C;IACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAClDE,WAAWf,QAAQe,aAAa;IAChCC,WAAWjB,SAASkB;IACpBC,SAASnB,SAASD,KAAKc;IACvBO,WAAWpB,SAASD,KAAKQ;IACzBc,SAAStB,KAAKuB,YAAY;IAC1BvB,MAAM;KACFwB,QAAQtB,QAAQW,QAAQY,UAAU,gBAAgB;KAClD,GAAIzB,KAAKM,QAAQ,EAAEA,OAAON,KAAKM,MAAM,IAAI,CAAC;IAC9C;GACJ,CAAA;GACA,KAAKb,SAASiC,gBAAgB,QAAA;GAE9B,OAAOvB;EACX,SAASwB,GAAG;GACR,IAAItD,cAAcsD,GAAGrD,mCAAAA,GAAsC;IACvD,MAAM,KAAKkB,cAAca,OAAO;KAC5BC,OAAOpC,WAAWqC;KAClBC,MAAMxC,UAAU4D;KAChBlB,SAASzC,aAAa0C;KACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAClDE,WAAWf,QAAQe,aAAa;KAChCC,WAAWjB,SAASkB;KACpBC,SAASnB,SAASD,KAAKc;KACvBO,WAAWpB,SAASD,KAAKQ;KACzBc,SAAStB,KAAKuB,YAAY;KAC1BvB,MAAM,EAAEwB,QAAQ,eAAe;IACnC,CAAA;IACA,KAAK/B,SAASiC,gBAAgB,QAAA;GAClC,OAAO,IAAIrD,cAAcsD,GAAGpD,oCAAAA,GACxB,KAAKkB,SAASiC,gBAAgB,gBAAA;QAC3B,IAAIrD,cAAcsD,GAAGnD,kCAAAA,GACxB,KAAKiB,SAASiC,gBAAgB,cAAA;QAE9B,KAAKjC,SAASiC,gBAAgB,OAAA;GAGlC,MAAMC;EACV;CACJ;CAEA,MAAgBvB,eACZJ,MACAC,UACAC,UAAsC,CAAC,GACJ;EAInC,IAAI2B,gBAA2B,CAAA;EAC/B,IAAI7B,KAAK8B,eACLD,gBAAgBE,MAAMC,QAAQhC,KAAK8B,aAAa,IAC5C9B,KAAK8B,gBACL9B,KAAK8B,cAAcG,MAAM,GAAA;EAGjC,KAAK,MAAMC,gBAAgBL,eACvB,IAAIK,iBAAiBtD,gCAAgCuD,MACjD,MAAMlD,wBAAwBmD,YAAW;EAIjD,IAAI,CAACP,cAAcQ,SAASzD,gCAAgCuD,IAAI,GAC5D,MAAMlD,wBAAwBmD,YAAW;EAG7C,IAAI,CAACpC,KAAKsC,cACN,MAAMzD,iBAAiB0D,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAazC,KAAKsC;GAClB,GAAItC,KAAK0C,QAAQ,EAAEA,OAAO1C,KAAK0C,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACzC,UACD,MAAMjB,mBAAmB2D,gBAAe;EAY5C,IACI3C,KAAKuB,YACLtB,SAASD,KAAKsB,YAAYtB,KAAKuB,UAE/B,MAAMzC,yBAAyB8D,cAAa;EAOhD,MAAMC,aAAaC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;EAC3C,IAAIC,WAAWL;EACf,IAAIM,UAA2B;EAC/B,IAAIjD,QAAQe,WAAW;GACnBkC,UAAU,MAAM,KAAK5D,eAAe6D,YAAYlD,QAAQe,SAAS;GACjE,IAAIkC,WAAWA,QAAQE,WACnBH,WAAWJ,KAAKC,MAAM,IAAIC,KAAKG,QAAQE,SAAS,CAAA,CAAEC,QAAO,IAAK,GAAA;EAEtE;EAQA,IAAI,KAAK1D,wBAAwBK,SAASkB,SAAShD,aAAaoF,MAAM;GAGlE,MAAMC,YAAY,MAAM,KAAK5D,qBAAqB4D,UAC9CvD,SAASD,KAAKc,IACd,EAAE2C,eAAe,MAAM,CAAA;GAc3B,IAAI,EAF4BN,SAASQ,eAAevF,kBAAkBwF,WAE5C;IAC1B,IAAIJ,UAAUK,YAAY,CAACV,SAASW,OAChC,MAAM/E,uBAAuBgF,kBAAiB;IAGlD,IAAIP,UAAUQ,oBACV,MAAMjF,uBAAuBiF,mBAAkB;GAEvD;GAcA,IAAIR,UAAUK,YAAY7D,KAAKiE,YACTjE;QAAAA,KAAKiE,WAAWhC,MAAM,GACpCiC,CAAAA,CAAU7B,SAAS3D,iCAAiCyF,GAAG,GAAG;KAC1D,MAAMC,eAAejB,SAASW,QAC1BhB,KAAKC,MAAM,IAAIC,KAAKG,QAAQW,KAAK,CAAA,CAAER,QAAO,IAAK,GAAA,IAC/C;KACJ,IAAIc,iBAAiB,QAAQvB,aAAauB,eAAe,KAAKzE,oBAC1D,MAAMZ,uBAAuBsF,eAAc;IAEnD;;EAER;EAMA,KADgBrE,KAAKuE,SAASvE,KAAKuE,OAAOtC,MAAM,GAAA,IAAO,CAAA,EAAA,CAE3CI,SAAS1D,0BAA0B6F,KAAK,KAChD3B,aAAaK,WAAW,KAAKxD,mBAE7B,MAAMZ,yBAAyB2F,yBAAwB;EAG3D,IACI,OAAOzE,KAAK0E,YAAY,eACxB1E,KAAK0E,YAAY,MACnB;GACE,MAAMC,SAASC,OAAO5E,KAAK0E,OAAO;GAClC,IACIE,OAAOC,SAASF,MAAAA,KAChB9B,aAAaK,WAAWyB,QAExB,MAAM7F,yBAAyB2F,yBAAwB;EAE/D;EAQA,IAAIvE,QAAQW,QAAQiE,gBAAgB;GAChC,IAAIC,UAAU;GAEd,MAAMC,UAAU9F,qBAAqBe,QAAAA;GACrC,IAAI,KAAKJ,yBAAyBmF,SAC9BD,UAAU,MAAM,KAAKlF,sBAAsBoF,SACvC/E,QAAQW,OAAOiE,gBACfE,OAAAA;GAIR,IAAI,CAACD,SACD,MAAMtG,wBAAwByG,UAC1BhF,QAAQiF,uBAAuBnF,KAAKsC,eAChC;IAAEG,aAAazC,KAAKsC;IAAcI,OAAO1C,KAAK0C,SAAS;GAAK,IAC5D0C,KAAAA,CAAAA;EAGhB;EAeA5C,OAAO+C,qBAAoBF,MAVwB,KAAK/F,WAAWgG,MAC/DtF,MACAC,UACA;GACIgB,WAAWf,QAAQe;GACnBiC;GACAS,YAAYR,SAASQ,cAAc;EACvC,CAAA,EAAA,CAGkC7C;EAEtC,OAAO0B;CACX;AACJ"}

package/dist/core/oauth2/authorization/state/module.mjs CHANGED Viewed

@@ -12,9 +12,8 @@ var OAuth2AuthorizationStateManager = class {
 		return this.repository.insert(data);
 	}
 	async verify(state, input) {
-		const payload = await this.repository.findOneById(state);
+		const payload = await this.repository.popOneById(state);
 		if (!payload) throw OAuth2RequestError.stateInvalid();
-		await this.repository.remove(state);
 		if (payload.ip && input.ip !== payload.ip) throw OAuth2RequestError.stateInvalid();
 		if (payload.userAgent && input.userAgent !== payload.userAgent) throw OAuth2RequestError.stateInvalid();
 		return payload;

