@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.63

package/dist/core/index.mjs

@@ -113,8 +113,10 @@ import { toIdentityPolicyData } from "./identity/permission/identity-policy-data
 import { OAuth2Authorization } from "./oauth2/authorization/module.mjs";
 import { OAuth2EndSessionService } from "./oauth2/end-session/service.mjs";
 import { OAuth2EndSessionRequestValidator } from "./oauth2/end-session/validator.mjs";
+import { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL } from "./oauth2/federated-login/constants.mjs";
 import { IdentityProviderLdapAuthenticator } from "./identity/provider/authentication/protocols/ldap/module.mjs";
 import { IdentityProviderLdapCollectionAuthenticator } from "./identity/provider/authentication/protocols/ldap/collection.mjs";
+import { IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE, IdentityProviderAssuranceError, assertIdentityProviderAssurance, buildIdentityProviderAcrValues, isIdentityProviderAssuranceError } from "./identity/provider/authentication/protocols/oauth2/assurance.mjs";
 import { IdentityProviderOAuth2Authenticator } from "./identity/provider/authentication/protocols/oauth2/module.mjs";
 import { IdentityProviderOpenIDAuthenticator } from "./identity/provider/authentication/protocols/open-id/module.mjs";
 import { IdentityProviderFacebookAuthenticator } from "./identity/provider/authentication/presets/facebook.mjs";
@@ -123,9 +125,9 @@ import { IdentityProviderGoogleAuthenticator } from "./identity/provider/authent
 import { IdentityProviderInstagramAuthenticator } from "./identity/provider/authentication/presets/instagram.mjs";
 import { IdentityProviderPaypalAuthenticator } from "./identity/provider/authentication/presets/paypal.mjs";
 import { createIdentityProviderOAuth2Authenticator } from "./identity/provider/authentication/factory.mjs";
+import { buildOAuth2BearerTokenResponse } from "./oauth2/response/bearer.mjs";
 import { OAuth2FederatedLoginRefusal } from "./oauth2/federated-login/types.mjs";
 import { OAuth2FederatedLoginService } from "./oauth2/federated-login/module.mjs";
-import { buildOAuth2BearerTokenResponse } from "./oauth2/response/bearer.mjs";
 import { OAuth2AuthorizeGrant } from "./oauth2/grant-types/authorize.mjs";
 import { ClientCredentialsGrant } from "./oauth2/grant-types/client-credentials.mjs";
 import { IdentityGrantType } from "./oauth2/grant-types/identity.mjs";
@@ -190,4 +192,4 @@ import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/m
 import { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry } from "./provisioning/wildcard/module.mjs";
 import "./provisioning/index.mjs";
 import "./security/index.mjs";
-export { BaseCredentialsAuthenticator, CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EVENT_RETENTION_SWEEP_BATCH_SIZE, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, IDENTITY_PROVIDER_ACCOUNT_LINK_TTL, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountAlreadyLinkedError, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAccountService, IdentityProviderAccountUnlinkBlockedError, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2FederatedLoginRefusal, OAuth2FederatedLoginService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, REALM_WILDCARD_NAME, RECORD_QUERY_PARAMETERS, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RealmWildcardProvisioningValidator, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, SESSION_TOKEN_FILTER_KEYS, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, SessionTokenRelationMissingError, SessionTokenService, SystemClientProvisioner, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WildcardRealmProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildProvisioningEntityKey, buildSystemClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, createRelationsReadGate, decodeQuery, defineMailTemplate, deriveAmrAcr, describeQuerySchema, eventSchema, expandWildcardRealmEntry, extractWildcardRealmEntry, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderAccountSchema, identityProviderRoleMappingSchema, identityProviderSchema, isIdentityProviderAccountAlreadyLinkedError, isIdentityProviderAccountUnlinkBlockedError, isRealmCipherBlobError, isSessionTokenRelationMissingError, isWrappedKeyMaterial, keySchema, mergeProvisioningEntities, mergeProvisioningEntity, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, schemas, scopeSchema, sessionSchema, sessionTokenSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };
+export { BaseCredentialsAuthenticator, CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EVENT_RETENTION_SWEEP_BATCH_SIZE, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, IDENTITY_PROVIDER_ACCOUNT_LINK_TTL, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountAlreadyLinkedError, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAccountService, IdentityProviderAccountUnlinkBlockedError, IdentityProviderAssuranceError, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2FederatedLoginRefusal, OAuth2FederatedLoginService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, REALM_WILDCARD_NAME, RECORD_QUERY_PARAMETERS, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RealmWildcardProvisioningValidator, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, SESSION_TOKEN_FILTER_KEYS, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, SessionTokenRelationMissingError, SessionTokenService, SystemClientProvisioner, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WildcardRealmProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, assertIdentityProviderAssurance, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildIdentityProviderAcrValues, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildProvisioningEntityKey, buildSystemClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, createRelationsReadGate, decodeQuery, defineMailTemplate, deriveAmrAcr, describeQuerySchema, eventSchema, expandWildcardRealmEntry, extractWildcardRealmEntry, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderAccountSchema, identityProviderRoleMappingSchema, identityProviderSchema, isIdentityProviderAccountAlreadyLinkedError, isIdentityProviderAccountUnlinkBlockedError, isIdentityProviderAssuranceError, isRealmCipherBlobError, isSessionTokenRelationMissingError, isWrappedKeyMaterial, keySchema, mergeProvisioningEntities, mergeProvisioningEntity, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, schemas, scopeSchema, sessionSchema, sessionTokenSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };

package/dist/core/oauth2/authorization/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAMtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIhD;;;;;;GAMG;AACH,wBAAgB,YAAY,CACxB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG,IAAI,GACtD,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,KAAK,CAAC,CAiCzC;AAED,wBAAgB,0BAA0B,WAazC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,UAWvD;AAWD,wBAAsB,oBAAoB,CACtC,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,GAC9B,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAMtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIhD;;;;;;GAMG;AACH,wBAAgB,YAAY,CACxB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG,IAAI,GACtD,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,KAAK,CAAC,CA0CzC;AAED,wBAAgB,0BAA0B,WAazC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,UAWvD;AAWD,wBAAsB,oBAAoB,CACtC,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,GAC9B,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}

package/dist/core/oauth2/authorization/helpers.mjs

@@ -25,9 +25,14 @@ import { subtle } from "uncrypto";
 		default: return {};
 	}
 	if (session.mfaAt) amr.push(OAuth2AuthenticationMethodReference.OTP);
+	if (session.mfaAt) return {
+		amr,
+		acr: OAuth2AuthenticationContextClass.MFA
+	};
+	if (session.authMethod === SessionAuthMethod.EXTERNAL) return { amr };
 	return {
 		amr,
-		acr: session.mfaAt ? OAuth2AuthenticationContextClass.MFA : OAuth2AuthenticationContextClass.PASSWORD
+		acr: OAuth2AuthenticationContextClass.PASSWORD
 	};
 }
 function generateOAuth2CodeVerifier() {

