@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/core/identity/provider/authentication/protocols/oauth2/assurance.mjs

@@ -0,0 +1,89 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { extractTokenPayload } from "@authup/server-kit";
+import { ValidationError, markInstanceof, matchesInstanceof } from "@authup/errors";
+//#region src/core/identity/provider/authentication/protocols/oauth2/assurance.ts
+const IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE = Symbol.for("@authup/server-core/IdentityProviderAssuranceError");
+/**
+* The upstream did not meet the provider's `requiredAmr` / `requiredAcr`.
+*
+* It adds no dedicated `ErrorCode` and keeps `ValidationError`'s shared
+* `BAD_REQUEST`, so the marker is the ONLY thing the guard may read - a
+* code fallback would match every other `ValidationError` in the process.
+* That is sound here because both callers swallow it into a redirect (the
+* login bounces to the hosted page with `access_denied`, the link callback
+* with `linkError`), so it never crosses a wire boundary. The reason lands
+* in the operator's log instead, which is where a misconfigured allow-list
+* is debugged.
+*/ var IdentityProviderAssuranceError = class extends ValidationError {
+	constructor(message) {
+		super(message);
+		markInstanceof(this, IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE);
+	}
+};
+function isIdentityProviderAssuranceError(input) {
+	return matchesInstanceof(input, IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE);
+}
+/**
+* `unknown`, not `string | null`, because these are extra-attribute rows and
+* the EA value column round-trips through `destr`: a stored `"1"` - the
+* canonical PAPE / ISO-29115 acr level, and the shortest value the validator
+* deliberately allows - is read back as the NUMBER `1`. Calling a string
+* method on that threw, and `"0"` (falsy) silently disabled the whole check.
+*/ function splitList(input) {
+	if (input === null || typeof input === "undefined") return [];
+	return String(input).split(/[\s,]+/).filter(Boolean);
+}
+/**
+* The `acr_values` an outbound authorize request asks for, so the upstream is
+* asked to step up rather than merely observed. Voluntary in OIDC Core
+* 5.5.1.1 - a provider may ignore it and answer anyway, which is exactly what
+* {@see assertIdentityProviderAssurance} is for.
+*/ function buildIdentityProviderAcrValues(provider) {
+	const values = splitList(provider.requiredAcr);
+	return values.length > 0 ? values.join(" ") : void 0;
+}
+/**
+* Verify what the upstream actually returned against the provider's
+* allow-lists.
+*
+* Fail closed on every uncertainty: the claims are read from the `id_token`
+* alone, so a provider that returns none - or one whose token carries neither
+* claim, or cannot be decoded - is refused once an allow-list is set. Failing
+* open there would make the feature decorative.
+*
+* The token is DECODED, not verified, and that is not an oversight. It is the
+* return value of the server's own back-channel POST to the operator-configured
+* `tokenUrl`, so OIDC Core 3.1.3.7 item 6 accepts TLS server validation in
+* place of checking the signature. No browser-supplied token reaches here, and
+* a provider the operator configured is the authentication authority for these
+* users anyway: one that lies about `amr` could equally mint any subject. What
+* item 6 does NOT waive is the audience, which is checked below because
+* `clientId` is already in hand.
+*/ function assertIdentityProviderAssurance(provider, idToken) {
+	const requiredAmr = splitList(provider.requiredAmr);
+	const requiredAcr = splitList(provider.requiredAcr);
+	if (requiredAmr.length === 0 && requiredAcr.length === 0) return;
+	if (typeof idToken !== "string") throw new IdentityProviderAssuranceError("The identity provider returned no id_token to verify.");
+	let claims;
+	try {
+		claims = extractTokenPayload(idToken) ?? {};
+	} catch {
+		throw new IdentityProviderAssuranceError("The identity provider id_token could not be read.");
+	}
+	if (provider.clientId) {
+		const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+		if (audiences.length !== 1 || audiences[0] !== provider.clientId) throw new IdentityProviderAssuranceError("The identity provider id_token was not issued for this client alone.");
+		if (typeof claims.azp === "string" && claims.azp !== provider.clientId) throw new IdentityProviderAssuranceError("The identity provider id_token was issued for another party.");
+	}
+	if (requiredAmr.length > 0) {
+		const amr = Array.isArray(claims.amr) ? claims.amr : [];