package/dist/core/oauth2/authorization/state/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["OAuth2RequestError","OAuth2AuthorizationStateManager","repository","save","data","insert","verify","state","input","payload","~~findOneById~~","stateInvalid","~~remove","~~ip","userAgent"],"sources":["../../../../../src/core/oauth2/authorization/state/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2RequestError } from '@authup/specs';\nimport type {\n IOAuth2AuthorizationStateManager,\n IOAuth2AuthorizeStateRepository,\n OAuth2AuthorizationState,\n} from './types.ts';\n\nexport class OAuth2AuthorizationStateManager implements IOAuth2AuthorizationStateManager {\n protected repository: IOAuth2AuthorizeStateRepository;\n\n constructor(repository: IOAuth2AuthorizeStateRepository) {\n this.repository = repository;\n }\n\n async save(data: OAuth2AuthorizationState) : Promise<string> {\n return this.repository.insert(data);\n }\n\n async verify(state: string, input: Partial<OAuth2AuthorizationState>): Promise<OAuth2AuthorizationState> {\n const payload = await this.repository.~~findOneById~~(state);\n if (!payload) {\n throw OAuth2RequestError.stateInvalid();\n }\n\n ~~// avoid replay attacks\n await this.repository.remove(state);\n\n~~ if (\n payload.ip &&\n input.ip !== payload.ip\n ) {\n throw OAuth2RequestError.stateInvalid();\n }\n\n if (\n payload.userAgent &&\n input.userAgent !== payload.userAgent\n ) {\n throw OAuth2RequestError.stateInvalid();\n }\n\n return payload;\n }\n}\n"],"mappings":";;;;;AAcA,IAAaC,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAA6C;EACrD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,KAAKC,MAAkD;EACzD,OAAO,KAAKF,WAAWG,OAAOD,IAAAA;CAClC;CAEA,MAAME,OAAOC,OAAeC,OAA6E;~~EACrG~~,MAAMC,UAAU,MAAM,KAAKP,WAAWQ,~~YAAYH~~,KAAAA;~~EAClD~~,IAAI,CAACE,SACD,MAAMT,mBAAmBW,aAAY;~~EAIzC~~,~~MAAM~~,~~KAAKT~~,~~WAAWU~~,~~OAAOL~~,~~KAAAA;EAE7B~~,~~IACIE~~,~~QAAQI,MACRL,MAAMK,OAAOJ,QAAQI,~~IAErB,~~MAAMb~~,mBAAmBW,aAAY;EAGzC,IACIF,~~QAAQK~~,~~aACRN~~,~~MAAMM~~,~~cAAcL~~,~~QAAQK~~,WAE5B,~~MAAMd~~,mBAAmBW,aAAY;EAGzC,OAAOF;CACX;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["OAuth2RequestError","OAuth2AuthorizationStateManager","repository","save","data","insert","verify","state","input","payload","popOneById","stateInvalid","ip","userAgent"],"sources":["../../../../../src/core/oauth2/authorization/state/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2RequestError } from '@authup/specs';\nimport type {\n IOAuth2AuthorizationStateManager,\n IOAuth2AuthorizeStateRepository,\n OAuth2AuthorizationState,\n} from './types.ts';\n\nexport class OAuth2AuthorizationStateManager implements IOAuth2AuthorizationStateManager {\n protected repository: IOAuth2AuthorizeStateRepository;\n\n constructor(repository: IOAuth2AuthorizeStateRepository) {\n this.repository = repository;\n }\n\n async save(data: OAuth2AuthorizationState) : Promise<string> {\n return this.repository.insert(data);\n }\n\n async verify(state: string, input: Partial<OAuth2AuthorizationState>): Promise<OAuth2AuthorizationState> {\n // The pop is the replay guard: a state is consumed by whichever\n // callback presents it first, whether or not it then passes the\n // binding checks below.\n const payload = await this.repository.popOneById(state);\n if (!payload) {\n throw OAuth2RequestError.stateInvalid();\n }\n\n if (\n payload.ip &&\n input.ip !== payload.ip\n ) {\n throw OAuth2RequestError.stateInvalid();\n }\n\n if (\n payload.userAgent &&\n input.userAgent !== payload.userAgent\n ) {\n throw OAuth2RequestError.stateInvalid();\n }\n\n return payload;\n }\n}\n"],"mappings":";;;;;AAcA,IAAaC,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAA6C;EACrD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,KAAKC,MAAkD;EACzD,OAAO,KAAKF,WAAWG,OAAOD,IAAAA;CAClC;CAEA,MAAME,OAAOC,OAAeC,OAA6E;EAIrG,MAAMC,UAAU,MAAM,KAAKP,WAAWQ,WAAWH,KAAAA;EACjD,IAAI,CAACE,SACD,MAAMT,mBAAmBW,aAAY;EAGzC,IACIF,QAAQG,MACRJ,MAAMI,OAAOH,QAAQG,IAErB,MAAMZ,mBAAmBW,aAAY;EAGzC,IACIF,QAAQI,aACRL,MAAMK,cAAcJ,QAAQI,WAE5B,MAAMb,mBAAmBW,aAAY;EAGzC,OAAOF;CACX;AACJ"}

package/dist/core/oauth2/authorization/state/types.d.ts CHANGED Viewed

@@ -12,13 +12,24 @@ export type OAuth2AuthorizationState = {
      * endpoint, never from client input.
      */
     link?: OAuth2AuthorizationStateLink;
+    /**
+     * Ties a federated login to the browser that started it (plan 094). The
+     * value is set as a cookie when the login starts and required to match
+     * when the provider sends the browser back, so a crafted callback URL
+     * opened elsewhere establishes nothing. The state's own ip / user agent
+     * cannot do this: both are chosen by whoever mints the state (#3439).
+     */
+    browserNonce?: string;
     ip: string;
     userAgent?: string | null;
 };
 export interface IOAuth2AuthorizeStateRepository {
-    findOneById(id: string): Promise<OAuth2AuthorizationState | null>;
     insert(data: OAuth2AuthorizationState): Promise<string>;
-    remove(id: string): Promise<void>;
+    /**
+     * Read and delete in one step, so two callbacks presenting the same
+     * state cannot both obtain the payload.
+     */
+    popOneById(id: string): Promise<OAuth2AuthorizationState | null>;
 }
 export interface IOAuth2AuthorizationStateManager {
     save(data: OAuth2AuthorizationState): Promise<string>;

package/dist/core/oauth2/authorization/state/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/state/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAEvE,MAAM,MAAM,4BAA4B,GAAG;IACvC,MAAM,EAAE,MAAM,CAAC;IAKf,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC,WAAW,CAAC,EAAE,8BAA8B,CAAC;IAC7C;;;;;OAKG;IACH,IAAI,CAAC,EAAE,4BAA4B,CAAC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC5C,~~WAAW,CAAC,EAAE,EAAE,~~MAAM,~~GAAI,OAAO,~~CAAC,~~wBAAwB,GAAG,~~IAAI,~~CAAC,CAAC;IAEnE,MAAM,CAAC,IAAI,~~EAAE,wBAAwB,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzD,~~MAAM~~,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;~~CACtC~~;AAED,MAAM,WAAW,gCAAgC;IAC7C,IAAI,CAAC,IAAI,EAAE,wBAAwB,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtG"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/state/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAEvE,MAAM,MAAM,4BAA4B,GAAG;IACvC,MAAM,EAAE,MAAM,CAAC;IAKf,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC,WAAW,CAAC,EAAE,8BAA8B,CAAC;IAC7C;;;;;OAKG;IACH,IAAI,CAAC,EAAE,4BAA4B,CAAC;IACpC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC5C,MAAM,CAAC,IAAI,EAAE,wBAAwB,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzD;;;OAGG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,gCAAgC;IAC7C,IAAI,CAAC,IAAI,EAAE,wBAAwB,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtG"}