package/dist/core/oauth2/authorization/helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.mjs","names":["JWTError","OAuth2AuthenticationContextClass","OAuth2AuthenticationMethodReference","SessionAuthMethod","subtle","deriveAmrAcr","session","authMethod","amr","PASSWORD","LDAP","push","EXTERNAL","mfaAt","OTP","acr","MFA","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","TOKEN_HASH_DIGESTS","name","halfLength","buildOAuth2TokenHash","value","alg","digest","slice","headerPropertyInvalid","encoder","TextEncoder","data","encode","hashBuffer","halfHash","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { JWTAlgorithm, OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWTError,\n    OAuth2AuthenticationContextClass,\n    OAuth2AuthenticationMethodReference,\n} from '@authup/specs';\nimport type { Session } from '@authup/core-kit';\nimport { SessionAuthMethod } from '@authup/core-kit';\nimport { subtle } from 'uncrypto';\n\n/**\n * Derive the OIDC `amr` / `acr` claims from the backing session's\n * authMethod + mfaAt (plan 050). Pre-column sessions (null authMethod)\n * yield no claims — authup cannot retroactively know how an old session\n * authenticated. M2M methods yield none either (amr/acr are user-flow\n * claims; those grants mint no id_token).\n */\nexport function deriveAmrAcr(\n    session: Pick<Session, 'authMethod' | 'mfaAt'> | null,\n): Pick<OAuth2TokenPayload, 'amr' | 'acr'> {\n    if (!session || !session.authMethod) {\n        return {};\n    }\n\n    const amr : string[] = [];\n    switch (session.authMethod) {\n        case SessionAuthMethod.PASSWORD:\n        case SessionAuthMethod.LDAP: {\n            // LDAP is still a password factor for amr — the finer\n            // distinction lives in the authup-local authMethod.\n            amr.push(OAuth2AuthenticationMethodReference.PASSWORD);\n            break;\n        }\n        case SessionAuthMethod.EXTERNAL: {\n            amr.push(OAuth2AuthenticationMethodReference.EXTERNAL);\n            break;\n        }\n        default: {\n            return {};\n        }\n    }\n\n    if (session.mfaAt) {\n        amr.push(OAuth2AuthenticationMethodReference.OTP);\n    }\n\n    return {\n        amr,\n        acr: session.mfaAt ?\n            OAuth2AuthenticationContextClass.MFA :\n            OAuth2AuthenticationContextClass.PASSWORD,\n    };\n}\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\n// OIDC Core §3.1.3.6: at_hash / c_hash use the hash algorithm of the id_token's\n// JWS alg (…S256 → SHA-256, …S384 → SHA-384, …S512 → SHA-512) and keep the LEFT\n// HALF of the digest — so the half-length follows the digest (16/24/32 bytes).\nconst TOKEN_HASH_DIGESTS : Record<string, { name: string, halfLength: number }> = {\n    256: { name: 'SHA-256', halfLength: 16 },\n    384: { name: 'SHA-384', halfLength: 24 },\n    512: { name: 'SHA-512', halfLength: 32 },\n};\n\nexport async function buildOAuth2TokenHash(\n    value: string,\n    alg?: `${JWTAlgorithm}` | null,\n) : Promise<string> {\n    // A key row without a persisted alg (nullable legacy column) signs with\n    // the signer's *256 default (RS256/ES256/HS256) — derive the matching\n    // SHA-256 digest. An unrecognized alg still fails loud — silently\n    // defaulting there would mint a hash no conforming verifier accepts.\n    const digest = alg ?\n        TOKEN_HASH_DIGESTS[alg.slice(-3)] :\n        TOKEN_HASH_DIGESTS['256'];\n    if (!digest) {\n        throw JWTError.headerPropertyInvalid('alg');\n    }\n\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest(digest.name, data);\n    const halfHash = hashBuffer.slice(0, digest.halfLength);\n\n    return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;;;;;;;;;GAwBA,SAAgBK,aACZC,SAAqD;CAErD,IAAI,CAACA,WAAW,CAACA,QAAQC,YACrB,OAAO,CAAC;CAGZ,MAAMC,MAAiB,CAAA;CACvB,QAAQF,QAAQC,YAAhB;EACI,KAAKJ,kBAAkBM;EACvB,KAAKN,kBAAkBO;GAGnBF,IAAIG,KAAKT,oCAAoCO,QAAQ;GACrD;EAEJ,KAAKN,kBAAkBS;GACnBJ,IAAIG,KAAKT,oCAAoCU,QAAQ;GACrD;EAEJ,SACI,OAAO,CAAC;CAEhB;CAEA,IAAIN,QAAQO,OACRL,IAAIG,KAAKT,oCAAoCY,GAAG;CAGpD,OAAO;EACHN;EACAO,KAAKT,QAAQO,QACTZ,iCAAiCe,MACjCf,iCAAiCQ;CACzC;AACJ;AAEA,SAAgBQ,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAKA,MAAMC,qBAA4E;CAC9E,KAAK;EAAEC,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;AAC3C;AAEA,eAAsBC,qBAClBC,OACAC,KAA8B;CAM9B,MAAMC,SAASD,MACXL,mBAAmBK,IAAIE,MAAM,EAAC,KAC9BP,mBAAmB;CACvB,IAAI,CAACM,QACD,MAAM1C,SAAS4C,sBAAsB,KAAA;CAIzC,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOR,KAAAA;CAI5B,OAAOd,iBAFUuB,MADQ7C,OAAOsC,OAAOA,OAAOL,MAAMU,IAAAA,EAAAA,CACxBJ,MAAM,GAAGD,OAAOJ,UAErBY,CAAAA;AAC3B;AAEA,eAAsBC,yBAAyB/B,cAAoB;CAE/D,MAAM2B,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAO5B,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGvB,OAAOsC,OAAO,WAAWK,IAAAA,CAE5BpB;AAC3B"}
+{"version":3,"file":"helpers.mjs","names":["JWTError","OAuth2AuthenticationContextClass","OAuth2AuthenticationMethodReference","SessionAuthMethod","subtle","deriveAmrAcr","session","authMethod","amr","PASSWORD","LDAP","push","EXTERNAL","mfaAt","OTP","acr","MFA","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","TOKEN_HASH_DIGESTS","name","halfLength","buildOAuth2TokenHash","value","alg","digest","slice","headerPropertyInvalid","encoder","TextEncoder","data","encode","hashBuffer","halfHash","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { JWTAlgorithm, OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWTError,\n    OAuth2AuthenticationContextClass,\n    OAuth2AuthenticationMethodReference,\n} from '@authup/specs';\nimport type { Session } from '@authup/core-kit';\nimport { SessionAuthMethod } from '@authup/core-kit';\nimport { subtle } from 'uncrypto';\n\n/**\n * Derive the OIDC `amr` / `acr` claims from the backing session's\n * authMethod + mfaAt (plan 050). Pre-column sessions (null authMethod)\n * yield no claims — authup cannot retroactively know how an old session\n * authenticated. M2M methods yield none either (amr/acr are user-flow\n * claims; those grants mint no id_token).\n */\nexport function deriveAmrAcr(\n    session: Pick<Session, 'authMethod' | 'mfaAt'> | null,\n): Pick<OAuth2TokenPayload, 'amr' | 'acr'> {\n    if (!session || !session.authMethod) {\n        return {};\n    }\n\n    const amr : string[] = [];\n    switch (session.authMethod) {\n        case SessionAuthMethod.PASSWORD:\n        case SessionAuthMethod.LDAP: {\n            // LDAP is still a password factor for amr — the finer\n            // distinction lives in the authup-local authMethod.\n            amr.push(OAuth2AuthenticationMethodReference.PASSWORD);\n            break;\n        }\n        case SessionAuthMethod.EXTERNAL: {\n            amr.push(OAuth2AuthenticationMethodReference.EXTERNAL);\n            break;\n        }\n        default: {\n            return {};\n        }\n    }\n\n    if (session.mfaAt) {\n        amr.push(OAuth2AuthenticationMethodReference.OTP);\n    }\n\n    if (session.mfaAt) {\n        return { amr, acr: OAuth2AuthenticationContextClass.MFA };\n    }\n\n    // No `acr` for a session an external provider authenticated: authup\n    // verified no credential of its own, so it asserts no assurance level.\n    // `urn:authup:pwd` would say the subject authenticated with a password,\n    // which is exactly what did NOT happen (issue #3478). Per OIDC Core\n    // §2 the claim is voluntary, so the absence is the honest answer, and\n    // `amr: ['ext']` still says how the login happened.\n    if (session.authMethod === SessionAuthMethod.EXTERNAL) {\n        return { amr };\n    }\n\n    return { amr, acr: OAuth2AuthenticationContextClass.PASSWORD };\n}\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\n// OIDC Core §3.1.3.6: at_hash / c_hash use the hash algorithm of the id_token's\n// JWS alg (…S256 → SHA-256, …S384 → SHA-384, …S512 → SHA-512) and keep the LEFT\n// HALF of the digest — so the half-length follows the digest (16/24/32 bytes).\nconst TOKEN_HASH_DIGESTS : Record<string, { name: string, halfLength: number }> = {\n    256: { name: 'SHA-256', halfLength: 16 },\n    384: { name: 'SHA-384', halfLength: 24 },\n    512: { name: 'SHA-512', halfLength: 32 },\n};\n\nexport async function buildOAuth2TokenHash(\n    value: string,\n    alg?: `${JWTAlgorithm}` | null,\n) : Promise<string> {\n    // A key row without a persisted alg (nullable legacy column) signs with\n    // the signer's *256 default (RS256/ES256/HS256) — derive the matching\n    // SHA-256 digest. An unrecognized alg still fails loud — silently\n    // defaulting there would mint a hash no conforming verifier accepts.\n    const digest = alg ?\n        TOKEN_HASH_DIGESTS[alg.slice(-3)] :\n        TOKEN_HASH_DIGESTS['256'];\n    if (!digest) {\n        throw JWTError.headerPropertyInvalid('alg');\n    }\n\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest(digest.name, data);\n    const halfHash = hashBuffer.slice(0, digest.halfLength);\n\n    return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;;;;;;;;;GAwBA,SAAgBK,aACZC,SAAqD;CAErD,IAAI,CAACA,WAAW,CAACA,QAAQC,YACrB,OAAO,CAAC;CAGZ,MAAMC,MAAiB,CAAA;CACvB,QAAQF,QAAQC,YAAhB;EACI,KAAKJ,kBAAkBM;EACvB,KAAKN,kBAAkBO;GAGnBF,IAAIG,KAAKT,oCAAoCO,QAAQ;GACrD;EAEJ,KAAKN,kBAAkBS;GACnBJ,IAAIG,KAAKT,oCAAoCU,QAAQ;GACrD;EAEJ,SACI,OAAO,CAAC;CAEhB;CAEA,IAAIN,QAAQO,OACRL,IAAIG,KAAKT,oCAAoCY,GAAG;CAGpD,IAAIR,QAAQO,OACR,OAAO;EAAEL;EAAKO,KAAKd,iCAAiCe;CAAI;CAS5D,IAAIV,QAAQC,eAAeJ,kBAAkBS,UACzC,OAAO,EAAEJ,IAAI;CAGjB,OAAO;EAAEA;EAAKO,KAAKd,iCAAiCQ;CAAS;AACjE;AAEA,SAAgBQ,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAKA,MAAMC,qBAA4E;CAC9E,KAAK;EAAEC,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;AAC3C;AAEA,eAAsBC,qBAClBC,OACAC,KAA8B;CAM9B,MAAMC,SAASD,MACXL,mBAAmBK,IAAIE,MAAM,EAAC,KAC9BP,mBAAmB;CACvB,IAAI,CAACM,QACD,MAAM1C,SAAS4C,sBAAsB,KAAA;CAIzC,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOR,KAAAA;CAI5B,OAAOd,iBAFUuB,MADQ7C,OAAOsC,OAAOA,OAAOL,MAAMU,IAAAA,EAAAA,CACxBJ,MAAM,GAAGD,OAAOJ,UAErBY,CAAAA;AAC3B;AAEA,eAAsBC,yBAAyB/B,cAAoB;CAE/D,MAAM2B,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAO5B,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGvB,OAAOsC,OAAO,WAAWK,IAAAA,CAE5BpB;AAC3B"}

package/dist/core/oauth2/authorization/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,QAAQ,EAER,8BAA8B,EAEjC,MAAM,kBAAkB,CAAC;AAsB1B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,KAAK,EACR,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAS/D,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,iBAAiB,EAAG,MAAM,CAAC;IAErC,SAAS,CAAC,kBAAkB,EAAG,MAAM,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAG,mCAAmC,CAAC;IAEtE,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;gBAEpD,GAAG,EAAE,iCAAiC;IAWlD;;;;;;OAMG;IACG,SAAS,CACX,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;cAmDtB,cAAc,CAC1B,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;CA4KzC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,QAAQ,EAER,8BAA8B,EAEjC,MAAM,kBAAkB,CAAC;AAuB1B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,KAAK,EACR,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAS/D,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,iBAAiB,EAAG,MAAM,CAAC;IAErC,SAAS,CAAC,kBAAkB,EAAG,MAAM,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAG,mCAAmC,CAAC;IAEtE,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;gBAEpD,GAAG,EAAE,iCAAiC;IAWlD;;;;;;OAMG;IACG,SAAS,CACX,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;cAmDtB,cAAc,CAC1B,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;CA+LzC"}