+		if (requiredAmr.every((value) => !amr.includes(value))) throw new IdentityProviderAssuranceError(`The identity provider amr claim does not satisfy: ${requiredAmr.join(", ")}.`);
+	}
+	if (requiredAcr.length > 0 && !requiredAcr.includes(claims.acr)) throw new IdentityProviderAssuranceError(`The identity provider acr claim does not satisfy: ${requiredAcr.join(", ")}.`);
+}
+//#endregion
+export { IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE, IdentityProviderAssuranceError, assertIdentityProviderAssurance, buildIdentityProviderAcrValues, isIdentityProviderAssuranceError };
+
+//# sourceMappingURL=assurance.mjs.map

package/dist/core/identity/provider/authentication/protocols/oauth2/assurance.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"assurance.mjs","names":["ValidationError","markInstanceof","matchesInstanceof","extractTokenPayload","IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE","Symbol","for","IdentityProviderAssuranceError","message","isIdentityProviderAssuranceError","input","splitList","String","split","filter","Boolean","buildIdentityProviderAcrValues","provider","values","requiredAcr","length","join","undefined","assertIdentityProviderAssurance","idToken","requiredAmr","claims","clientId","audiences","Array","isArray","aud","azp","amr","every","value","includes","acr"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/assurance.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProviderBase } from '@authup/core-kit';\nimport { ValidationError, markInstanceof, matchesInstanceof } from '@authup/errors';\nimport { extractTokenPayload } from '@authup/server-kit';\n\nexport const IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE = Symbol.for('@authup/server-core/IdentityProviderAssuranceError');\n\n/**\n * The upstream did not meet the provider's `requiredAmr` / `requiredAcr`.\n *\n * It adds no dedicated `ErrorCode` and keeps `ValidationError`'s shared\n * `BAD_REQUEST`, so the marker is the ONLY thing the guard may read - a\n * code fallback would match every other `ValidationError` in the process.\n * That is sound here because both callers swallow it into a redirect (the\n * login bounces to the hosted page with `access_denied`, the link callback\n * with `linkError`), so it never crosses a wire boundary. The reason lands\n * in the operator's log instead, which is where a misconfigured allow-list\n * is debugged.\n */\nexport class IdentityProviderAssuranceError extends ValidationError {\n    constructor(message: string) {\n        super(message);\n        markInstanceof(this, IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE);\n    }\n}\n\nexport function isIdentityProviderAssuranceError(input: unknown): input is IdentityProviderAssuranceError {\n    return matchesInstanceof(input, IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE);\n}\n\n/**\n * `unknown`, not `string | null`, because these are extra-attribute rows and\n * the EA value column round-trips through `destr`: a stored `\"1\"` - the\n * canonical PAPE / ISO-29115 acr level, and the shortest value the validator\n * deliberately allows - is read back as the NUMBER `1`. Calling a string\n * method on that threw, and `\"0\"` (falsy) silently disabled the whole check.\n */\nfunction splitList(input?: unknown): string[] {\n    if (input === null || typeof input === 'undefined') {\n        return [];\n    }\n\n    return String(input).split(/[\\s,]+/).filter(Boolean);\n}\n\n/**\n * The `acr_values` an outbound authorize request asks for, so the upstream is\n * asked to step up rather than merely observed. Voluntary in OIDC Core\n * 5.5.1.1 - a provider may ignore it and answer anyway, which is exactly what\n * {@see assertIdentityProviderAssurance} is for.\n */\nexport function buildIdentityProviderAcrValues(provider: Partial<OAuth2IdentityProviderBase>): string | undefined {\n    const values = splitList(provider.requiredAcr);\n    return values.length > 0 ? values.join(' ') : undefined;\n}\n\n/**\n * Verify what the upstream actually returned against the provider's\n * allow-lists.\n *\n * Fail closed on every uncertainty: the claims are read from the `id_token`\n * alone, so a provider that returns none - or one whose token carries neither\n * claim, or cannot be decoded - is refused once an allow-list is set. Failing\n * open there would make the feature decorative.\n *\n * The token is DECODED, not verified, and that is not an oversight. It is the\n * return value of the server's own back-channel POST to the operator-configured\n * `tokenUrl`, so OIDC Core 3.1.3.7 item 6 accepts TLS server validation in\n * place of checking the signature. No browser-supplied token reaches here, and\n * a provider the operator configured is the authentication authority for these\n * users anyway: one that lies about `amr` could equally mint any subject. What\n * item 6 does NOT waive is the audience, which is checked below because\n * `clientId` is already in hand.