package/dist/core/oauth2/end-session/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EACR,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,8BAA8B,EACjC,MAAM,YAAY,CAAC;AAEpB,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC;gBAEtB,GAAG,EAAE,8BAA8B;IASzC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAgHtE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2B/E;;;;;OAKG;IACH,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO;IAcvE;;;;OAIG;IACH,SAAS,CAAC,yBAAyB,CAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,SAAS,EAAE,MAAM,GAClB,OAAO;~~CAsBb~~"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EACR,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,8BAA8B,EACjC,MAAM,YAAY,CAAC;AAEpB,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC;gBAEtB,GAAG,EAAE,8BAA8B;IASzC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAgHtE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2B/E;;;;;OAKG;IACH,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO;IAcvE;;;;OAIG;IACH,SAAS,CAAC,yBAAyB,CAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,SAAS,EAAE,MAAM,GAClB,OAAO;CA6Bb"}

package/dist/core/oauth2/end-session/service.mjs CHANGED Viewed

@@ -120,6 +120,7 @@ var OAuth2EndSessionService = class {
 			return false;
 		}
 		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+		if (parsed.username || parsed.password) return false;
 		if (!registered) return false;
 		return isSimpleURLMatch(candidate, registered.split(","));
 	}

package/dist/core/oauth2/end-session/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["isSimpleURLMatch","isUUID","EventName","EventRefType","EventScope","OAuth2TokenKind","OAuth2EndSessionService","tokenVerifier","sessionManager","clientRepository","realmRepository","eventService","hintGracePeriod","ctx","verify","data","hintVerified","sub","subKind","sessionId","hintRealmId","audiences","id_token_hint","payload","ignoreExpiry","skipActiveCheck","kind","ID_TOKEN","isWithinHintGraceWindow","sub_kind","sid","session_id","undefined","realm_id","aud","Array","isArray","filter","entry","clientId","client_id","length","client","realmKey","realm_name","realm","resolve","findOneByIdOrName","id","expected","includes","clientName","redirectUri","name","post_logout_redirect_uri","isValidPostLogoutRedirect","postLogoutRedirectUri","state","revoke","session","findOneById","record","scope","OAUTH2","LOGOUT","refType","SESSION","refId","actorType","actorId","realmId","exp","nowSeconds","Math","floor","Date","now","registered","candidate","parsed","URL","protocol","split"],"sources":["../../../../src/core/oauth2/end-session/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { isSimpleURLMatch, isUUID } from '@authup/kit';\nimport type { Client, IdentityType } from '@authup/core-kit';\nimport { EventName, EventRefType, EventScope } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2ClientRepository } from '../client/index.ts';\nimport type { IOAuth2TokenVerifier } from '../token/index.ts';\nimport type {\n IOAuth2EndSessionService,\n OAuth2EndSessionRequest,\n OAuth2EndSessionResult,\n OAuth2EndSessionServiceContext,\n} from './types.ts';\n\nexport class OAuth2EndSessionService implements IOAuth2EndSessionService {\n protected tokenVerifier: IOAuth2TokenVerifier;\n\n protected sessionManager: ISessionManager;\n\n protected clientRepository: IOAuth2ClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected eventService?: IEventService;\n\n protected hintGracePeriod: number;\n\n constructor(ctx: OAuth2EndSessionServiceContext) {\n this.tokenVerifier = ctx.tokenVerifier;\n this.sessionManager = ctx.sessionManager;\n this.clientRepository = ctx.clientRepository;\n this.realmRepository = ctx.realmRepository;\n this.eventService = ctx.eventService;\n this.hintGracePeriod = ctx.hintGracePeriod ?? 0;\n }\n\n async verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult> {\n let hintVerified = false;\n let sub: string \| undefined;\n let subKind: string \| undefined;\n let sessionId: string \| undefined;\n let hintRealmId: string \| undefined;\n let audiences: string[] = [];\n\n if (data.id_token_hint) {\n try {\n // Signature + kind are the anchors; exp is skipped (a logout hint\n // is routinely expired) and the cache blocklist is irrelevant.\n const payload = await this.tokenVerifier.verify(data.id_token_hint, {\n ignoreExpiry: true,\n skipActiveCheck: true,\n });\n\n // MUST be an id_token — access/refresh tokens also carry\n // session_id, so accepting them would let a leaked access token\n // act as a logout weapon.\n if (payload.kind === OAuth2TokenKind.ID_TOKEN && this.isWithinHintGraceWindow(payload)) {\n hintVerified = true;\n sub = payload.sub;\n subKind = payload.sub_kind;\n sessionId = payload.sid ?? payload.session_id ?? undefined;\n hintRealmId = payload.realm_id ?? undefined;\n // aud may be a single string or an array (JWT spec).\n const { aud } = payload;\n if (Array.isArray(aud)) {\n audiences = aud.filter((entry): entry is string => typeof entry === 'string');\n } else if (typeof aud === 'string') {\n audiences = [aud];\n }\n }\n } catch {\n // forged / unverifiable hint → stays unverified (no revoke)\n }\n }\n\n // Resolve a single client for the aud cross-check and redirect\n // validation: the request's client_id, else the hint's sole audience\n // (ambiguous for a multi-aud hint).\n const clientId = data.client_id ?? (audiences.length === 1 ? audiences[0] : undefined);\n\n let client: Client \| null = null;\n if (clientId) {\n // Scope a name-identified client to the request's realm hint; a\n // VERIFIED hint's own realm claim serves as fallback (claims from an\n // unverified hint are never trusted). No master fallback here\n // (unlike /token): a bogus hint must NOT silently resolve a\n // same-named client in master → null realm.\n const realmKey = data.realm_id ?? data.realm_name ?? (hintVerified ? hintRealmId : undefined);\n const realm = await this.realmRepository.resolve(realmKey, false);\n\n // Fail closed instead of dropping the realm predicate: a supplied\n // realm key that does not resolve never degrades to an unscoped\n // lookup, and a NAME-form client_id without any realm key is\n // ambiguous (client names are only unique per realm, and every\n // realm carries the same-named system clients — same rule as the\n // /authorize verifier). A UUID is globally unique and needs no\n // scope; the sole-aud-derived clientId is always a UUID.\n if (realm) {\n client = await this.clientRepository.findOneByIdOrName(clientId, realm.id);\n } else if (!realmKey && isUUID(clientId)) {\n client = await this.clientRepository.findOneByIdOrName(clientId);\n }\n }\n\n // aud/client_id cross-check: when the request supplies a client_id on a\n // verified hint, it MUST denote one of the hint's audiences. The aud is\n // the client UUID, so a name-form client_id is compared via its resolved\n // client's id. Fail closed: an aud-less hint, or a name that did not\n // resolve, counts as unverified.\n if (hintVerified && data.client_id) {\n const expected = isUUID(data.client_id) ? data.client_id : client?.id;\n if (audiences.length === 0 \|\| !expected \|\| !audiences.includes(expected)) {\n hintVerified = false;\n sub = undefined;\n subKind = undefined;\n sessionId = undefined;\n }\n }\n\n let clientName: string \| undefined;\n let redirectUri: string \| undefined;\n\n // Redirect validation is independent of hint verification — the\n // click-gated confirm page (unverified hint / hint-less request) still\n // honors a registered post-logout redirect.\n if (client) {\n clientName = client.name;\n if (\n data.post_logout_redirect_uri &&\n this.isValidPostLogoutRedirect(client.postLogoutRedirectUri, data.post_logout_redirect_uri)\n ) {\n redirectUri = data.post_logout_redirect_uri;\n }\n }\n\n return {\n hintVerified,\n ...(hintVerified ? {\n sub,\n subKind,\n sessionId,\n } : {}),\n ...(clientId ? { clientId } : {}),\n ...(clientName ? { clientName } : {}),\n ...(redirectUri ? { redirectUri, ...(data.state ? { state: data.state } : {}) } : {}),\n };\n }\n\n async revoke(sessionId: string, sub: string, subKind: string): Promise<boolean> {\n const session = await this.sessionManager.findOneById(sessionId);\n if (!session) {\n return false;\n }\n\n // Never revoke a session that does not belong to the hint's subject.