package/dist/core/oauth2/authorization/module.mjs

@@ -2,7 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { toIdentityPolicyData } from "../../identity/permission/identity-policy-data.mjs";
-import { EventName, EventRefType, EventScope, IdentityType } from "@authup/core-kit";
+import { EventName, EventRefType, EventScope, IdentityType, SessionAuthMethod } from "@authup/core-kit";
 import { hasInstanceof } from "@authup/errors";
 import { OAUTH2_ACCESS_DENIED_ERROR_INSTANCE, OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE, OAUTH2_MFA_REQUIRED_ERROR_INSTANCE, OAuth2AccessDeniedError, OAuth2AuthenticationContextClass, OAuth2AuthorizationPrompt, OAuth2AuthorizationResponseType, OAuth2GrantError, OAuth2LoginRequiredError, OAuth2MfaRequiredError, OAuth2RequestError, OAuth2ResponseTypeError } from "@authup/specs";
 //#region src/core/oauth2/authorization/module.ts
@@ -97,8 +97,10 @@ var OAuth2Authorization = class {
 		}
 		if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {
 			const challenge = await this.mfaChallengeProvider.challenge(identity.data.id, { issueMaterial: false });
-			if (challenge.required && !session?.mfaAt) throw OAuth2MfaRequiredError.challengeRequired();
-			if (challenge.enrollmentRequired) throw OAuth2MfaRequiredError.enrollmentRequired();
+			if (!(session?.authMethod === SessionAuthMethod.EXTERNAL)) {
+				if (challenge.required && !session?.mfaAt) throw OAuth2MfaRequiredError.challengeRequired();
+				if (challenge.enrollmentRequired) throw OAuth2MfaRequiredError.enrollmentRequired();
+			}
 			if (challenge.required && data.acr_values) {
 				if (data.acr_values.split(" ").includes(OAuth2AuthenticationContextClass.MFA)) {
 					const mfaAtSeconds = session?.mfaAt ? Math.floor(new Date(session.mfaAt).getTime() / 1e3) : null;