\n */\nexport function assertIdentityProviderAssurance(\n    provider: Partial<OAuth2IdentityProviderBase>,\n    idToken?: string,\n): void {\n    const requiredAmr = splitList(provider.requiredAmr);\n    const requiredAcr = splitList(provider.requiredAcr);\n\n    if (requiredAmr.length === 0 && requiredAcr.length === 0) {\n        return;\n    }\n\n    if (typeof idToken !== 'string') {\n        throw new IdentityProviderAssuranceError('The identity provider returned no id_token to verify.');\n    }\n\n    let claims : Record<string, any>;\n    try {\n        // `?? {}` against the declared return type on purpose: a payload of\n        // literal `null` parses, so the claim reads below would throw a\n        // TypeError out of a callback that has to answer with a refusal.\n        claims = extractTokenPayload(idToken) ?? {};\n    } catch {\n        throw new IdentityProviderAssuranceError('The identity provider id_token could not be read.');\n    }\n\n    // OIDC Core 3.1.3.7 items 3-5, the part item 6 does not excuse. Guarded on\n    // `clientId` because the gate takes a partial provider: an absent client id\n    // has nothing to compare against, and inventing a refusal there would fail\n    // a login over a value the caller never supplied.\n    if (provider.clientId) {\n        const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];\n\n        // Item 3 rejects a token that lists an audience the client does not\n        // trust, and authup has no trusted-audience configuration, so the only\n        // trusted audience is this provider's own client id. A membership test\n        // would have accepted `[\"someone-else\", <us>]`, where the provider\n        // minted one assertion for several parties.\n        if (audiences.length !== 1 || audiences[0] !== provider.clientId) {\n            throw new IdentityProviderAssuranceError(\n                'The identity provider id_token was not issued for this client alone.',\n            );\n        }\n\n        // Item 5. Redundant against the single audience above for a conformant\n        // provider, and not against one that names a different authorized\n        // party.\n        if (typeof claims.azp === 'string' && claims.azp !== provider.clientId) {\n            throw new IdentityProviderAssuranceError(\n                'The identity provider id_token was issued for another party.',\n            );\n        }\n    }\n\n    if (requiredAmr.length > 0) {\n        const amr = Array.isArray(claims.amr) ? claims.amr : [];\n        if (requiredAmr.every((value) => !amr.includes(value))) {\n            throw new IdentityProviderAssuranceError(\n                `The identity provider amr claim does not satisfy: ${requiredAmr.join(', ')}.`,\n            );\n        }\n    }\n\n    if (requiredAcr.length > 0 && !requiredAcr.includes(claims.acr)) {\n        throw new IdentityProviderAssuranceError(\n            `The identity provider acr claim does not satisfy: ${requiredAcr.join(', ')}.`,\n        );\n    }\n}\n"],"mappings":";;;;;;AAWA,MAAaI,6CAA6CC,OAAOC,IAAI,oDAAA;;;;;;;;;;;;GAcrE,IAAaC,iCAAb,cAAoDP,gBAAAA;CAChD,YAAYQ,SAAiB;EACzB,MAAMA,OAAAA;EACNP,eAAe,MAAMG,0CAAAA;CACzB;AACJ;AAEA,SAAgBK,iCAAiCC,OAAc;CAC3D,OAAOR,kBAAkBQ,OAAON,0CAAAA;AACpC;;;;;;;GASA,SAASO,UAAUD,OAAe;CAC9B,IAAIA,UAAU,QAAQ,OAAOA,UAAU,aACnC,OAAO,CAAA;CAGX,OAAOE,OAAOF,KAAAA,CAAAA,CAAOG,MAAM,QAAA,CAAA,CAAUC,OAAOC,OAAAA;AAChD;;;;;;GAQA,SAAgBC,+BAA+BC,UAA6C;CACxF,MAAMC,SAASP,UAAUM,SAASE,WAAW;CAC7C,OAAOD,OAAOE,SAAS,IAAIF,OAAOG,KAAK,GAAA,IAAOC,KAAAA;AAClD;;;;;;;;;;;;;;;;;;GAoBA,SAAgBC,gCACZN,UACAO,SAAgB;CAEhB,MAAMC,cAAcd,UAAUM,SAASQ,WAAW;CAClD,MAAMN,cAAcR,UAAUM,SAASE,WAAW;CAElD,IAAIM,YAAYL,WAAW,KAAKD,YAAYC,WAAW,GACnD;CAGJ,IAAI,OAAOI,YAAY,UACnB,MAAM,IAAIjB,+BAA+B,uDAAA;CAG7C,IAAImB;CACJ,IAAI;EAIAA,SAASvB,oBAAoBqB,OAAAA,KAAY,CAAC;CAC9C,QAAQ;EACJ,MAAM,IAAIjB,+BAA+B,mDAAA;CAC7C;CAMA,IAAIU,SAASU,UAAU;EACnB,MAAMC,YAAYC,MAAMC,QAAQJ,OAAOK,GAAG,IAAIL,OAAOK,MAAM,CAACL,OAAOK,GAAI;EAOvE,IAAIH,UAAUR,WAAW,KAAKQ,UAAU,OAAOX,SAASU,UACpD,MAAM,IAAIpB,+BACN,sEAAA;EAOR,IAAI,OAAOmB,OAAOM,QAAQ,YAAYN,OAAOM,QAAQf,SAASU,UAC1D,MAAM,IAAIpB,+BACN,8DAAA;CAGZ;CAEA,IAAIkB,YAAYL,SAAS,GAAG;EACxB,MAAMa,MAAMJ,MAAMC,QAAQJ,OAAOO,GAAG,IAAIP,OAAOO,MAAM,CAAA;EACrD,IAAIR,YAAYS,OAAOC,UAAU,CAACF,IAAIG,SAASD,KAAAA,CAAAA,GAC3C,MAAM,IAAI5B,+BACN,qDAAqDkB,YAAYJ,KAAK,IAAA,EAAM,EAAE;CAG1F;CAEA,IAAIF,YAAYC,SAAS,KAAK,CAACD,YAAYiB,SAASV,OAAOW,GAAG,GAC1D,MAAM,IAAI9B,+BACN,qDAAqDY,YAAYE,KAAK,IAAA,EAAM,EAAE;AAG1F"}