\n if (session.sub !== sub \|\| session.subKind !== subKind) {\n return false;\n }\n\n await this.sessionManager.revoke(sessionId);\n\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.LOGOUT,\n refType: EventRefType.SESSION,\n refId: sessionId,\n sessionId,\n actorType: session.subKind as `${IdentityType}`,\n actorId: session.sub,\n realmId: session.realmId,\n });\n\n return true;\n }\n\n /\n With a positive `hintGracePeriod`, an expired hint is honored only within\n * the window past `exp` — beyond it a leaked id_token stops being a\n * replayable remote logout (the hint counts as unverified; the click-gated\n * confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.\n /\n protected isWithinHintGraceWindow(payload: OAuth2TokenPayload): boolean {\n if (this.hintGracePeriod <= 0) {\n return true;\n }\n\n // a bounded window without an exp claim to judge against fails closed\n if (typeof payload.exp !== 'number') {\n return false;\n }\n\n const nowSeconds = Math.floor(Date.now() / 1000);\n return nowSeconds - payload.exp <= this.hintGracePeriod;\n }\n\n /\n A post-logout redirect is honored only when it is an absolute http(s) URL\n * that matches a registered client redirect pattern (defense against open\n * redirects to attacker-controlled URLs).\n /\n protected isValidPostLogoutRedirect(\n registered: string \| null \| undefined,\n candidate: string,\n ): boolean {\n let parsed: URL;\n try {\n parsed = new URL(candidate);\n } catch {\n return false;\n }\n\n if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n return false;\n }\n\n if (!registered) {\n return false;\n }\n\n // isSimpleURLMatch, never isSimpleMatch: matched against the raw\n // string, a `` in a registered pattern's host absorbs a `?`, `#` or\n // `\\`, which would turn this endpoint into a server-issued open\n // redirect carrying `state`.\n return isSimpleURLMatch(candidate, registered.split(','));\n }\n}\n"],"mappings":";;;;;;;AAuBA,IAAaM,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,gBAAgBM,IAAIN;EACzB,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,kBAAkBC,IAAID,mBAAmB;CAClD;CAEA,MAAME,OAAOC,MAAgE;EACzE,IAAIC,eAAe;EACnB,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC,YAAsB,CAAA;EAE1B,IAAIN,KAAKO,eACL,IAAI;GAGA,MAAMC,UAAU,MAAM,KAAKhB,cAAcO,OAAOC,KAAKO,eAAe;IAChEE,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAKA,IAAIF,QAAQG,SAASrB,gBAAgBsB,YAAY,KAAKC,wBAAwBL,OAAAA,GAAU;IACpFP,eAAe;IACfC,MAAMM,QAAQN;IACdC,UAAUK,QAAQM;IAClBV,YAAYI,QAAQO,OAAOP,QAAQQ,cAAcC,KAAAA;IACjDZ,cAAcG,QAAQU,YAAYD,KAAAA;IAElC,MAAM,EAAEE,QAAQX;IAChB,IAAIY,MAAMC,QAAQF,GAAAA,GACdb,YAAYa,IAAIG,QAAQC,UAA2B,OAAOA,UAAU,QAAA;SACjE,IAAI,OAAOJ,QAAQ,UACtBb,YAAY,CAACa,GAAI;GAEzB;EACJ,QAAQ,CAER;EAMJ,MAAMK,WAAWxB,KAAKyB,cAAcnB,UAAUoB,WAAW,IAAIpB,UAAU,KAAKW,KAAAA;EAE5E,IAAIU,SAAwB;EAC5B,IAAIH,UAAU;GAMV,MAAMI,WAAW5B,KAAKkB,YAAYlB,KAAK6B,eAAe5B,eAAeI,cAAcY,KAAAA;GACnF,MAAMa,QAAQ,MAAM,KAAKnC,gBAAgBoC,QAAQH,UAAU,KAAA;GAS3D,IAAIE,OACAH,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,UAAUM,MAAMG,EAAE;QACtE,IAAI,CAACL,YAAY1C,OAAOsC,QAAAA,GAC3BG,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,QAAAA;EAE/D;EAOA,IAAIvB,gBAAgBD,KAAKyB,WAAW;GAChC,MAAMS,WAAWhD,OAAOc,KAAKyB,SAAS,IAAIzB,KAAKyB,YAAYE,QAAQM;GACnE,IAAI3B,UAAUoB,WAAW,KAAK,CAACQ,YAAY,CAAC5B,UAAU6B,SAASD,QAAAA,GAAW;IACtEjC,eAAe;IACfC,MAAMe,KAAAA;IACNd,UAAUc,KAAAA;IACVb,YAAYa,KAAAA;GAChB;EACJ;EAEA,IAAImB;EACJ,IAAIC;EAKJ,IAAIV,QAAQ;GACRS,aAAaT,OAAOW;GACpB,IACItC,KAAKuC,4BACL,KAAKC,0BAA0Bb,OAAOc,uBAAuBzC,KAAKuC,wBAAwB,GAE1FF,cAAcrC,KAAKuC;EAE3B;EAEA,OAAO;GACHtC;GACA,GAAIA,eAAe;IACfC;IACAC;IACAC;GACJ,IAAI,CAAC;GACL,GAAIoB,WAAW,EAAEA,SAAS,IAAI,CAAC;GAC/B,GAAIY,aAAa,EAAEA,WAAW,IAAI,CAAC;GACnC,GAAIC,cAAc;IAAEA;IAAa,GAAIrC,KAAK0C,QAAQ,EAAEA,OAAO1C,KAAK0C,MAAM,IAAI,CAAC;GAAG,IAAI,CAAC;EACvF;CACJ;CAEA,MAAMC,OAAOvC,WAAmBF,KAAaC,SAAmC;EAC5E,MAAMyC,UAAU,MAAM,KAAKnD,eAAeoD,YAAYzC,SAAAA;EACtD,IAAI,CAACwC,SACD,OAAO;EAIX,IAAIA,QAAQ1C,QAAQA,OAAO0C,QAAQzC,YAAYA,SAC3C,OAAO;EAGX,MAAM,KAAKV,eAAekD,OAAOvC,SAAAA;EAEjC,MAAM,KAAKR,cAAckD,OAAO;GAC5BC,OAAO1D,WAAW2D;GAClBV,MAAMnD,UAAU8D;GAChBC,SAAS9D,aAAa+D;GACtBC,OAAOhD;GACPA;GACAiD,WAAWT,QAAQzC;GACnBmD,SAASV,QAAQ1C;GACjBqD,SAASX,QAAQW;EACrB,CAAA;EAEA,OAAO;CACX;;;;;;IAQA,wBAAkC/C,SAAsC;EACpE,IAAI,KAAKX,mBAAmB,GACxB,OAAO;EAIX,IAAI,OAAOW,QAAQgD,QAAQ,UACvB,OAAO;EAIX,OADmBE,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GACpCJ,IAAajD,QAAQgD,OAAO,KAAK3D;CAC5C;;;;;IAOA,0BACIiE,YACAC,WACO;EACP,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIC,IAAIF,SAAAA;EACrB,QAAQ;GACJ,OAAO;EACX;EAEA,IAAIC,OAAOE,aAAa,WAAWF,OAAOE,aAAa,UACnD,OAAO;EAGX,IAAI,CAACJ,YACD,OAAO;EAOX,OAAO7E,iBAAiB8E,WAAWD,WAAWK,MAAM,GAAA,CAAA;CACxD;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["isSimpleURLMatch","isUUID","EventName","EventRefType","EventScope","OAuth2TokenKind","OAuth2EndSessionService","tokenVerifier","sessionManager","clientRepository","realmRepository","eventService","hintGracePeriod","ctx","verify","data","hintVerified","sub","subKind","sessionId","hintRealmId","audiences","id_token_hint","payload","ignoreExpiry","skipActiveCheck","kind","ID_TOKEN","isWithinHintGraceWindow","sub_kind","sid","session_id","undefined","realm_id","aud","Array","isArray","filter","entry","clientId","client_id","length","client","realmKey","realm_name","realm","resolve","findOneByIdOrName","id","expected","includes","clientName","redirectUri","name","post_logout_redirect_uri","isValidPostLogoutRedirect","postLogoutRedirectUri","state","revoke","session","findOneById","record","scope","OAUTH2","LOGOUT","refType","SESSION","refId","actorType","actorId","realmId","exp","nowSeconds","Math","floor","Date","now","registered","candidate","parsed","URL","protocol","username","password","split"],"sources":["../../../../src/core/oauth2/end-session/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { isSimpleURLMatch, isUUID } from '@authup/kit';\nimport type { Client, IdentityType } from '@authup/core-kit';\nimport { EventName, EventRefType, EventScope } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2ClientRepository } from '../client/index.ts';\nimport type { IOAuth2TokenVerifier } from '../token/index.ts';\nimport type {\n IOAuth2EndSessionService,\n OAuth2EndSessionRequest,\n OAuth2EndSessionResult,\n OAuth2EndSessionServiceContext,\n} from './types.ts';\n\nexport class OAuth2EndSessionService implements IOAuth2EndSessionService {\n protected tokenVerifier: IOAuth2TokenVerifier;\n\n protected sessionManager: ISessionManager;\n\n protected clientRepository: IOAuth2ClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected eventService?: IEventService;\n\n protected hintGracePeriod: number;\n\n constructor(ctx: OAuth2EndSessionServiceContext) {\n this.tokenVerifier = ctx.tokenVerifier;\n this.sessionManager = ctx.sessionManager;\n this.clientRepository = ctx.clientRepository;\n this.realmRepository = ctx.realmRepository;\n this.eventService = ctx.eventService;\n this.hintGracePeriod = ctx.hintGracePeriod ?? 0;\n }\n\n async verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult> {\n let hintVerified = false;\n let sub: string \| undefined;\n let subKind: string \| undefined;\n let sessionId: string \| undefined;\n let hintRealmId: string \| undefined;\n let audiences: string[] = [];\n\n if (data.id_token_hint) {\n try {\n // Signature + kind are the anchors; exp is skipped (a logout hint\n // is routinely expired) and the cache blocklist is irrelevant.\n const payload = await this.tokenVerifier.verify(data.id_token_hint, {\n ignoreExpiry: true,\n skipActiveCheck: true,\n });\n\n // MUST be an id_token — access/refresh tokens also carry\n // session_id, so accepting them would let a leaked access token\n // act as a logout weapon.\n if (payload.kind === OAuth2TokenKind.ID_TOKEN && this.isWithinHintGraceWindow(payload)) {\n hintVerified = true;\n sub = payload.sub;\n subKind = payload.sub_kind;\n sessionId = payload.sid ?? payload.session_id ?? undefined;\n hintRealmId = payload.realm_id ?? undefined;\n // aud may be a single string or an array (JWT spec).