package/dist/core/oauth2/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["EventName","EventRefType","EventScope","IdentityType","hasInstanceof","OAUTH2_ACCESS_DENIED_ERROR_INSTANCE","OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE","OAUTH2_MFA_REQUIRED_ERROR_INSTANCE","OAuth2AccessDeniedError","OAuth2AuthenticationContextClass","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2LoginRequiredError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2ResponseTypeError","toIdentityPolicyData","DEFAULT_PROMPT_LOGIN_MAX_AGE","DEFAULT_MFA_FRESHNESS_MAX_AGE","OAuth2Authorization","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","ctx","authorize","data","identity","options","result","authorizeInner","record","scope","OAUTH2","name","AUTHORIZE","refType","CLIENT","refId","client","id","client_id","clientId","sessionId","actorType","type","actorId","actorName","realmId","realm_id","reason","builtIn","recordAuthorize","e","AUTHORIZE_FAILED","responseTypes","response_type","Array","isArray","split","responseType","CODE","unsupported","includes","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","realmMismatch","nowSeconds","Math","floor","Date","now","authTime","session","findOneById","createdAt","getTime","USER","challenge","issueMaterial","required","mfaAt","challengeRequired","enrollmentRequired","acr_values","acrValues","MFA","mfaAtSeconds","stepUpRequired","prompts","prompt","LOGIN","reauthenticationRequired","max_age","maxAge","Number","isFinite","accessPolicyId","allowed","subject","evaluate","forClient","redirectUriVerified","undefined","codeEntity","issue","authMethod","authorizationCode"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Identity, \n    OAuth2AuthorizationCode, \n    OAuth2AuthorizationCodeRequest, \n    Session,\n} from '@authup/core-kit';\nimport {\n    EventName, \n    EventRefType, \n    EventScope, \n    IdentityType,\n} from '@authup/core-kit';\nimport { hasInstanceof } from '@authup/errors';\nimport {\n    OAUTH2_ACCESS_DENIED_ERROR_INSTANCE,\n    OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE,\n    OAUTH2_MFA_REQUIRED_ERROR_INSTANCE,\n    OAuth2AccessDeniedError,\n    OAuth2AuthenticationContextClass,\n    OAuth2AuthorizationPrompt,\n    OAuth2AuthorizationResponseType,\n    OAuth2GrantError,\n    OAuth2LoginRequiredError,\n    OAuth2MfaRequiredError,\n    OAuth2RequestError,\n    OAuth2ResponseTypeError,\n} from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport { toIdentityPolicyData } from '../../identity/permission/identity-policy-data.ts';\nimport type {\n    OAuth2AuthorizationManagerContext,\n    OAuth2AuthorizationOptions,\n    OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IEventService, IUserAuthenticatorChallengeProvider } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\n\nconst DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;\n\n// Deliberately 60 (not 0, deviating from the plan-050 sketch): the hosted\n// challenge round-trip (stamp mfa_at → retry POST /authorize) takes seconds,\n// so a 0-window step-up could never be satisfied and would loop the ladder.\nconst DEFAULT_MFA_FRESHNESS_MAX_AGE = 60;\n\nexport class OAuth2Authorization {\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    protected sessionManager : ISessionManager;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected promptLoginMaxAge : number;\n\n    protected mfaFreshnessMaxAge : number;\n\n    protected mfaChallengeProvider? : IUserAuthenticatorChallengeProvider;\n\n    protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n    constructor(ctx: OAuth2AuthorizationManagerContext) {\n        this.codeIssuer = ctx.codeIssuer;\n        this.sessionManager = ctx.sessionManager;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n        this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n        this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;\n        this.mfaFreshnessMaxAge = ctx.mfaFreshnessMaxAge ?? DEFAULT_MFA_FRESHNESS_MAX_AGE;\n        this.mfaChallengeProvider = ctx.mfaChallengeProvider;\n    }\n\n    /**\n     * Authorize with validated codeRequest.\n     *\n     * @param data\n     * @param identity\n     * @param options\n     */\n    async authorize(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationOptions = {},\n    ) : Promise<OAuth2AuthorizationResult> {\n        try {\n            const result = await this.authorizeInner(data, identity, options);\n\n            await this.eventService?.record({\n                scope: EventScope.OAUTH2,\n                name: EventName.AUTHORIZE,\n                refType: EventRefType.CLIENT,\n                refId: options.client?.id ?? data.client_id ?? null,\n                clientId: options.client?.id ?? data.client_id ?? null,\n                sessionId: options.sessionId ?? null,\n                actorType: identity.type,\n                actorId: identity.data.id,\n                actorName: identity.data.name,\n                realmId: data.realm_id ?? null,\n                data: {\n                    reason: options.client?.builtIn ? 'autoConsent' : 'consent',\n                    ...(data.scope ? { scope: data.scope } : {}),\n                },\n            });\n            this.metrics?.recordAuthorize('issued');\n\n            return result;\n        } catch (e) {\n            if (hasInstanceof(e, OAUTH2_ACCESS_DENIED_ERROR_INSTANCE)) {\n                await this.eventService?.record({\n                    scope: EventScope.OAUTH2,\n                    name: EventName.AUTHORIZE_FAILED,\n                    refType: EventRefType.CLIENT,\n                    refId: options.client?.id ?? data.client_id ?? null,\n                    clientId: options.client?.id ?? data.client_id ?? null,\n                    sessionId: options.sessionId ?? null,\n                    actorType: identity.type,\n                    actorId: identity.data.id,\n                    actorName: identity.data.name,\n                    realmId: data.realm_id ?? null,\n                    data: { reason: 'accessPolicy' },\n                });\n                this.metrics?.recordAuthorize('denied');\n            } else if (hasInstanceof(e, OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE)) {\n                this.metrics?.recordAuthorize('login_required');\n            } else if (hasInstanceof(e, OAUTH2_MFA_REQUIRED_ERROR_INSTANCE)) {\n                this.metrics?.recordAuthorize('mfa_required');\n            } else {\n                this.metrics?.recordAuthorize('error');\n            }\n\n            throw e;\n        }\n    }\n\n    protected async authorizeInner(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationOptions = {},\n    ) : Promise<OAuth2AuthorizationResult> {\n        // OAuth 2.1 posture: only the authorization-code response type is\n        // supported — implicit/hybrid (token, id_token, none) were dropped\n        // (plan 042 item 3). Defense in depth behind the request validator.\n        let responseTypes : string[] = [];\n        if (data.response_type) {\n            responseTypes = Array.isArray(data.response_type) ?\n                data.response_type :\n                data.response_type.split(' ');\n        }\n\n        for (const responseType of responseTypes) {\n            if (responseType !== OAuth2AuthorizationResponseType.CODE) {\n                throw OAuth2ResponseTypeError.unsupported();\n            }\n        }\n\n        if (!responseTypes.includes(OAuth2AuthorizationResponseType.CODE)) {\n            throw OAuth2ResponseTypeError.unsupported();\n        }\n\n        if (!data.redirect_uri) {\n            throw OAuth2GrantError.redirectUriMismatch();\n        }\n\n        const output : OAuth2AuthorizationResult = {\n            redirectUri: data.redirect_uri,\n            ...(data.state ? { state: data.state } : {}),\n        };\n\n        if (!identity) {\n            throw OAuth2RequestError.identityInvalid();\n        }\n\n        // Realm binding: the code-request verifier stamped data.realm_id with the\n        // resolved client's realm. The authenticated identity must belong to that\n        // same realm — otherwise a lingering session for realm A could silently\n        // mint a code/token for realm B's client (confused deputy). The error body\n        // deliberately carries no identity data (no realm-enumeration oracle).\n        // The comparison reads the scalar realmId column, NOT the realm\n        // relation — the relation may simply not be loaded on the resolved\n        // identity. An identity without a realmId fails closed the same way —\n        // clean login_required, never a TypeError.\n        if (\n            data.realm_id &&\n            identity.data.realmId !== data.realm_id\n        ) {\n            throw OAuth2LoginRequiredError.realmMismatch();\n        }\n\n        // Authentication time = the backing session's creation instant (NOT\n        // refreshed_at — a token refresh must not reset it). Session-less flows\n        // (e.g. HTTP Basic authorize) present live credentials on this request,\n        // so the authentication time is \"now\".\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        let authTime = nowSeconds;\n        let session : Session | null = null;\n        if (options.sessionId) {\n            session = await this.sessionManager.findOneById(options.sessionId);\n            if (session && session.createdAt) {\n                authTime = Math.floor(new Date(session.createdAt).getTime() / 1000);\n            }\n        }\n\n        // MFA backstop (plan 049) — the authoritative server-side gate; the\n        // hosted UI's challenge step is convenience. The proof is session-bound\n        // (mfa_at — stamped by the challenge endpoint or the password grant's\n        // otp param), so a session-less flow (HTTP Basic) cannot carry one and\n        // fails closed while the user holds a confirmed device. A user without\n        // a device under mfaRequired is routed to inline enrollment.\n        if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {\n            // requirement flags only — the interactive challenge material (the\n            // webauthn nonce) is issued by the status endpoint, not this backstop.\n            const challenge = await this.mfaChallengeProvider.challenge(\n                identity.data.id,\n                { issueMaterial: false },\n            );\n            if (challenge.required && !session?.mfaAt) {\n                throw OAuth2MfaRequiredError.challengeRequired();\n            }\n\n            if (challenge.enrollmentRequired) {\n                throw OAuth2MfaRequiredError.enrollmentRequired();\n            }\n\n            // Step-up (plan 050 stage 3): a requested `acr_values` containing\n            // urn:authup:mfa is a TRIGGER (Auth0/Keycloak stance) — the proof\n            // must additionally be FRESH (mfaFreshnessMaxAge window, mirroring\n            // promptLoginMaxAge's absorb-the-round-trip semantics). Enforced\n            // only while the user actually holds a factor — per OIDC Core\n            // §5.5.1.1 acr is voluntary, so an unsatisfiable request degrades\n            // to the achieved acr instead of bricking the RP.\n            if (challenge.required && data.acr_values) {\n                const acrValues = data.acr_values.split(' ');\n                if (acrValues.includes(OAuth2AuthenticationContextClass.MFA)) {\n                    const mfaAtSeconds = session?.mfaAt ?\n                        Math.floor(new Date(session.mfaAt).getTime() / 1000) :\n                        null;\n                    if (mfaAtSeconds === null || nowSeconds - mfaAtSeconds > this.mfaFreshnessMaxAge) {\n                        throw OAuth2MfaRequiredError.stepUpRequired();\n                    }\n                }\n            }\n        }\n\n        // OIDC §3.1.2.1 prompt=login / max_age freshness (enforced only when\n        // requested — a plain authorize never throws here). The hosted page\n        // renders the login form for prompt=login; this is the server backstop.\n        const prompts = data.prompt ? data.prompt.split(' ') : [];\n        if (\n            prompts.includes(OAuth2AuthorizationPrompt.LOGIN) &&\n            nowSeconds - authTime > this.promptLoginMaxAge\n        ) {\n            throw OAuth2LoginRequiredError.reauthenticationRequired();\n        }\n\n        if (\n            typeof data.max_age !== 'undefined' &&\n            data.max_age !