package/dist/core/identity/provider/authentication/protocols/oauth2/index.d.ts

@@ -1,3 +1,4 @@
+export * from './assurance.ts';
 export * from './module.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/identity/provider/authentication/protocols/oauth2/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/provider/authentication/protocols/oauth2/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE, IdentityProviderAssuranceError, assertIdentityProviderAssurance, buildIdentityProviderAcrValues, isIdentityProviderAssuranceError } from "./assurance.mjs";
 import { IdentityProviderOAuth2Authenticator } from "./module.mjs";
-export { IdentityProviderOAuth2Authenticator };
+export { IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE, IdentityProviderAssuranceError, IdentityProviderOAuth2Authenticator, assertIdentityProviderAssurance, buildIdentityProviderAcrValues, isIdentityProviderAssuranceError };

package/dist/core/identity/provider/authentication/protocols/oauth2/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EACR,oBAAoB,EACpB,0CAA0C,EAC1C,0CAA0C,EAC1C,mCAAmC,EACtC,MAAM,YAAY,CAAC;AAQpB,qBAAa,mCAAoC,YAAW,oBAAoB,CAAC,IAAI,CAAC;IAClF,SAAS,CAAC,MAAM,EAAG,YAAY,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAG,0CAA0C,CAAC;IAE/D,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,QAAQ,EAAG,sBAAsB,GAAG,sBAAsB,CAAC;IAErE,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAIf,GAAG,EAAE,0CAA0C;IAqB3D,gBAAgB,CAAC,UAAU,GAAE,OAAO,CAAC,mBAAmB,CAAM,GAAI,MAAM;IAYlE,eAAe,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAW/F,YAAY,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxE,gBAAgB,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAiB1F;;;;;;;OAOG;cACa,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,SAAS,GAAI,OAAO,CAAC,SAAS,CAAC;IAyDjG;;;;OAIG;IACH,SAAS,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAI,OAAO,CAAC,CAAC,CAAC;cAY1C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,wBAAwB,CAAC;CA2BrH"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAI7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,KAAK,EACR,oBAAoB,EACpB,0CAA0C,EAC1C,0CAA0C,EAC1C,mCAAmC,EACtC,MAAM,YAAY,CAAC;AAQpB,qBAAa,mCAAoC,YAAW,oBAAoB,CAAC,IAAI,CAAC;IAClF,SAAS,CAAC,MAAM,EAAG,YAAY,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAG,0CAA0C,CAAC;IAE/D,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,QAAQ,EAAG,sBAAsB,GAAG,sBAAsB,CAAC;IAErE,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAIf,GAAG,EAAE,0CAA0C;IA4B3D,gBAAgB,CAAC,UAAU,GAAE,OAAO,CAAC,mBAAmB,CAAM,GAAI,MAAM;IA0BlE,eAAe,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAiB/F,YAAY,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxE,gBAAgB,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAiB1F;;;;;;;OAOG;cACa,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,SAAS,GAAI,OAAO,CAAC,SAAS,CAAC;IAyDjG;;;;OAIG;IACH,SAAS,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAI,OAAO,CAAC,CAAC,CAAC;cAY1C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,wBAAwB,CAAC;CA2BrH"}

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs

@@ -1,6 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { resolveURL } from "../../../../../../utils/url.mjs";
+import "../../../../../../utils/index.mjs";
+import { assertIdentityProviderAssurance, buildIdentityProviderAcrValues } from "./assurance.mjs";
 import { buildIdentityProviderAuthorizeCallbackPath } from "@authup/core-kit";
 import { extractTokenPayload } from "@authup/server-kit";
 import { ValidationError } from "@authup/errors";
@@ -24,7 +27,7 @@ var IdentityProviderOAuth2Authenticator = class {
 		this.client = new OAuth2Client({ options: {
 			clientId: ctx.provider.clientId,
 			clientSecret: ctx.provider.clientSecret,
-			redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,
+			redirectUri: resolveURL(ctx.options.baseURL, buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)),
 			scope: ctx.provider.scope || void 0,
 			authorizationEndpoint: ctx.provider.authorizeUrl,
 			tokenEndpoint: ctx.provider.tokenUrl,
@@ -33,13 +36,17 @@ var IdentityProviderOAuth2Authenticator = class {
 	}
 	buildRedirectURL(parameters = {}) {
 		try {
-			return this.client.authorize.buildURL(parameters);
+			const url = new URL(this.client.authorize.buildURL(parameters));
+			const acrValues = buildIdentityProviderAcrValues(this.provider);
+			if (acrValues) url.searchParams.set("acr_values", acrValues);
+			return url.href;
 		} catch {
 			throw new ValidationError("The identity provider is misconfigured and has an invalid or missing authorize URL.");