\n const { aud } = payload;\n if (Array.isArray(aud)) {\n audiences = aud.filter((entry): entry is string => typeof entry === 'string');\n } else if (typeof aud === 'string') {\n audiences = [aud];\n }\n }\n } catch {\n // forged / unverifiable hint → stays unverified (no revoke)\n }\n }\n\n // Resolve a single client for the aud cross-check and redirect\n // validation: the request's client_id, else the hint's sole audience\n // (ambiguous for a multi-aud hint).\n const clientId = data.client_id ?? (audiences.length === 1 ? audiences[0] : undefined);\n\n let client: Client \| null = null;\n if (clientId) {\n // Scope a name-identified client to the request's realm hint; a\n // VERIFIED hint's own realm claim serves as fallback (claims from an\n // unverified hint are never trusted). No master fallback here\n // (unlike /token): a bogus hint must NOT silently resolve a\n // same-named client in master → null realm.\n const realmKey = data.realm_id ?? data.realm_name ?? (hintVerified ? hintRealmId : undefined);\n const realm = await this.realmRepository.resolve(realmKey, false);\n\n // Fail closed instead of dropping the realm predicate: a supplied\n // realm key that does not resolve never degrades to an unscoped\n // lookup, and a NAME-form client_id without any realm key is\n // ambiguous (client names are only unique per realm, and every\n // realm carries the same-named system clients — same rule as the\n // /authorize verifier). A UUID is globally unique and needs no\n // scope; the sole-aud-derived clientId is always a UUID.\n if (realm) {\n client = await this.clientRepository.findOneByIdOrName(clientId, realm.id);\n } else if (!realmKey && isUUID(clientId)) {\n client = await this.clientRepository.findOneByIdOrName(clientId);\n }\n }\n\n // aud/client_id cross-check: when the request supplies a client_id on a\n // verified hint, it MUST denote one of the hint's audiences. The aud is\n // the client UUID, so a name-form client_id is compared via its resolved\n // client's id. Fail closed: an aud-less hint, or a name that did not\n // resolve, counts as unverified.\n if (hintVerified && data.client_id) {\n const expected = isUUID(data.client_id) ? data.client_id : client?.id;\n if (audiences.length === 0 \|\| !expected \|\| !audiences.includes(expected)) {\n hintVerified = false;\n sub = undefined;\n subKind = undefined;\n sessionId = undefined;\n }\n }\n\n let clientName: string \| undefined;\n let redirectUri: string \| undefined;\n\n // Redirect validation is independent of hint verification — the\n // click-gated confirm page (unverified hint / hint-less request) still\n // honors a registered post-logout redirect.\n if (client) {\n clientName = client.name;\n if (\n data.post_logout_redirect_uri &&\n this.isValidPostLogoutRedirect(client.postLogoutRedirectUri, data.post_logout_redirect_uri)\n ) {\n redirectUri = data.post_logout_redirect_uri;\n }\n }\n\n return {\n hintVerified,\n ...(hintVerified ? {\n sub,\n subKind,\n sessionId,\n } : {}),\n ...(clientId ? { clientId } : {}),\n ...(clientName ? { clientName } : {}),\n ...(redirectUri ? { redirectUri, ...(data.state ? { state: data.state } : {}) } : {}),\n };\n }\n\n async revoke(sessionId: string, sub: string, subKind: string): Promise<boolean> {\n const session = await this.sessionManager.findOneById(sessionId);\n if (!session) {\n return false;\n }\n\n // Never revoke a session that does not belong to the hint's subject.\n if (session.sub !== sub \|\| session.subKind !== subKind) {\n return false;\n }\n\n await this.sessionManager.revoke(sessionId);\n\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.LOGOUT,\n refType: EventRefType.SESSION,\n refId: sessionId,\n sessionId,\n actorType: session.subKind as `${IdentityType}`,\n actorId: session.sub,\n realmId: session.realmId,\n });\n\n return true;\n }\n\n /\n With a positive `hintGracePeriod`, an expired hint is honored only within\n * the window past `exp` — beyond it a leaked id_token stops being a\n * replayable remote logout (the hint counts as unverified; the click-gated\n * confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.\n /\n protected isWithinHintGraceWindow(payload: OAuth2TokenPayload): boolean {\n if (this.hintGracePeriod <= 0) {\n return true;\n }\n\n // a bounded window without an exp claim to judge against fails closed\n if (typeof payload.exp !== 'number') {\n return false;\n }\n\n const nowSeconds = Math.floor(Date.now() / 1000);\n return nowSeconds - payload.exp <= this.hintGracePeriod;\n }\n\n /\n A post-logout redirect is honored only when it is an absolute http(s) URL\n * that matches a registered client redirect pattern (defense against open\n * redirects to attacker-controlled URLs).\n /\n protected isValidPostLogoutRedirect(\n registered: string \| null \| undefined,\n candidate: string,\n ): boolean {\n let parsed: URL;\n try {\n parsed = new URL(candidate);\n } catch {\n return false;\n }\n\n if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n return false;\n }\n\n // The matcher canonicalizes the candidate (userinfo dropped) while the\n // redirect is built from the raw value, so a credential blob would\n // ride the Location header (#3455).\n if (parsed.username \|\| parsed.password) {\n return false;\n }\n\n if (!registered) {\n return false;\n }\n\n // isSimpleURLMatch, never isSimpleMatch: matched against the raw\n // string, a `` in a registered pattern's host absorbs a `?`, `#` or\n // `\\`, which would turn this endpoint into a server-issued open\n // redirect carrying `state`.\n return isSimpleURLMatch(candidate, registered.split(','));\n }\n}\n"],"mappings":";;;;;;;AAuBA,IAAaM,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,gBAAgBM,IAAIN;EACzB,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,kBAAkBC,IAAID,mBAAmB;CAClD;CAEA,MAAME,OAAOC,MAAgE;EACzE,IAAIC,eAAe;EACnB,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC,YAAsB,CAAA;EAE1B,IAAIN,KAAKO,eACL,IAAI;GAGA,MAAMC,UAAU,MAAM,KAAKhB,cAAcO,OAAOC,KAAKO,eAAe;IAChEE,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAKA,IAAIF,QAAQG,SAASrB,gBAAgBsB,YAAY,KAAKC,wBAAwBL,OAAAA,GAAU;IACpFP,eAAe;IACfC,MAAMM,QAAQN;IACdC,UAAUK,QAAQM;IAClBV,YAAYI,QAAQO,OAAOP,QAAQQ,cAAcC,KAAAA;IACjDZ,cAAcG,QAAQU,YAAYD,KAAAA;IAElC,MAAM,EAAEE,QAAQX;IAChB,IAAIY,MAAMC,QAAQF,GAAAA,GACdb,YAAYa,IAAIG,QAAQC,UAA2B,OAAOA,UAAU,QAAA;SACjE,IAAI,OAAOJ,QAAQ,UACtBb,YAAY,CAACa,GAAI;GAEzB;EACJ,QAAQ,CAER;EAMJ,MAAMK,WAAWxB,KAAKyB,cAAcnB,UAAUoB,WAAW,IAAIpB,UAAU,KAAKW,KAAAA;EAE5E,IAAIU,SAAwB;EAC5B,IAAIH,UAAU;GAMV,MAAMI,WAAW5B,KAAKkB,YAAYlB,KAAK6B,eAAe5B,eAAeI,cAAcY,KAAAA;GACnF,MAAMa,QAAQ,MAAM,KAAKnC,gBAAgBoC,QAAQH,UAAU,KAAA;GAS3D,IAAIE,OACAH,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,UAAUM,MAAMG,EAAE;QACtE,IAAI,CAACL,YAAY1C,OAAOsC,QAAAA,GAC3BG,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,QAAAA;EAE/D;EAOA,IAAIvB,gBAAgBD,KAAKyB,WAAW;GAChC,MAAMS,WAAWhD,OAAOc,KAAKyB,SAAS,IAAIzB,KAAKyB,YAAYE,QAAQM;GACnE,IAAI3B,UAAUoB,WAAW,KAAK,CAACQ,YAAY,CAAC5B,UAAU6B,SAASD,QAAAA,GAAW;IACtEjC,eAAe;IACfC,MAAMe,KAAAA;IACNd,UAAUc,KAAAA;IACVb,YAAYa,KAAAA;GAChB;EACJ;EAEA,IAAImB;EACJ,IAAIC;EAKJ,IAAIV,QAAQ;GACRS,aAAaT,OAAOW;GACpB,IACItC,KAAKuC,4BACL,KAAKC,0BAA0Bb,OAAOc,uBAAuBzC,KAAKuC,wBAAwB,GAE1FF,cAAcrC,KAAKuC;EAE3B;EAEA,OAAO;GACHtC;GACA,GAAIA,eAAe;IACfC;IACAC;IACAC;GACJ,IAAI,CAAC;GACL,GAAIoB,WAAW,EAAEA,SAAS,IAAI,CAAC;GAC/B,GAAIY,aAAa,EAAEA,WAAW,IAAI,CAAC;GACnC,GAAIC,cAAc;IAAEA;IAAa,GAAIrC,KAAK0C,QAAQ,EAAEA,OAAO1C,KAAK0C,MAAM,IAAI,CAAC;GAAG,IAAI,CAAC;EACvF;CACJ;CAEA,MAAMC,OAAOvC,WAAmBF,KAAaC,SAAmC;EAC5E,MAAMyC,UAAU,MAAM,KAAKnD,eAAeoD,YAAYzC,SAAAA;EACtD,IAAI,CAACwC,SACD,OAAO;EAIX,IAAIA,QAAQ1C,QAAQA,OAAO0C,QAAQzC,YAAYA,SAC3C,OAAO;EAGX,MAAM,KAAKV,eAAekD,OAAOvC,SAAAA;EAEjC,MAAM,KAAKR,cAAckD,OAAO;GAC5BC,OAAO1D,WAAW2D;GAClBV,MAAMnD,UAAU8D;GAChBC,SAAS9D,aAAa+D;GACtBC,OAAOhD;GACPA;GACAiD,WAAWT,QAAQzC;GACnBmD,SAASV,QAAQ1C;GACjBqD,SAASX,QAAQW;EACrB,CAAA;EAEA,OAAO;CACX;;;;;;IAQA,wBAAkC/C,SAAsC;EACpE,IAAI,KAAKX,mBAAmB,GACxB,OAAO;EAIX,IAAI,OAAOW,QAAQgD,QAAQ,UACvB,OAAO;EAIX,OADmBE,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GACpCJ,IAAajD,QAAQgD,OAAO,KAAK3D;CAC5C;;;;;IAOA,0BACIiE,YACAC,WACO;EACP,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIC,IAAIF,SAAAA;EACrB,QAAQ;GACJ,OAAO;EACX;EAEA,IAAIC,OAAOE,aAAa,WAAWF,OAAOE,aAAa,UACnD,OAAO;EAMX,IAAIF,OAAOG,YAAYH,OAAOI,UAC1B,OAAO;EAGX,IAAI,CAACN,YACD,OAAO;EAOX,OAAO7E,iBAAiB8E,WAAWD,WAAWO,MAAM,GAAA,CAAA;CACxD;AACJ"}