== null\n        ) {\n            const maxAge = Number(data.max_age);\n            if (\n                Number.isFinite(maxAge) &&\n                nowSeconds - authTime > maxAge\n            ) {\n                throw OAuth2LoginRequiredError.reauthenticationRequired();\n            }\n        }\n\n        // Application access policy (plan 052) — the last gate before\n        // issuance: a denial is only revealed to a fully-authenticated\n        // (incl. second-factor) identity. A client carrying a policy id with\n        // no wired evaluator denies too (never silently allow a configured\n        // gate). The redirect target rides the error only when the\n        // redirect_uri was pattern-verified (RFC 6749 §4.1.2.1).\n        if (options.client?.accessPolicyId) {\n            let allowed = false;\n\n            const subject = toIdentityPolicyData(identity);\n            if (this.accessPolicyEvaluator && subject) {\n                allowed = await this.accessPolicyEvaluator.evaluate(\n                    options.client.accessPolicyId,\n                    subject,\n                );\n            }\n\n            if (!allowed) {\n                throw OAuth2AccessDeniedError.forClient(\n                    options.redirectUriVerified && data.redirect_uri ?\n                        { redirectUri: data.redirect_uri, state: data.state ?? null } :\n                        undefined,\n                );\n            }\n        }\n\n        // The id_token is NOT minted here — the /token exchange mints it after\n        // resolving the real backing session, so its `sid` is authoritative\n        // (plan 042 item 6). The code carries the authentication instant.\n        const codeEntity : OAuth2AuthorizationCode = await this.codeIssuer.issue(\n            data,\n            identity,\n            {\n                sessionId: options.sessionId,\n                authTime,\n                authMethod: session?.authMethod ?? null,\n            },\n        );\n\n        output.authorizationCode = codeEntity.id;\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;AA8CA,MAAMkB,+BAA+B;AAKrC,MAAMC,gCAAgC;AAEtC,IAAaC,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKR,aAAaQ,IAAIR;EACtB,KAAKC,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,UAAUK,IAAIL;EACnB,KAAKI,wBAAwBC,IAAID;EACjC,KAAKH,oBAAoBI,IAAIJ,qBAAqBP;EAClD,KAAKQ,qBAAqBG,IAAIH,sBAAsBP;EACpD,KAAKQ,uBAAuBE,IAAIF;CACpC;;;;;;;IASA,MAAMG,UACFC,MACAC,UACAC,UAAsC,CAAC,GACJ;EACnC,IAAI;GACA,MAAMC,SAAS,MAAM,KAAKC,eAAeJ,MAAMC,UAAUC,OAAAA;GAEzD,MAAM,KAAKV,cAAca,OAAO;IAC5BC,OAAOnC,WAAWoC;IAClBC,MAAMvC,UAAUwC;IAChBC,SAASxC,aAAayC;IACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAClDE,WAAWf,QAAQe,aAAa;IAChCC,WAAWjB,SAASkB;IACpBC,SAASnB,SAASD,KAAKc;IACvBO,WAAWpB,SAASD,KAAKQ;IACzBc,SAAStB,KAAKuB,YAAY;IAC1BvB,MAAM;KACFwB,QAAQtB,QAAQW,QAAQY,UAAU,gBAAgB;KAClD,GAAIzB,KAAKM,QAAQ,EAAEA,OAAON,KAAKM,MAAM,IAAI,CAAC;IAC9C;GACJ,CAAA;GACA,KAAKb,SAASiC,gBAAgB,QAAA;GAE9B,OAAOvB;EACX,SAASwB,GAAG;GACR,IAAItD,cAAcsD,GAAGrD,mCAAAA,GAAsC;IACvD,MAAM,KAAKkB,cAAca,OAAO;KAC5BC,OAAOnC,WAAWoC;KAClBC,MAAMvC,UAAU2D;KAChBlB,SAASxC,aAAayC;KACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAClDE,WAAWf,QAAQe,aAAa;KAChCC,WAAWjB,SAASkB;KACpBC,SAASnB,SAASD,KAAKc;KACvBO,WAAWpB,SAASD,KAAKQ;KACzBc,SAAStB,KAAKuB,YAAY;KAC1BvB,MAAM,EAAEwB,QAAQ,eAAe;IACnC,CAAA;IACA,KAAK/B,SAASiC,gBAAgB,QAAA;GAClC,OAAO,IAAIrD,cAAcsD,GAAGpD,oCAAAA,GACxB,KAAKkB,SAASiC,gBAAgB,gBAAA;QAC3B,IAAIrD,cAAcsD,GAAGnD,kCAAAA,GACxB,KAAKiB,SAASiC,gBAAgB,cAAA;QAE9B,KAAKjC,SAASiC,gBAAgB,OAAA;GAGlC,MAAMC;EACV;CACJ;CAEA,MAAgBvB,eACZJ,MACAC,UACAC,UAAsC,CAAC,GACJ;EAInC,IAAI2B,gBAA2B,CAAA;EAC/B,IAAI7B,KAAK8B,eACLD,gBAAgBE,MAAMC,QAAQhC,KAAK8B,aAAa,IAC5C9B,KAAK8B,gBACL9B,KAAK8B,cAAcG,MAAM,GAAA;EAGjC,KAAK,MAAMC,gBAAgBL,eACvB,IAAIK,iBAAiBtD,gCAAgCuD,MACjD,MAAMlD,wBAAwBmD,YAAW;EAIjD,IAAI,CAACP,cAAcQ,SAASzD,gCAAgCuD,IAAI,GAC5D,MAAMlD,wBAAwBmD,YAAW;EAG7C,IAAI,CAACpC,KAAKsC,cACN,MAAMzD,iBAAiB0D,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAazC,KAAKsC;GAClB,GAAItC,KAAK0C,QAAQ,EAAEA,OAAO1C,KAAK0C,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACzC,UACD,MAAMjB,mBAAmB2D,gBAAe;EAY5C,IACI3C,KAAKuB,YACLtB,SAASD,KAAKsB,YAAYtB,KAAKuB,UAE/B,MAAMzC,yBAAyB8D,cAAa;EAOhD,MAAMC,aAAaC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;EAC3C,IAAIC,WAAWL;EACf,IAAIM,UAA2B;EAC/B,IAAIjD,QAAQe,WAAW;GACnBkC,UAAU,MAAM,KAAK5D,eAAe6D,YAAYlD,QAAQe,SAAS;GACjE,IAAIkC,WAAWA,QAAQE,WACnBH,WAAWJ,KAAKC,MAAM,IAAIC,KAAKG,QAAQE,SAAS,CAAA,CAAEC,QAAO,IAAK,GAAA;EAEtE;EAQA,IAAI,KAAK1D,wBAAwBK,SAASkB,SAAS/C,aAAamF,MAAM;GAGlE,MAAMC,YAAY,MAAM,KAAK5D,qBAAqB4D,UAC9CvD,SAASD,KAAKc,IACd,EAAE2C,eAAe,MAAM,CAAA;GAE3B,IAAID,UAAUE,YAAY,CAACP,SAASQ,OAChC,MAAM5E,uBAAuB6E,kBAAiB;GAGlD,IAAIJ,UAAUK,oBACV,MAAM9E,uBAAuB8E,mBAAkB;GAUnD,IAAIL,UAAUE,YAAY1D,KAAK8D,YACT9D;QAAAA,KAAK8D,WAAW7B,MAAM,GACpC8B,CAAAA,CAAU1B,SAAS3D,iCAAiCsF,GAAG,GAAG;KAC1D,MAAMC,eAAed,SAASQ,QAC1Bb,KAAKC,MAAM,IAAIC,KAAKG,QAAQQ,KAAK,CAAA,CAAEL,QAAO,IAAK,GAAA,IAC/C;KACJ,IAAIW,iBAAiB,QAAQpB,aAAaoB,eAAe,KAAKtE,oBAC1D,MAAMZ,uBAAuBmF,eAAc;IAEnD;;EAER;EAMA,KADgBlE,KAAKoE,SAASpE,KAAKoE,OAAOnC,MAAM,GAAA,IAAO,CAAA,EAAA,CAE3CI,SAAS1D,0BAA0B0F,KAAK,KAChDxB,aAAaK,WAAW,KAAKxD,mBAE7B,MAAMZ,yBAAyBwF,yBAAwB;EAG3D,IACI,OAAOtE,KAAKuE,YAAY,eACxBvE,KAAKuE,YAAY,MACnB;GACE,MAAMC,SAASC,OAAOzE,KAAKuE,OAAO;GAClC,IACIE,OAAOC,SAASF,MAAAA,KAChB3B,aAAaK,WAAWsB,QAExB,MAAM1F,yBAAyBwF,yBAAwB;EAE/D;EAQA,IAAIpE,QAAQW,QAAQ8D,gBAAgB;GAChC,IAAIC,UAAU;GAEd,MAAMC,UAAU3F,qBAAqBe,QAAAA;GACrC,IAAI,KAAKJ,yBAAyBgF,SAC9BD,UAAU,MAAM,KAAK/E,sBAAsBiF,SACvC5E,QAAQW,OAAO8D,gBACfE,OAAAA;GAIR,IAAI,CAACD,SACD,MAAMnG,wBAAwBsG,UAC1B7E,QAAQ8E,uBAAuBhF,KAAKsC,eAChC;IAAEG,aAAazC,KAAKsC;IAAcI,OAAO1C,KAAK0C,SAAS;GAAK,IAC5DuC,KAAAA,CAAAA;EAGhB;EAeAzC,OAAO6C,qBAAoBH,MAVwB,KAAK5F,WAAW6F,MAC/DnF,MACAC,UACA;GACIgB,WAAWf,QAAQe;GACnBiC;GACAkC,YAAYjC,SAASiC,cAAc;EACvC,CAAA,EAAA,CAGkCtE;EAEtC,OAAO0B;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["EventName","EventRefType","EventScope","IdentityType","SessionAuthMethod","hasInstanceof","OAUTH2_ACCESS_DENIED_ERROR_INSTANCE","OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE","OAUTH2_MFA_REQUIRED_ERROR_INSTANCE","OAuth2AccessDeniedError","OAuth2AuthenticationContextClass","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2LoginRequiredError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2ResponseTypeError","toIdentityPolicyData","DEFAULT_PROMPT_LOGIN_MAX_AGE","DEFAULT_MFA_FRESHNESS_MAX_AGE","OAuth2Authorization","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","ctx","authorize","data","identity","options","result","authorizeInner","record","scope","OAUTH2","name","AUTHORIZE","refType","CLIENT","refId","client","id","client_id","clientId","sessionId","actorType","type","actorId","actorName","realmId","realm_id","reason","builtIn","recordAuthorize","e","AUTHORIZE_FAILED","responseTypes","response_type","Array","isArray","split","responseType","CODE","unsupported","includes","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","realmMismatch","nowSeconds","Math","floor","Date","now","authTime","session","findOneById","createdAt","getTime","USER","challenge","issueMaterial","externallyAuthenticated","authMethod","EXTERNAL","required","mfaAt","challengeRequired","enrollmentRequired","acr_values","acrValues","MFA","mfaAtSeconds","stepUpRequired","prompts","prompt","LOGIN","reauthenticationRequired","max_age","maxAge","Number","isFinite","accessPolicyId","allowed","subject","evaluate","forClient","redirectUriVerified","undefined","codeEntity","issue","authorizationCode"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Identity, \n    OAuth2AuthorizationCode, \n    OAuth2AuthorizationCodeRequest, \n    Session,\n} from '@authup/core-kit';\nimport {\n    EventName, \n    EventRefType, \n    EventScope, \n    IdentityType,\n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport { hasInstanceof } from '@authup/errors';\nimport {\n    OAUTH2_ACCESS_DENIED_ERROR_INSTANCE,\n    OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE,\n    OAUTH2_MFA_REQUIRED_ERROR_INSTANCE,\n    OAuth2AccessDeniedError,\n    OAuth2AuthenticationContextClass,\n    OAuth2AuthorizationPrompt,\n    OAuth2AuthorizationResponseType,\n    OAuth2GrantError,\n    OAuth2LoginRequiredError,\n    OAuth2MfaRequiredError,\n    OAuth2RequestError,\n    OAuth2ResponseTypeError,\n} from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport { toIdentityPolicyData } from '../../identity/permission/identity-policy-data.ts';\nimport type {\n    OAuth2AuthorizationManagerContext,\n    OAuth2AuthorizationOptions,\n    OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IEventService, IUserAuthenticatorChallengeProvider } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\n\nconst DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;\n\n// Deliberately 60 (not 0, deviating from the plan-050 sketch): the hosted\n// challenge round-trip (stamp mfa_at → retry POST /authorize) takes seconds,\n// so a 0-window step-up could never be satisfied and would loop the ladder.\nconst DEFAULT_MFA_FRESHNESS_MAX_AGE = 60;\n\nexport class OAuth2Authorization {\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    protected sessionManager : ISessionManager;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected promptLoginMaxAge : number;\n\n    protected mfaFreshnessMaxAge : number;\n\n    protected mfaChallengeProvider? : IUserAuthenticatorChallengeProvider;\n\n    protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n    constructor(ctx: OAuth2AuthorizationManagerContext) {\n        this.codeIssuer = ctx.codeIssuer;\n        this.sessionManager = ctx.sessionManager;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n        this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n        this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;\n        this.mfaFreshnessMaxAge = ctx.mfaFreshnessMaxAge ?? DEFAULT_MFA_FRESHNESS_MAX_AGE;\n        this.mfaChallengeProvider = ctx.mfaChallengeProvider;\n    }\n\n    /**\n     * Authorize with validated codeRequest.\n     *\n     * @param data\n     * @param identity\n     * @param options\n     */\n    async authorize(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationOptions = {},\n    ) : Promise<OAuth2AuthorizationResult> {\n        try {\n            const result = await this.authorizeInner(data, identity, options);\n\n            await this.eventService?.record({\n                scope: EventScope.OAUTH2,\n                name: EventName.AUTHORIZE,\n                refType: EventRefType.CLIENT,\n                refId: options.client?.id ?? data.client_id ?? null,\n                clientId: options.client?.id ?? data.client_id ?? null,\n                sessionId: options.sessionId ?? null,\n                actorType: identity.type,\n                actorId: identity.data.id,\n                actorName: identity.data.name,\n                realmId: data.realm_id ?? null,\n                data: {\n                    reason: options.client?.builtIn ? 'autoConsent' : 'consent',\n                    ...(data.scope ? { scope: data.scope } : {}),\n                },\n            });\n            this.metrics?.recordAuthorize('issued');\n\n            return result;\n        } catch (e) {\n            if (hasInstanceof(e, OAUTH2_ACCESS_DENIED_ERROR_INSTANCE)) {\n                await this.eventService?.record({\n                    scope: EventScope.OAUTH2,\n                    name: EventName.AUTHORIZE_FAILED,\n                    refType: EventRefType.CLIENT,\n                    refId: options.client?.id ?? data.client_id ?? null,\n                    clientId: options.client?.id ?? data.client_id ?? null,\n                    sessionId: options.sessionId ?? null,\n                    actorType: identity.type,\n                    actorId: identity.data.id,\n                    actorName: identity.data.name,\n                    realmId: data.realm_id ?? null,\n                    data: { reason: 'accessPolicy' },\n                });\n                this.metrics?.recordAuthorize('denied');\n            } else if (hasInstanceof(e, OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE)) {\n                this.metrics?.recordAuthorize('login_required');\n            } else if (hasInstanceof(e, OAUTH2_MFA_REQUIRED_ERROR_INSTANCE)) {\n                this.metrics?.recordAuthorize('mfa_required');\n            } else {\n                this.metrics?.recordAuthorize('error');\n            }\n\n            throw e;\n        }\n    }\n\n    protected async authorizeInner(\n        data: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationOptions = {},\n    ) : Promise<OAuth2AuthorizationResult> {\n        // OAuth 2.1 posture: only the authorization-code response type is\n        // supported — implicit/hybrid (token, id_token, none) were dropped\n        // (plan 042 item 3). Defense in depth behind the request validator.