 		}
 	}
 	async resolveIdentity(params) {
 		const token = await this.client.token.createWithAuthorizationCode(params);
+		assertIdentityProviderAssurance(this.provider, token.id_token);
 		const identity = await this.buildIdentityWithTokenGrantResponse(token);
 		if (this.options.clientId) identity.clientId = this.options.clientId;
 		return identity;

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","ValidationError","extractTokenPayload","OAuth2Client","USERINFO_TIMEOUT","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","logger","ctx","clientId","clientSecret","redirectUri","baseURL","id","scope","undefined","authorizationEndpoint","authorizeUrl","tokenEndpoint","tokenUrl","userinfoEndpoint","userInfoUrl","buildRedirectURL","parameters","authorize","buildURL","resolveIdentity","params","token","createWithAuthorizationCode","identity","buildIdentityWithTokenGrantResponse","authenticate","account","save","user","safeAuthenticate","data","success","e","error","resolveClaims","input","payload","claims","id_token","warn","message","userInfo","withTimeout","get","type","access_token","sub","promise","Promise","race","_resolve","reject","setTimeout","Error","unref","attributeCandidates","name","preferred_username","nickname","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport { ValidationError } from '@authup/errors';\nimport type { Result } from '@authup/kit';\nimport type { JWTClaims } from '@authup/specs';\nimport type { Logger } from '@authup/server-kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\n/**\n * Bound on the optional userinfo enrichment. Short by design: the caller is\n * a browser sitting on a redirect, and the login proceeds without it.\n */\nconst USERINFO_TIMEOUT = 5000;\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    protected logger? : Logger;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n        this.logger = ctx.logger;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.clientId,\n                clientSecret: ctx.provider.clientSecret,\n                redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,\n                scope: ctx.provider.scope || undefined,\n                authorizationEndpoint: ctx.provider.authorizeUrl,\n                tokenEndpoint: ctx.provider.tokenUrl,\n                userinfoEndpoint: ctx.provider.userInfoUrl || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        try {\n            return this.client.authorize.buildURL(parameters);\n        } catch {\n            throw new ValidationError(\n                'The identity provider is misconfigured and has an invalid or missing authorize URL.',\n            );\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    async resolveIdentity(params: OAuth2AuthorizationCodeGrantPayload): Promise<IdentityProviderIdentity> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        return identity;\n    }\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const identity = await this.resolveIdentity(params);\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    /**\n     * The claims an external identity is described by, richest source last.\n     *\n     * The access token is opaque by contract (OIDC Core §2), so it is only\n     * the floor: authup's own carries `sub`, `kind` and `realm_name` and no\n     * username at all, which is why a federated user used to be provisioned\n     * under the remote subject UUID.\n     */\n    protected async resolveClaims(input: TokenGrantResponse, payload: JWTClaims) : Promise<JWTClaims> {\n        let claims = payload;\n\n        if (typeof input.id_token === 'string') {\n            try {\n                claims = {\n                    ...claims,\n                    ...extractTokenPayload(input.id_token),\n                };\n            } catch (e) {\n                // an encrypted (five-segment JWE) id_token is not decodable\n                // here, and was ignored outright before it was read at all.\n                // Logged rather than swallowed silently: every other reason\n                // to land here leaves the user provisioned under the remote\n                // subject, which is the defect this method exists to fix.