package/dist/core/oauth2/federated-login/constants.d.ts ADDED Viewed

@@ -0,0 +1,22 @@
+/**
+ * Lifetime of a pending federated login (plan 094).
+ *
+ * It is completed by the very next page load, so it needs to cover a redirect
+ * and a bootstrap, not a user's attention span. It is also the lifetime of the
+ * session the callback creates, so an abandoned login self-expires and is
+ * swept with the regular session sweep; completion extends it to the full
+ * session lifetime.
+ */
+export declare const OAUTH2_FEDERATED_LOGIN_TTL: number;
+/**
+ * The cookie carrying the pending login between the provider callback and the
+ * hosted page that completes it.
+ *
+ * A cookie rather than a query parameter, which is what Keycloak and Authentik
+ * both do: the browser that STARTED the login is the only one that can present
+ * it, no other origin can set it, and nothing redeemable travels in a URL that
+ * reaches history, logs or a referrer. `SameSite=Lax` keeps it off cross-site
+ * requests, so a page on another origin cannot drive the completion.
+ */
+export declare const OAUTH2_FEDERATED_LOGIN_COOKIE = "authup_federated_login";
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/oauth2/federated-login/constants.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/constants.ts"],"names":[],"mappings":"AAOA;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,QAAgB,CAAC;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,2BAA2B,CAAC"}