\n        let responseTypes : string[] = [];\n        if (data.response_type) {\n            responseTypes = Array.isArray(data.response_type) ?\n                data.response_type :\n                data.response_type.split(' ');\n        }\n\n        for (const responseType of responseTypes) {\n            if (responseType !== OAuth2AuthorizationResponseType.CODE) {\n                throw OAuth2ResponseTypeError.unsupported();\n            }\n        }\n\n        if (!responseTypes.includes(OAuth2AuthorizationResponseType.CODE)) {\n            throw OAuth2ResponseTypeError.unsupported();\n        }\n\n        if (!data.redirect_uri) {\n            throw OAuth2GrantError.redirectUriMismatch();\n        }\n\n        const output : OAuth2AuthorizationResult = {\n            redirectUri: data.redirect_uri,\n            ...(data.state ? { state: data.state } : {}),\n        };\n\n        if (!identity) {\n            throw OAuth2RequestError.identityInvalid();\n        }\n\n        // Realm binding: the code-request verifier stamped data.realm_id with the\n        // resolved client's realm. The authenticated identity must belong to that\n        // same realm — otherwise a lingering session for realm A could silently\n        // mint a code/token for realm B's client (confused deputy). The error body\n        // deliberately carries no identity data (no realm-enumeration oracle).\n        // The comparison reads the scalar realmId column, NOT the realm\n        // relation — the relation may simply not be loaded on the resolved\n        // identity. An identity without a realmId fails closed the same way —\n        // clean login_required, never a TypeError.\n        if (\n            data.realm_id &&\n            identity.data.realmId !== data.realm_id\n        ) {\n            throw OAuth2LoginRequiredError.realmMismatch();\n        }\n\n        // Authentication time = the backing session's creation instant (NOT\n        // refreshed_at — a token refresh must not reset it). Session-less flows\n        // (e.g. HTTP Basic authorize) present live credentials on this request,\n        // so the authentication time is \"now\".\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        let authTime = nowSeconds;\n        let session : Session | null = null;\n        if (options.sessionId) {\n            session = await this.sessionManager.findOneById(options.sessionId);\n            if (session && session.createdAt) {\n                authTime = Math.floor(new Date(session.createdAt).getTime() / 1000);\n            }\n        }\n\n        // MFA backstop (plan 049) — the authoritative server-side gate; the\n        // hosted UI's challenge step is convenience. The proof is session-bound\n        // (mfa_at — stamped by the challenge endpoint or the password grant's\n        // otp param), so a session-less flow (HTTP Basic) cannot carry one and\n        // fails closed while the user holds a confirmed device. A user without\n        // a device under mfaRequired is routed to inline enrollment.\n        if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {\n            // requirement flags only — the interactive challenge material (the\n            // webauthn nonce) is issued by the status endpoint, not this backstop.\n            const challenge = await this.mfaChallengeProvider.challenge(\n                identity.data.id,\n                { issueMaterial: false },\n            );\n            // The local second factor belongs to a local credential. A\n            // session established by an external identity provider was\n            // authenticated THERE, which is where MFA is configured and\n            // enforced for it, so authup does not stack a factor of its own\n            // on top and `mfaRequired` does not force local enrollment on\n            // those users. The route is opt-in either way: an external\n            // identity reaches an existing account only through the\n            // bearer-authenticated link flow, since a first login provisions\n            // a NEW user (plan 091). A session-less authorize (HTTP Basic) is\n            // not external and keeps the gate.\n            const externallyAuthenticated = session?.authMethod === SessionAuthMethod.EXTERNAL;\n\n            if (!externallyAuthenticated) {\n                if (challenge.required && !session?.mfaAt) {\n                    throw OAuth2MfaRequiredError.challengeRequired();\n                }\n\n                if (challenge.enrollmentRequired) {\n                    throw OAuth2MfaRequiredError.enrollmentRequired();\n                }\n            }\n\n            // Step-up (plan 050 stage 3): a requested `acr_values` containing\n            // urn:authup:mfa is a TRIGGER (Auth0/Keycloak stance) — the proof\n            // must additionally be FRESH (mfaFreshnessMaxAge window, mirroring\n            // promptLoginMaxAge's absorb-the-round-trip semantics). Enforced\n            // only while the user actually holds a factor — per OIDC Core\n            // §5.5.1.1 acr is voluntary, so an unsatisfiable request degrades\n            // to the achieved acr instead of bricking the RP.\n            //\n            // This one DOES apply to an externally authenticated session: the\n            // application asked for MFA explicitly, and a local factor the\n            // user holds is the only way authup can answer that. Trusting the\n            // upstream is the default, not a refusal to prove anything.\n            if (challenge.required && data.acr_values) {\n                const acrValues = data.acr_values.split(' ');\n                if (acrValues.includes(OAuth2AuthenticationContextClass.MFA)) {\n                    const mfaAtSeconds = session?.mfaAt ?\n                        Math.floor(new Date(session.mfaAt).getTime() / 1000) :\n                        null;\n                    if (mfaAtSeconds === null || nowSeconds - mfaAtSeconds > this.mfaFreshnessMaxAge) {\n                        throw OAuth2MfaRequiredError.stepUpRequired();\n                    }\n                }\n            }\n        }\n\n        // OIDC §3.1.2.1 prompt=login / max_age freshness (enforced only when\n        // requested — a plain authorize never throws here). The hosted page\n        // renders the login form for prompt=login; this is the server backstop.\n        const prompts = data.prompt ? data.prompt.split(' ') : [];\n        if (\n            prompts.includes(OAuth2AuthorizationPrompt.LOGIN) &&\n            nowSeconds - authTime > this.promptLoginMaxAge\n        ) {\n            throw OAuth2LoginRequiredError.reauthenticationRequired();\n        }\n\n        if (\n            typeof data.max_age !== 'undefined' &&\n            data.max_age !== null\n        ) {\n            const maxAge = Number(data.max_age);\n            if (\n                Number.isFinite(maxAge) &&\n                nowSeconds - authTime > maxAge\n            ) {\n                throw OAuth2LoginRequiredError.reauthenticationRequired();\n            }\n        }\n\n        // Application access policy (plan 052) — the last gate before\n        // issuance: a denial is only revealed to a fully-authenticated\n        // (incl. second-factor) identity. A client carrying a policy id with\n        // no wired evaluator denies too (never silently allow a configured\n        // gate). The redirect target rides the error only when the\n        // redirect_uri was pattern-verified (RFC 6749 §4.1.2.1).\n        if (options.client?.accessPolicyId) {\n            let allowed = false;\n\n            const subject = toIdentityPolicyData(identity);\n            if (this.accessPolicyEvaluator && subject) {\n                allowed = await this.accessPolicyEvaluator.evaluate(\n                    options.client.accessPolicyId,\n                    subject,\n                );\n            }\n\n            if (!allowed) {\n                throw OAuth2AccessDeniedError.forClient(\n                    options.redirectUriVerified && data.redirect_uri ?\n                        { redirectUri: data.redirect_uri, state: data.state ?? null } :\n                        undefined,\n                );\n            }\n        }\n\n        // The id_token is NOT minted here — the /token exchange mints it after\n        // resolving the real backing session, so its `sid` is authoritative\n        // (plan 042 item 6). The code carries the authentication instant.\n        const codeEntity : OAuth2AuthorizationCode = await this.codeIssuer.issue(\n            data,\n            identity,\n            {\n                sessionId: options.sessionId,\n                authTime,\n                authMethod: session?.authMethod ?? null,\n            },\n        );\n\n        output.authorizationCode = codeEntity.id;\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;AA+CA,MAAMmB,+BAA+B;AAKrC,MAAMC,gCAAgC;AAEtC,IAAaC,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKR,aAAaQ,IAAIR;EACtB,KAAKC,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,UAAUK,IAAIL;EACnB,KAAKI,wBAAwBC,IAAID;EACjC,KAAKH,oBAAoBI,IAAIJ,qBAAqBP;EAClD,KAAKQ,qBAAqBG,IAAIH,sBAAsBP;EACpD,KAAKQ,uBAAuBE,IAAIF;CACpC;;;;;;;IASA,MAAMG,UACFC,MACAC,UACAC,UAAsC,CAAC,GACJ;EACnC,IAAI;GACA,MAAMC,SAAS,MAAM,KAAKC,eAAeJ,MAAMC,UAAUC,OAAAA;GAEzD,MAAM,KAAKV,cAAca,OAAO;IAC5BC,OAAOpC,WAAWqC;IAClBC,MAAMxC,UAAUyC;IAChBC,SAASzC,aAAa0C;IACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAClDE,WAAWf,QAAQe,aAAa;IAChCC,WAAWjB,SAASkB;IACpBC,SAASnB,SAASD,KAAKc;IACvBO,WAAWpB,SAASD,KAAKQ;IACzBc,SAAStB,KAAKuB,YAAY;IAC1BvB,MAAM;KACFwB,QAAQtB,QAAQW,QAAQY,UAAU,gBAAgB;KAClD,GAAIzB,KAAKM,QAAQ,EAAEA,OAAON,KAAKM,MAAM,IAAI,CAAC;IAC9C;GACJ,CAAA;GACA,KAAKb,SAASiC,gBAAgB,QAAA;GAE9B,OAAOvB;EACX,SAASwB,GAAG;GACR,IAAItD,cAAcsD,GAAGrD,mCAAAA,GAAsC;IACvD,MAAM,KAAKkB,cAAca,OAAO;KAC5BC,OAAOpC,WAAWqC;KAClBC,MAAMxC,UAAU4D;KAChBlB,SAASzC,aAAa0C;KACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAClDE,WAAWf,QAAQe,aAAa;KAChCC,WAAWjB,SAASkB;KACpBC,SAASnB,SAASD,KAAKc;KACvBO,WAAWpB,SAASD,KAAKQ;KACzBc,SAAStB,KAAKuB,YAAY;KAC1BvB,MAAM,EAAEwB,QAAQ,eAAe;IACnC,CAAA;IACA,KAAK/B,SAASiC,gBAAgB,QAAA;GAClC,OAAO,IAAIrD,cAAcsD,GAAGpD,oCAAAA,GACxB,KAAKkB,SAASiC,gBAAgB,gBAAA;QAC3B,IAAIrD,cAAcsD,GAAGnD,kCAAAA,GACxB,KAAKiB,SAASiC,gBAAgB,cAAA;QAE9B,KAAKjC,SAASiC,gBAAgB,OAAA;GAGlC,MAAMC;EACV;CACJ;CAEA,MAAgBvB,eACZJ,MACAC,UACAC,UAAsC,CAAC,GACJ;EAInC,IAAI2B,gBAA2B,CAAA;EAC/B,IAAI7B,KAAK8B,eACLD,gBAAgBE,MAAMC,QAAQhC,KAAK8B,aAAa,IAC5C9B,KAAK8B,gBACL9B,KAAK8B,cAAcG,MAAM,GAAA;EAGjC,KAAK,MAAMC,gBAAgBL,eACvB,IAAIK,iBAAiBtD,gCAAgCuD,MACjD,MAAMlD,wBAAwBmD,YAAW;EAIjD,IAAI,CAACP,cAAcQ,SAASzD,gCAAgCuD,IAAI,GAC5D,MAAMlD,wBAAwBmD,YAAW;EAG7C,IAAI,CAACpC,KAAKsC,cACN,MAAMzD,iBAAiB0D,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAazC,KAAKsC;GAClB,GAAItC,KAAK0C,QAAQ,EAAEA,OAAO1C,KAAK0C,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACzC,UACD,MAAMjB,mBAAmB2D,gBAAe;EAY5C,IACI3C,KAAKuB,YACLtB,SAASD,KAAKsB,YAAYtB,KAAKuB,UAE/B,MAAMzC,yBAAyB8D,cAAa;EAOhD,MAAMC,aAAaC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;EAC3C,IAAIC,WAAWL;EACf,IAAIM,UAA2B;EAC/B,IAAIjD,QAAQe,WAAW;GACnBkC,UAAU,MAAM,KAAK5D,eAAe6D,YAAYlD,QAAQe,SAAS;GACjE,IAAIkC,WAAWA,QAAQE,WACnBH,WAAWJ,KAAKC,MAAM,IAAIC,KAAKG,QAAQE,SAAS,CAAA,CAAEC,QAAO,IAAK,GAAA;EAEtE;EAQA,IAAI,KAAK1D,wBAAwBK,SAASkB,SAAShD,aAAaoF,MAAM;GAGlE,MAAMC,YAAY,MAAM,KAAK5D,qBAAqB4D,UAC9CvD,SAASD,KAAKc,IACd,EAAE2C,eAAe,MAAM,CAAA;GAc3B,IAAI,EAF4BN,SAASQ,eAAevF,kBAAkBwF,WAE5C;IAC1B,IAAIJ,UAAUK,YAAY,CAACV,SAASW,OAChC,MAAM/E,uBAAuBgF,kBAAiB;IAGlD,IAAIP,UAAUQ,oBACV,MAAMjF,uBAAuBiF,mBAAkB;GAEvD;GAcA,IAAIR,UAAUK,YAAY7D,KAAKiE,YACTjE;QAAAA,KAAKiE,WAAWhC,MAAM,GACpCiC,CAAAA,CAAU7B,SAAS3D,iCAAiCyF,GAAG,GAAG;KAC1D,MAAMC,eAAejB,SAASW,QAC1BhB,KAAKC,MAAM,IAAIC,KAAKG,QAAQW,KAAK,CAAA,CAAER,QAAO,IAAK,GAAA,IAC/C;KACJ,IAAIc,iBAAiB,QAAQvB,aAAauB,eAAe,KAAKzE,oBAC1D,MAAMZ,uBAAuBsF,eAAc;IAEnD;;EAER;EAMA,KADgBrE,KAAKuE,SAASvE,KAAKuE,OAAOtC,MAAM,GAAA,IAAO,CAAA,EAAA,CAE3CI,SAAS1D,0BAA0B6F,KAAK,KAChD3B,aAAaK,WAAW,KAAKxD,mBAE7B,MAAMZ,yBAAyB2F,yBAAwB;EAG3D,IACI,OAAOzE,KAAK0E,YAAY,eACxB1E,KAAK0E,YAAY,MACnB;GACE,MAAMC,SAASC,OAAO5E,KAAK0E,OAAO;GAClC,IACIE,OAAOC,SAASF,MAAAA,KAChB9B,aAAaK,WAAWyB,QAExB,MAAM7F,yBAAyB2F,yBAAwB;EAE/D;EAQA,IAAIvE,QAAQW,QAAQiE,gBAAgB;GAChC,IAAIC,UAAU;GAEd,MAAMC,UAAU9F,qBAAqBe,QAAAA;GACrC,IAAI,KAAKJ,yBAAyBmF,SAC9BD,UAAU,MAAM,KAAKlF,sBAAsBoF,SACvC/E,QAAQW,OAAOiE,gBACfE,OAAAA;GAIR,IAAI,CAACD,SACD,MAAMtG,wBAAwByG,UAC1BhF,QAAQiF,uBAAuBnF,KAAKsC,eAChC;IAAEG,aAAazC,KAAKsC;IAAcI,OAAO1C,KAAK0C,SAAS;GAAK,IAC5D0C,KAAAA,CAAAA;EAGhB;EAeA5C,OAAO+C,qBAAoBF,MAVwB,KAAK/F,WAAWgG,MAC/DtF,MACAC,UACA;GACIgB,WAAWf,QAAQe;GACnBiC;GACAS,YAAYR,SAASQ,cAAc;EACvC,CAAA,EAAA,CAGkC7C;EAEtC,OAAO0B;CACX;AACJ"}