\n                this.logger?.warn(\n                    `The identity provider (${this.provider.id}) id_token could not be read: ${(e as Error).message}`,\n                );\n            }\n        }\n\n        if (this.provider.userInfoUrl) {\n            // the guard is load-bearing: the client carries no baseURL, so\n            // hapic's `/userinfo` default would be a relative fetch URL\n            try {\n                const userInfo = await this.withTimeout(this.client.userInfo.get({\n                    type: 'Bearer',\n                    token: input.access_token,\n                }));\n\n                // OIDC Core 5.3.2: a userinfo response whose `sub` does not\n                // match the token's MUST NOT be used. Without this a\n                // mis-routed response (a multi-tenant gateway, a token\n                // mix-up) would name and, worse, EMAIL the local user after\n                // somebody else.\n                if (\n                    typeof userInfo.sub === 'string' &&\n                    typeof payload.sub === 'string' &&\n                    userInfo.sub !== payload.sub\n                ) {\n                    this.logger?.warn(\n                        `The identity provider (${this.provider.id}) userinfo subject does not match the token subject.`,\n                    );\n                } else {\n                    claims = { ...claims, ...userInfo };\n                }\n            } catch (e) {\n                // enrichment, never a login blocker\n                this.logger?.warn(\n                    `The identity provider (${this.provider.id}) userinfo request failed: ${(e as Error).message}`,\n                );\n            }\n        }\n\n        return claims;\n    }\n\n    /**\n     * hapic passes no `signal` to `fetch`, so an endpoint that accepts the\n     * connection and never answers would hold the login for undici's 300s\n     * headers timeout. Enrichment must not outlast the request it enriches.\n     */\n    protected withTimeout<T>(promise: Promise<T>) : Promise<T> {\n        return Promise.race([\n            promise,\n            new Promise<T>((_resolve, reject) => {\n                setTimeout(\n                    () => reject(new Error(`the request exceeded ${USERINFO_TIMEOUT}ms`)),\n                    USERINFO_TIMEOUT,\n                ).unref();\n            }),\n        ]);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n        const claims = await this.resolveClaims(input, payload);\n\n        return {\n            // the account key: sourcing it from a richer claim set would\n            // orphan every existing auth_identity_provider_accounts row\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    // keycloak/authentik put the username here, authup its\n                    // (nullable) display name; a candidate failing name\n                    // validation shifts to the next one\n                    claims.preferred_username,\n                    claims.nickname,\n                    // authup's own id_token: the real user name\n                    claims.name,\n                    claims.sub,\n                ],\n                email: [\n                    claims.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;GA6BA,MAAMI,mBAAmB;AAEzB,IAAaC,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;EACzD,KAAKJ,UAAUI,IAAIJ;EACnB,KAAKC,iBAAiBG,IAAIH;EAC1B,KAAKC,WAAWE,IAAIF;EACpB,KAAKC,SAASC,IAAID;EAElB,KAAKJ,SAAS,IAAIH,aAAa,EAC3BI,SAAS;GACLK,UAAUD,IAAIF,SAASG;GACvBC,cAAcF,IAAIF,SAASI;GAC3BC,aAAa,GAAGH,IAAIJ,QAAQQ,UAAUf,2CAA2CW,IAAIF,SAASO,EAAE;GAChGC,OAAON,IAAIF,SAASQ,SAASC,KAAAA;GAC7BC,uBAAuBR,IAAIF,SAASW;GACpCC,eAAeV,IAAIF,SAASa;GAC5BC,kBAAkBZ,IAAIF,SAASe,eAAeN,KAAAA;EAClD,EACJ,CAAA;CACJ;CAIAO,iBAAiBC,aAA2C,CAAC,GAAY;EACrE,IAAI;GACA,OAAO,KAAKpB,OAAOqB,UAAUC,SAASF,UAAAA;EAC1C,QAAQ;GACJ,MAAM,IAAIzB,gBACN,qFAAA;EAER;CACJ;CAIA,MAAM4B,gBAAgBC,QAAgF;EAClG,MAAMC,QAAQ,MAAM,KAAKzB,OAAOyB,MAAMC,4BAA4BF,MAAAA;EAElE,MAAMG,WAAW,MAAM,KAAKC,oCAAoCH,KAAAA;EAChE,IAAI,KAAKxB,QAAQK,UACbqB,SAASrB,WAAW,KAAKL,QAAQK;EAGrC,OAAOqB;CACX;CAEA,MAAME,aAAaL,QAA4D;EAC3E,MAAMG,WAAW,MAAM,KAAKJ,gBAAgBC,MAAAA;EAI5C,QAAOM,MAFe,KAAK5B,eAAe6B,KAAKJ,QAAAA,EAAAA,CAEhCK;CACnB;CAEA,MAAMC,iBAAiBT,QAAoE;EACvF,IAAI;GAEA,OAAO;IACHW,SAAS;IACTD,MAAAA,MAHe,KAAKL,aAAaL,MAAAA;GAIrC;EACJ,SAASY,GAAG;GACR,OAAO;IACHD,SAAS;IACTE,OAAOD;GACX;EACJ;CACJ;;;;;;;;IAYA,MAAgBE,cAAcC,OAA2BC,SAAyC;EAC9F,IAAIC,SAASD;EAEb,IAAI,OAAOD,MAAMG,aAAa,UAC1B,IAAI;GACAD,SAAS;IACL,GAAGA;IACH,GAAG7C,oBAAoB2C,MAAMG,QAAQ;GACzC;EACJ,SAASN,GAAG;GAMR,KAAKhC,QAAQuC,KACT,0BAA0B,KAAKxC,SAASO,GAAG,gCAAgC,EAAakC,SAAS;EAEzG;EAGJ,IAAI,KAAKzC,SAASe,aAGd,IAAI;GACA,MAAM2B,WAAW,MAAM,KAAKC,YAAY,KAAK9C,OAAO6C,SAASE,IAAI;IAC7DC,MAAM;IACNvB,OAAOc,MAAMU;GACjB,CAAA,CAAA;GAOA,IACI,OAAOJ,SAASK,QAAQ,YACxB,OAAOV,QAAQU,QAAQ,YACvBL,SAASK,QAAQV,QAAQU,KAEzB,KAAK9C,QAAQuC,KACT,0BAA0B,KAAKxC,SAASO,GAAG,qDAAqD;QAGpG+B,SAAS;IAAE,GAAGA;IAAQ,GAAGI;GAAS;EAE1C,SAAST,GAAG;GAER,KAAKhC,QAAQuC,KACT,0BAA0B,KAAKxC,SAASO,GAAG,6BAA6B,EAAakC,SAAS;EAEtG;EAGJ,OAAOH;CACX;;;;;IAOA,YAAyBU,SAAkC;EACvD,OAAOC,QAAQC,KAAK,CAChBF,SACA,IAAIC,SAAYE,UAAUC,WAAAA;GACtBC,iBACUD,uBAAO,IAAIE,MAAM,wBAAwB3D,iBAAiB,GAAG,CAAA,GACnEA,gBAAAA,CAAAA,CACF4D,MAAK;EACX,CAAA,CACH,CAAA;CACL;CAEA,MAAgB9B,oCAAoCW,OAA+D;EAC/G,MAAMC,UAAU5C,oBAAoB2C,MAAMU,YAAY;EACtD,MAAMR,SAAS,MAAM,KAAKH,cAAcC,OAAOC,OAAAA;EAE/C,OAAO;GAGH9B,IAAI8B,QAAQU;GACZS,qBAAqB;IACjBC,MAAM;KAIFnB,OAAOoB;KACPpB,OAAOqB;KAEPrB,OAAOmB;KACPnB,OAAOS;IACV;IACDa,OAAO,CACHtB,OAAOsB,KACV;GACL;GACA7B,MAAMM;GACNrC,UAAU,KAAKA;EACnB;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","resolveURL","ValidationError","extractTokenPayload","OAuth2Client","assertIdentityProviderAssurance","buildIdentityProviderAcrValues","USERINFO_TIMEOUT","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","logger","ctx","clientId","clientSecret","redirectUri","baseURL","id","scope","undefined","authorizationEndpoint","authorizeUrl","tokenEndpoint","tokenUrl","userinfoEndpoint","userInfoUrl","buildRedirectURL","parameters","url","URL","authorize","buildURL","acrValues","searchParams","set","href","resolveIdentity","params","token","createWithAuthorizationCode","id_token","identity","buildIdentityWithTokenGrantResponse","authenticate","account","save","user","safeAuthenticate","data","success","e","error","resolveClaims","input","payload","claims","warn","message","userInfo","withTimeout","get","type","access_token","sub","promise","Promise","race","_resolve","reject","setTimeout","Error","unref","attributeCandidates","name","preferred_username","nickname","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport { resolveURL } from '../../../../../../utils/index.ts';\nimport { ValidationError } from '@authup/errors';\nimport type { Result } from '@authup/kit';\nimport type { JWTClaims } from '@authup/specs';\nimport type { Logger } from '@authup/server-kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport { assertIdentityProviderAssurance, buildIdentityProviderAcrValues } from './assurance.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\n/**\n * Bound on the optional userinfo enrichment. Short by design: the caller is\n * a browser sitting on a redirect, and the login proceeds without it.\n */\nconst USERINFO_TIMEOUT = 5000;\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    protected logger? : Logger;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n        this.logger = ctx.logger;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.clientId,\n                clientSecret: ctx.provider.clientSecret,\n                // resolveURL, never a template literal: a publicUrl with a\n                // trailing slash produced `//identity-providers/...`, which\n                // the router does not match, so the provider sent the person\n                // back to a 404 and every federated login died there.\n                redirectUri: resolveURL(\n                    ctx.options.baseURL,\n                    buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id),\n                ),\n                scope: ctx.provider.scope || undefined,\n                authorizationEndpoint: ctx.provider.authorizeUrl,\n                tokenEndpoint: ctx.provider.tokenUrl,\n                userinfoEndpoint: ctx.provider.userInfoUrl || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        try {\n            const url = new URL(this.client.authorize.buildURL(parameters));\n\n            // Ask the upstream to step up rather than merely observing what\n            // it returns. Defaulted here rather than at the call sites, so\n            // the login and the account-link flow both send it.\n            //\n            // Appended by hand because hapic's buildAuthorizeURL only emits\n            // the keys it knows and silently drops the rest (tada5hi/hapic#1071)\n            // - drop this once `acr_values` is part of AuthorizeParameters.\n            const acrValues = buildIdentityProviderAcrValues(this.provider);\n            if (acrValues) {\n                url.searchParams.set('acr_values', acrValues);\n            }\n\n            return url.href;\n        } catch {\n            throw new ValidationError(\n                'The identity provider is misconfigured and has an invalid or missing authorize URL.',\n            );\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    async resolveIdentity(params: OAuth2AuthorizationCodeGrantPayload): Promise<IdentityProviderIdentity> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        // Before the identity is built, so a refused login provisions no user\n        // and links no account. Reading the token response here rather than\n        // inside the identity builder is deliberate: the five presets override\n        // the builder, and a preset must not be able to skip the gate.