package/dist/core/oauth2/federated-login/constants.mjs ADDED Viewed

@@ -0,0 +1,27 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/oauth2/federated-login/constants.ts
+/**
+* Lifetime of a pending federated login (plan 094).
+*
+* It is completed by the very next page load, so it needs to cover a redirect
+* and a bootstrap, not a user's attention span. It is also the lifetime of the
+* session the callback creates, so an abandoned login self-expires and is
+* swept with the regular session sweep; completion extends it to the full
+* session lifetime.
+*/ const OAUTH2_FEDERATED_LOGIN_TTL = 3e5;
+/**
+* The cookie carrying the pending login between the provider callback and the
+* hosted page that completes it.
+*
+* A cookie rather than a query parameter, which is what Keycloak and Authentik
+* both do: the browser that STARTED the login is the only one that can present
+* it, no other origin can set it, and nothing redeemable travels in a URL that
+* reaches history, logs or a referrer. `SameSite=Lax` keeps it off cross-site
+* requests, so a page on another origin cannot drive the completion.
+*/ const OAUTH2_FEDERATED_LOGIN_COOKIE = "authup_federated_login";
+//#endregion
+export { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL };
+//# sourceMappingURL=constants.mjs.map

package/dist/core/oauth2/federated-login/constants.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"constants.mjs","names":["OAUTH2_FEDERATED_LOGIN_TTL","OAUTH2_FEDERATED_LOGIN_COOKIE"],"sources":["../../../../src/core/oauth2/federated-login/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Lifetime of a pending federated login (plan 094).\n *\n * It is completed by the very next page load, so it needs to cover a redirect\n * and a bootstrap, not a user's attention span. It is also the lifetime of the\n * session the callback creates, so an abandoned login self-expires and is\n * swept with the regular session sweep; completion extends it to the full\n * session lifetime.\n */\nexport const OAUTH2_FEDERATED_LOGIN_TTL = 1000 * 60 * 5;\n\n/**\n * The cookie carrying the pending login between the provider callback and the\n * hosted page that completes it.\n *\n * A cookie rather than a query parameter, which is what Keycloak and Authentik\n * both do: the browser that STARTED the login is the only one that can present\n * it, no other origin can set it, and nothing redeemable travels in a URL that\n * reaches history, logs or a referrer. `SameSite=Lax` keeps it off cross-site\n * requests, so a page on another origin cannot drive the completion.\n */\nexport const OAUTH2_FEDERATED_LOGIN_COOKIE = 'authup_federated_login';\n"],"mappings":";;;;;;;;;;;;GAgBA,MAAaA,6BAA6B;;;;;;;;;;GAY1C,MAAaC,gCAAgC"}

package/dist/core/oauth2/federated-login/index.d.ts ADDED Viewed

@@ -0,0 +1,4 @@
+export * from './constants.ts';
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/federated-login/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/federated-login/index.mjs ADDED Viewed

@@ -0,0 +1,7 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL } from "./constants.mjs";
+import { OAuth2FederatedLoginRefusal } from "./types.mjs";
+import { OAuth2FederatedLoginService } from "./module.mjs";
+export { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL, OAuth2FederatedLoginRefusal, OAuth2FederatedLoginService };

package/dist/core/oauth2/federated-login/module.d.ts ADDED Viewed

@@ -0,0 +1,29 @@
+import type { Logger } from '@authup/server-kit';
+import type { OAuth2TokenGrantResponse } from '@authup/specs';
+import type { IEventService, IRealmRepository } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
+import type { ISessionManager } from '../../authentication/index.ts';
+import type { IIdentityProviderAccountManager } from '../../identity/provider/account/types.ts';
+import type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';
+import type { IOAuth2AuthorizationCodeRequestVerifier } from '../authorization/index.ts';
+import type { IOAuth2TokenIssuer } from '../token/index.ts';
+import type { IOAuth2FederatedLoginService, IOAuth2FederatedLoginStore, OAuth2FederatedLoginAuthenticatorFactory, OAuth2FederatedLoginCompleteHandoffInput, OAuth2FederatedLoginCompleteInput, OAuth2FederatedLoginCompleteResult, OAuth2FederatedLoginServiceContext, OAuth2FederatedLoginServiceOptions } from './types.ts';
+export declare class OAuth2FederatedLoginService implements IOAuth2FederatedLoginService {
+    protected options: OAuth2FederatedLoginServiceOptions;
+    protected accountManager: IIdentityProviderAccountManager;
+    protected realmRepository: IRealmRepository;
+    protected codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
+    protected sessionManager: ISessionManager;
+    protected pendingLoginStore: IOAuth2FederatedLoginStore;
+    protected accessTokenIssuer: IOAuth2TokenIssuer;
+    protected refreshTokenIssuer: IOAuth2TokenIssuer;
+    protected accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    protected eventService?: IEventService;
+    protected metrics?: IAuthFlowMetrics;
+    protected logger?: Logger;
+    protected authenticatorFactory: OAuth2FederatedLoginAuthenticatorFactory;
+    constructor(ctx: OAuth2FederatedLoginServiceContext);
+    complete(input: OAuth2FederatedLoginCompleteInput): Promise<OAuth2FederatedLoginCompleteResult>;
+    completeHandoff(input: OAuth2FederatedLoginCompleteHandoffInput): Promise<OAuth2TokenGrantResponse>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/federated-login/module.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/module.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAQlF,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGrE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAIhG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EACR,uCAAuC,EAE1C,MAAM,2BAA2B,CAAC;AAGnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,KAAK,EACR,4BAA4B,EAC5B,0BAA0B,EAC1B,wCAAwC,EACxC,wCAAwC,EACxC,iCAAiC,EACjC,kCAAkC,EAClC,kCAAkC,EAClC,kCAAkC,EACrC,MAAM,YAAY,CAAC;AAGpB,qBAAa,2BAA4B,YAAW,4BAA4B;IAC5E,SAAS,CAAC,OAAO,EAAG,kCAAkC,CAAC;IAEvD,SAAS,CAAC,cAAc,EAAG,+BAA+B,CAAC;IAE3D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,iBAAiB,EAAG,0BAA0B,CAAC;IAEzD,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;IAEhE,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAE3B,SAAS,CAAC,oBAAoB,EAAG,wCAAwC,CAAC;gBAE9D,GAAG,EAAE,kCAAkC;IAyB7C,QAAQ,CAAC,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC,kCAAkC,CAAC;IA4L/F,eAAe,CAAC,KAAK,EAAE,wCAAwC,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAqF5G"}