package/dist/core/oauth2/authorization/state/types.d.ts

@@ -12,6 +12,14 @@ export type OAuth2AuthorizationState = {
      * endpoint, never from client input.
      */
     link?: OAuth2AuthorizationStateLink;
+    /**
+     * Ties a federated login to the browser that started it (plan 094). The
+     * value is set as a cookie when the login starts and required to match
+     * when the provider sends the browser back, so a crafted callback URL
+     * opened elsewhere establishes nothing. The state's own ip / user agent
+     * cannot do this: both are chosen by whoever mints the state (#3439).
+     */
+    browserNonce?: string;
     ip: string;
     userAgent?: string | null;
 };

package/dist/core/oauth2/authorization/state/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/state/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAEvE,MAAM,MAAM,4BAA4B,GAAG;IACvC,MAAM,EAAE,MAAM,CAAC;IAKf,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC,WAAW,CAAC,EAAE,8BAA8B,CAAC;IAC7C;;;;;OAKG;IACH,IAAI,CAAC,EAAE,4BAA4B,CAAC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC5C,MAAM,CAAC,IAAI,EAAE,wBAAwB,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzD;;;OAGG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,gCAAgC;IAC7C,IAAI,CAAC,IAAI,EAAE,wBAAwB,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtG"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/authorization/state/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAEvE,MAAM,MAAM,4BAA4B,GAAG;IACvC,MAAM,EAAE,MAAM,CAAC;IAKf,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC,WAAW,CAAC,EAAE,8BAA8B,CAAC;IAC7C;;;;;OAKG;IACH,IAAI,CAAC,EAAE,4BAA4B,CAAC;IACpC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC5C,MAAM,CAAC,IAAI,EAAE,wBAAwB,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzD;;;OAGG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,gCAAgC;IAC7C,IAAI,CAAC,IAAI,EAAE,wBAAwB,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtG"}

package/dist/core/oauth2/federated-login/constants.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Lifetime of a pending federated login (plan 094).
+ *
+ * It is completed by the very next page load, so it needs to cover a redirect
+ * and a bootstrap, not a user's attention span. It is also the lifetime of the
+ * session the callback creates, so an abandoned login self-expires and is
+ * swept with the regular session sweep; completion extends it to the full
+ * session lifetime.
+ */
+export declare const OAUTH2_FEDERATED_LOGIN_TTL: number;
+/**
+ * The cookie carrying the pending login between the provider callback and the
+ * hosted page that completes it.
+ *
+ * A cookie rather than a query parameter, which is what Keycloak and Authentik
+ * both do: the browser that STARTED the login is the only one that can present
+ * it, no other origin can set it, and nothing redeemable travels in a URL that
+ * reaches history, logs or a referrer. `SameSite=Lax` keeps it off cross-site
+ * requests, so a page on another origin cannot drive the completion.
+ */
+export declare const OAUTH2_FEDERATED_LOGIN_COOKIE = "authup_federated_login";
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/oauth2/federated-login/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/constants.ts"],"names":[],"mappings":"AAOA;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,QAAgB,CAAC;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,2BAA2B,CAAC"}

package/dist/core/oauth2/federated-login/constants.mjs

@@ -0,0 +1,27 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/oauth2/federated-login/constants.ts
+/**
+* Lifetime of a pending federated login (plan 094).
+*
+* It is completed by the very next page load, so it needs to cover a redirect
+* and a bootstrap, not a user's attention span. It is also the lifetime of the
+* session the callback creates, so an abandoned login self-expires and is
+* swept with the regular session sweep; completion extends it to the full
+* session lifetime.
+*/ const OAUTH2_FEDERATED_LOGIN_TTL = 3e5;
+/**
+* The cookie carrying the pending login between the provider callback and the
+* hosted page that completes it.
+*
+* A cookie rather than a query parameter, which is what Keycloak and Authentik
+* both do: the browser that STARTED the login is the only one that can present
+* it, no other origin can set it, and nothing redeemable travels in a URL that
+* reaches history, logs or a referrer. `SameSite=Lax` keeps it off cross-site
+* requests, so a page on another origin cannot drive the completion.
+*/ const OAUTH2_FEDERATED_LOGIN_COOKIE = "authup_federated_login";
+//#endregion
+export { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/oauth2/federated-login/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["OAUTH2_FEDERATED_LOGIN_TTL","OAUTH2_FEDERATED_LOGIN_COOKIE"],"sources":["../../../../src/core/oauth2/federated-login/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Lifetime of a pending federated login (plan 094).\n *\n * It is completed by the very next page load, so it needs to cover a redirect\n * and a bootstrap, not a user's attention span. It is also the lifetime of the\n * session the callback creates, so an abandoned login self-expires and is\n * swept with the regular session sweep; completion extends it to the full\n * session lifetime.\n */\nexport const OAUTH2_FEDERATED_LOGIN_TTL = 1000 * 60 * 5;\n\n/**\n * The cookie carrying the pending login between the provider callback and the\n * hosted page that completes it.\n *\n * A cookie rather than a query parameter, which is what Keycloak and Authentik\n * both do: the browser that STARTED the login is the only one that can present\n * it, no other origin can set it, and nothing redeemable travels in a URL that\n * reaches history, logs or a referrer. `SameSite=Lax` keeps it off cross-site\n * requests, so a page on another origin cannot drive the completion.\n */\nexport const OAUTH2_FEDERATED_LOGIN_COOKIE = 'authup_federated_login';\n"],"mappings":";;;;;;;;;;;;GAgBA,MAAaA,6BAA6B;;;;;;;;;;GAY1C,MAAaC,gCAAgC"}

package/dist/core/oauth2/federated-login/index.d.ts

@@ -1,3 +1,4 @@
+export * from './constants.ts';
 export * from './module.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/federated-login/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/federated-login/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL } from "./constants.mjs";
 import { OAuth2FederatedLoginRefusal } from "./types.mjs";
 import { OAuth2FederatedLoginService } from "./module.mjs";
-export { OAuth2FederatedLoginRefusal, OAuth2FederatedLoginService };
+export { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL, OAuth2FederatedLoginRefusal, OAuth2FederatedLoginService };