package/dist/core/oauth2/federated-login/module.mjs ADDED Viewed

@@ -0,0 +1,193 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { deriveAmrAcr } from "../authorization/helpers.mjs";
+import { toIdentityPolicyData } from "../../identity/permission/identity-policy-data.mjs";
+import { OAUTH2_FEDERATED_LOGIN_TTL } from "./constants.mjs";
+import { describeError } from "../../../utils/error.mjs";
+import "../../../utils/index.mjs";
+import { isIdentityProviderAssuranceError } from "../../identity/provider/authentication/protocols/oauth2/assurance.mjs";
+import { createIdentityProviderOAuth2Authenticator } from "../../identity/provider/authentication/factory.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { OAuth2FederatedLoginRefusal } from "./types.mjs";
+import { isSafeRedirectURLScheme } from "@authup/kit";
+import { EventName, EventRefType, EventScope, IdentityType, ScopeName, SessionAuthMethod } from "@authup/core-kit";
+import { BadRequestError, InternalError } from "@authup/errors";
+import { OAuth2ErrorCode, OAuth2RequestError, OAuth2SubKind, isOAuth2Error } from "@authup/specs";
+//#region src/core/oauth2/federated-login/module.ts
+var OAuth2FederatedLoginService = class {
+	options;
+	accountManager;
+	realmRepository;
+	codeRequestVerifier;
+	sessionManager;
+	pendingLoginStore;
+	accessTokenIssuer;
+	refreshTokenIssuer;
+	accessPolicyEvaluator;
+	eventService;
+	metrics;
+	logger;
+	authenticatorFactory;
+	constructor(ctx) {
+		this.options = ctx.options;
+		this.accountManager = ctx.accountManager;
+		this.realmRepository = ctx.realmRepository;
+		this.codeRequestVerifier = ctx.codeRequestVerifier;
+		this.sessionManager = ctx.sessionManager;
+		this.pendingLoginStore = ctx.pendingLoginStore;
+		this.accessTokenIssuer = ctx.accessTokenIssuer;
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
+		this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;
+		this.eventService = ctx.eventService;
+		this.metrics = ctx.metrics;
+		this.logger = ctx.logger;
+		this.authenticatorFactory = ctx.authenticatorFactory ?? ((provider, options) => createIdentityProviderOAuth2Authenticator({
+			accountManager: this.accountManager,
+			provider,
+			logger: options.logger,
+			options: {
+				baseURL: options.baseURL,
+				clientId: options.clientId
+			}
+		}));
+	}
+	async complete(input) {
+		const { code, codeRequest, provider } = input;
+		let verified;
+		try {
+			verified = await this.codeRequestVerifier.verify(codeRequest);
+		} catch (e) {
+			if (!isOAuth2Error(e)) throw e;
+			return {
+				kind: "refused",
+				refusal: OAuth2FederatedLoginRefusal.CODE_REQUEST,
+				codeRequest
+			};
+		}
+		if (provider.realmId && verified.client.realmId !== provider.realmId) throw OAuth2RequestError.malformed("The provider and client realm do not match.");
+		const redirectUri = verified.data.redirect_uri;
+		if (!verified.redirectUriVerified || !redirectUri) throw OAuth2RequestError.malformed("The redirect_uri was not verified.");
+		if (!isSafeRedirectURLScheme(redirectUri)) throw new InternalError("The redirect_uri scheme is not allowed.");
+		if (!provider.enabled) return {
+			kind: "refused",
+			refusal: OAuth2FederatedLoginRefusal.PROVIDER_DISABLED,
+			error: OAuth2ErrorCode.LOGIN_REQUIRED,
+			codeRequest: verified.data
+		};
+		const authenticator = this.authenticatorFactory(provider, {
+			baseURL: this.options.baseURL,
+			clientId: verified.data.client_id,
+			logger: this.logger
+		});
+		let user;
+		try {
+			user = await authenticator.authenticate({ code });
+		} catch (e) {
+			if (!isIdentityProviderAssuranceError(e)) throw e;
+			this.logger?.warn(describeError(e, `The identity provider (${provider.id}) login was refused.`));
+			return {
+				kind: "refused",
+				refusal: OAuth2FederatedLoginRefusal.ASSURANCE_INSUFFICIENT,
+				error: OAuth2ErrorCode.ACCESS_DENIED,
+				codeRequest: verified.data
+			};
+		}
+		if (!user.active) return {
+			kind: "refused",
+			refusal: OAuth2FederatedLoginRefusal.USER_INACTIVE,
+			error: OAuth2ErrorCode.ACCESS_DENIED,
+			codeRequest: verified.data
+		};
+		if (verified.client.accessPolicyId) {
+			const realm = await this.realmRepository.resolve(provider.realmId, true);
+			let allowed = false;
+			const subject = toIdentityPolicyData({
+				type: IdentityType.USER,
+				data: {
+					...user,
+					realm
+				}
+			});
+			if (this.accessPolicyEvaluator && subject) allowed = await this.accessPolicyEvaluator.evaluate(verified.client.accessPolicyId, subject);
+			if (!allowed) return {
+				kind: "refused",
+				refusal: OAuth2FederatedLoginRefusal.ACCESS_DENIED,
+				error: OAuth2ErrorCode.ACCESS_DENIED,
+				codeRequest: verified.data
+			};
+		}
+		const session = await this.sessionManager.create({
+			userAgent: input.request?.userAgent ?? void 0,
+			ipAddress: input.request?.ipAddress ?? void 0,
+			realmId: user.realmId,
+			sub: user.id,
+			subKind: IdentityType.USER,
+			mfaAt: null,
+			authMethod: SessionAuthMethod.EXTERNAL,
+			expiresAt: new Date(Date.now() + OAUTH2_FEDERATED_LOGIN_TTL).toISOString()
+		});
+		return {
+			kind: "issued",
+			pendingLoginId: await this.pendingLoginStore.save({
+				sessionId: session.id,
+				providerId: provider.id,
+				userName: user.name
+			}),
+			codeRequest: verified.data
+		};
+	}
+	async completeHandoff(input) {
+		const refuse = () => new BadRequestError("The login request is unknown or expired.");
+		const pending = await this.pendingLoginStore.consume(input.pendingLoginId);
+		if (!pending) throw refuse();
+		if (pending.providerId !== input.providerId) throw refuse();
+		const existing = await this.sessionManager.findOneById(pending.sessionId);
+		if (!existing) throw refuse();
+		if (Date.parse(existing.expiresAt) <= Date.now()) throw refuse();
+		const realm = await this.realmRepository.resolve(existing.realmId, true);
+		const session = await this.sessionManager.refresh(existing);
+		const payload = {
+			session_id: session.id,
+			user_agent: session.userAgent,
+			remote_address: session.ipAddress,
+			scope: ScopeName.GLOBAL,
+			sub: session.sub,
+			sub_kind: OAuth2SubKind.USER,
+			realm_id: session.realmId,
+			realm_name: realm.name,
+			...deriveAmrAcr(session)
+		};
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(payload);
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(payload);
+		await this.eventService?.record({
+			scope: EventScope.OAUTH2,
+			name: EventName.LOGIN,
+			refType: EventRefType.SESSION,
+			refId: session.id,
+			clientId: null,
+			sessionId: session.id,
+			actorType: IdentityType.USER,
+			actorId: session.sub,
+			actorName: pending.userName ?? null,
+			realmId: session.realmId,
+			requestIpAddress: session.ipAddress ?? null,
+			requestUserAgent: session.userAgent ?? null,
+			data: {
+				reason: "federated",
+				providerId: pending.providerId
+			}
+		});
+		this.metrics?.recordLogin("success");
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		});
+	}
+};
+//#endregion
+export { OAuth2FederatedLoginService };
+//# sourceMappingURL=module.mjs.map