package/dist/core/oauth2/federated-login/module.d.ts

@@ -1,20 +1,29 @@
 import type { Logger } from '@authup/server-kit';
+import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IEventService, IRealmRepository } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
+import type { ISessionManager } from '../../authentication/index.ts';
 import type { IIdentityProviderAccountManager } from '../../identity/provider/account/types.ts';
 import type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';
-import type { IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier } from '../authorization/index.ts';
-import type { IOAuth2FederatedLoginService, OAuth2FederatedLoginAuthenticatorFactory, OAuth2FederatedLoginCompleteInput, OAuth2FederatedLoginCompleteResult, OAuth2FederatedLoginServiceContext, OAuth2FederatedLoginServiceOptions } from './types.ts';
+import type { IOAuth2AuthorizationCodeRequestVerifier } from '../authorization/index.ts';
+import type { IOAuth2TokenIssuer } from '../token/index.ts';
+import type { IOAuth2FederatedLoginService, IOAuth2FederatedLoginStore, OAuth2FederatedLoginAuthenticatorFactory, OAuth2FederatedLoginCompleteHandoffInput, OAuth2FederatedLoginCompleteInput, OAuth2FederatedLoginCompleteResult, OAuth2FederatedLoginServiceContext, OAuth2FederatedLoginServiceOptions } from './types.ts';
 export declare class OAuth2FederatedLoginService implements IOAuth2FederatedLoginService {
     protected options: OAuth2FederatedLoginServiceOptions;
     protected accountManager: IIdentityProviderAccountManager;
     protected realmRepository: IRealmRepository;
     protected codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
-    protected codeIssuer: IOAuth2AuthorizationCodeIssuer;
+    protected sessionManager: ISessionManager;
+    protected pendingLoginStore: IOAuth2FederatedLoginStore;
+    protected accessTokenIssuer: IOAuth2TokenIssuer;
+    protected refreshTokenIssuer: IOAuth2TokenIssuer;
     protected accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
     protected eventService?: IEventService;
+    protected metrics?: IAuthFlowMetrics;
     protected logger?: Logger;
     protected authenticatorFactory: OAuth2FederatedLoginAuthenticatorFactory;
     constructor(ctx: OAuth2FederatedLoginServiceContext);
     complete(input: OAuth2FederatedLoginCompleteInput): Promise<OAuth2FederatedLoginCompleteResult>;
+    completeHandoff(input: OAuth2FederatedLoginCompleteHandoffInput): Promise<OAuth2TokenGrantResponse>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/federated-login/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/module.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG/E,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAGhG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EACR,8BAA8B,EAC9B,uCAAuC,EAE1C,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EACR,4BAA4B,EAC5B,wCAAwC,EACxC,iCAAiC,EACjC,kCAAkC,EAClC,kCAAkC,EAClC,kCAAkC,EACrC,MAAM,YAAY,CAAC;AAGpB,qBAAa,2BAA4B,YAAW,4BAA4B;IAC5E,SAAS,CAAC,OAAO,EAAG,kCAAkC,CAAC;IAEvD,SAAS,CAAC,cAAc,EAAG,+BAA+B,CAAC;IAE3D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;IAEhE,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAE3B,SAAS,CAAC,oBAAoB,EAAG,wCAAwC,CAAC;gBAE9D,GAAG,EAAE,kCAAkC;IAqB7C,QAAQ,CAAC,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC,kCAAkC,CAAC;CA0LxG"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/module.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAQlF,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGrE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAIhG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EACR,uCAAuC,EAE1C,MAAM,2BAA2B,CAAC;AAGnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,KAAK,EACR,4BAA4B,EAC5B,0BAA0B,EAC1B,wCAAwC,EACxC,wCAAwC,EACxC,iCAAiC,EACjC,kCAAkC,EAClC,kCAAkC,EAClC,kCAAkC,EACrC,MAAM,YAAY,CAAC;AAGpB,qBAAa,2BAA4B,YAAW,4BAA4B;IAC5E,SAAS,CAAC,OAAO,EAAG,kCAAkC,CAAC;IAEvD,SAAS,CAAC,cAAc,EAAG,+BAA+B,CAAC;IAE3D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,iBAAiB,EAAG,0BAA0B,CAAC;IAEzD,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;IAEhE,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAE3B,SAAS,CAAC,oBAAoB,EAAG,wCAAwC,CAAC;gBAE9D,GAAG,EAAE,kCAAkC;IAyB7C,QAAQ,CAAC,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC,kCAAkC,CAAC;IA4L/F,eAAe,CAAC,KAAK,EAAE,wCAAwC,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAqF5G"}

package/dist/core/oauth2/federated-login/module.mjs

@@ -1,22 +1,32 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { deriveAmrAcr } from "../authorization/helpers.mjs";
 import { toIdentityPolicyData } from "../../identity/permission/identity-policy-data.mjs";
+import { OAUTH2_FEDERATED_LOGIN_TTL } from "./constants.mjs";
+import { describeError } from "../../../utils/error.mjs";
+import "../../../utils/index.mjs";
+import { isIdentityProviderAssuranceError } from "../../identity/provider/authentication/protocols/oauth2/assurance.mjs";
 import { createIdentityProviderOAuth2Authenticator } from "../../identity/provider/authentication/factory.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
 import { OAuth2FederatedLoginRefusal } from "./types.mjs";
 import { isSafeRedirectURLScheme } from "@authup/kit";
-import { EventName, EventRefType, EventScope, IdentityType, SessionAuthMethod } from "@authup/core-kit";
-import { InternalError } from "@authup/errors";
-import { OAuth2ErrorCode, OAuth2RequestError, isOAuth2Error } from "@authup/specs";
+import { EventName, EventRefType, EventScope, IdentityType, ScopeName, SessionAuthMethod } from "@authup/core-kit";
+import { BadRequestError, InternalError } from "@authup/errors";
+import { OAuth2ErrorCode, OAuth2RequestError, OAuth2SubKind, isOAuth2Error } from "@authup/specs";
 //#region src/core/oauth2/federated-login/module.ts
 var OAuth2FederatedLoginService = class {
 	options;
 	accountManager;
 	realmRepository;
 	codeRequestVerifier;
-	codeIssuer;
+	sessionManager;
+	pendingLoginStore;
+	accessTokenIssuer;
+	refreshTokenIssuer;
 	accessPolicyEvaluator;
 	eventService;
+	metrics;
 	logger;
 	authenticatorFactory;
 	constructor(ctx) {
@@ -24,9 +34,13 @@ var OAuth2FederatedLoginService = class {
 		this.accountManager = ctx.accountManager;
 		this.realmRepository = ctx.realmRepository;
 		this.codeRequestVerifier = ctx.codeRequestVerifier;
-		this.codeIssuer = ctx.codeIssuer;
+		this.sessionManager = ctx.sessionManager;
+		this.pendingLoginStore = ctx.pendingLoginStore;
+		this.accessTokenIssuer = ctx.accessTokenIssuer;
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
 		this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;
 		this.eventService = ctx.eventService;
+		this.metrics = ctx.metrics;
 		this.logger = ctx.logger;
 		this.authenticatorFactory = ctx.authenticatorFactory ?? ((provider, options) => createIdentityProviderOAuth2Authenticator({
 			accountManager: this.accountManager,
@@ -61,19 +75,32 @@ var OAuth2FederatedLoginService = class {
 			error: OAuth2ErrorCode.LOGIN_REQUIRED,
 			codeRequest: verified.data
 		};
-		const user = await this.authenticatorFactory(provider, {
+		const authenticator = this.authenticatorFactory(provider, {
 			baseURL: this.options.baseURL,
 			clientId: verified.data.client_id,
 			logger: this.logger
-		}).authenticate({ code });
+		});
+		let user;
+		try {
+			user = await authenticator.authenticate({ code });
+		} catch (e) {
+			if (!isIdentityProviderAssuranceError(e)) throw e;
+			this.logger?.warn(describeError(e, `The identity provider (${provider.id}) login was refused.`));
+			return {
+				kind: "refused",
+				refusal: OAuth2FederatedLoginRefusal.ASSURANCE_INSUFFICIENT,
+				error: OAuth2ErrorCode.ACCESS_DENIED,
+				codeRequest: verified.data
+			};
+		}
 		if (!user.active) return {
 			kind: "refused",
 			refusal: OAuth2FederatedLoginRefusal.USER_INACTIVE,
 			error: OAuth2ErrorCode.ACCESS_DENIED,
 			codeRequest: verified.data
 		};
-		const realm = await this.realmRepository.resolve(provider.realmId, true);
 		if (verified.client.accessPolicyId) {
+			const realm = await this.realmRepository.resolve(provider.realmId, true);
 			let allowed = false;
 			const subject = toIdentityPolicyData({
 				type: IdentityType.USER,
@@ -90,45 +117,74 @@ var OAuth2FederatedLoginService = class {
 				codeRequest: verified.data
 			};
 		}
-		const authorizationCode = await this.codeIssuer.issue(verified.data, {
-			type: IdentityType.USER,
-			data: {
-				...user,
-				realm
-			}
-		}, { authMethod: SessionAuthMethod.EXTERNAL });
+		const session = await this.sessionManager.create({
+			userAgent: input.request?.userAgent ?? void 0,
+			ipAddress: input.request?.ipAddress ?? void 0,
+			realmId: user.realmId,
+			sub: user.id,
+			subKind: IdentityType.USER,
+			mfaAt: null,
+			authMethod: SessionAuthMethod.EXTERNAL,
+			expiresAt: new Date(Date.now() + OAUTH2_FEDERATED_LOGIN_TTL).toISOString()
+		});
+		return {
+			kind: "issued",
+			pendingLoginId: await this.pendingLoginStore.save({
+				sessionId: session.id,
+				providerId: provider.id,
+				userName: user.name
+			}),
+			codeRequest: verified.data
+		};
+	}
+	async completeHandoff(input) {
+		const refuse = () => new BadRequestError("The login request is unknown or expired.");
+		const pending = await this.pendingLoginStore.consume(input.pendingLoginId);
+		if (!pending) throw refuse();
+		if (pending.providerId !== input.providerId) throw refuse();
+		const existing = await this.sessionManager.findOneById(pending.sessionId);
+		if (!existing) throw refuse();
+		if (Date.parse(existing.expiresAt) <= Date.now()) throw refuse();
+		const realm = await this.realmRepository.resolve(existing.realmId, true);
+		const session = await this.sessionManager.refresh(existing);
+		const payload = {
+			session_id: session.id,
+			user_agent: session.userAgent,
+			remote_address: session.ipAddress,
+			scope: ScopeName.GLOBAL,
+			sub: session.sub,
+			sub_kind: OAuth2SubKind.USER,
+			realm_id: session.realmId,
+			realm_name: realm.name,
+			...deriveAmrAcr(session)
+		};
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(payload);
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(payload);
 		await this.eventService?.record({
 			scope: EventScope.OAUTH2,
-			name: EventName.AUTHORIZE,
-			refType: EventRefType.CLIENT,
-			refId: verified.data.client_id ?? null,
-			clientId: verified.data.client_id ?? null,
-			sessionId: null,
+			name: EventName.LOGIN,
+			refType: EventRefType.SESSION,
+			refId: session.id,
+			clientId: null,
+			sessionId: session.id,
 			actorType: IdentityType.USER,
-			actorId: user.id,
-			actorName: user.name,
-			realmId: verified.data.realm_id ?? realm.id,
-			requestIpAddress: input.request?.ipAddress ?? null,
-			requestUserAgent: input.request?.userAgent ?? null,
+			actorId: session.sub,
+			actorName: pending.userName ?? null,
+			realmId: session.realmId,
+			requestIpAddress: session.ipAddress ?? null,
+			requestUserAgent: session.userAgent ?? null,
 			data: {
 				reason: "federated",
-				providerId: provider.id,
-				providerName: provider.name,
-				...verified.data.scope ? { scope: verified.data.scope } : {}
+				providerId: pending.providerId
 			}
 		});
-		return {
-			kind: "issued",
-			redirectUri,
-			code: authorizationCode.id,
-			state: verified.data.state,
-			codeRequest: verified.data,
-			client: {
-				id: verified.client.id,
-				name: verified.client.name,
-				displayName: verified.client.displayName ?? null
-			}
-		};
+		this.metrics?.recordLogin("success");
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		});
 	}
 };
 //#endregion