\n        assertIdentityProviderAssurance(this.provider, token.id_token);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        return identity;\n    }\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const identity = await this.resolveIdentity(params);\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    /**\n     * The claims an external identity is described by, richest source last.\n     *\n     * The access token is opaque by contract (OIDC Core §2), so it is only\n     * the floor: authup's own carries `sub`, `kind` and `realm_name` and no\n     * username at all, which is why a federated user used to be provisioned\n     * under the remote subject UUID.\n     */\n    protected async resolveClaims(input: TokenGrantResponse, payload: JWTClaims) : Promise<JWTClaims> {\n        let claims = payload;\n\n        if (typeof input.id_token === 'string') {\n            try {\n                claims = {\n                    ...claims,\n                    ...extractTokenPayload(input.id_token),\n                };\n            } catch (e) {\n                // an encrypted (five-segment JWE) id_token is not decodable\n                // here, and was ignored outright before it was read at all.\n                // Logged rather than swallowed silently: every other reason\n                // to land here leaves the user provisioned under the remote\n                // subject, which is the defect this method exists to fix.\n                this.logger?.warn(\n                    `The identity provider (${this.provider.id}) id_token could not be read: ${(e as Error).message}`,\n                );\n            }\n        }\n\n        if (this.provider.userInfoUrl) {\n            // the guard is load-bearing: the client carries no baseURL, so\n            // hapic's `/userinfo` default would be a relative fetch URL\n            try {\n                const userInfo = await this.withTimeout(this.client.userInfo.get({\n                    type: 'Bearer',\n                    token: input.access_token,\n                }));\n\n                // OIDC Core 5.3.2: a userinfo response whose `sub` does not\n                // match the token's MUST NOT be used. Without this a\n                // mis-routed response (a multi-tenant gateway, a token\n                // mix-up) would name and, worse, EMAIL the local user after\n                // somebody else.\n                if (\n                    typeof userInfo.sub === 'string' &&\n                    typeof payload.sub === 'string' &&\n                    userInfo.sub !== payload.sub\n                ) {\n                    this.logger?.warn(\n                        `The identity provider (${this.provider.id}) userinfo subject does not match the token subject.`,\n                    );\n                } else {\n                    claims = { ...claims, ...userInfo };\n                }\n            } catch (e) {\n                // enrichment, never a login blocker\n                this.logger?.warn(\n                    `The identity provider (${this.provider.id}) userinfo request failed: ${(e as Error).message}`,\n                );\n            }\n        }\n\n        return claims;\n    }\n\n    /**\n     * hapic passes no `signal` to `fetch`, so an endpoint that accepts the\n     * connection and never answers would hold the login for undici's 300s\n     * headers timeout. Enrichment must not outlast the request it enriches.\n     */\n    protected withTimeout<T>(promise: Promise<T>) : Promise<T> {\n        return Promise.race([\n            promise,\n            new Promise<T>((_resolve, reject) => {\n                setTimeout(\n                    () => reject(new Error(`the request exceeded ${USERINFO_TIMEOUT}ms`)),\n                    USERINFO_TIMEOUT,\n                ).unref();\n            }),\n        ]);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n        const claims = await this.resolveClaims(input, payload);\n\n        return {\n            // the account key: sourcing it from a richer claim set would\n            // orphan every existing auth_identity_provider_accounts row\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    // keycloak/authentik put the username here, authup its\n                    // (nullable) display name; a candidate failing name\n                    // validation shifts to the next one\n                    claims.preferred_username,\n                    claims.nickname,\n                    // authup's own id_token: the real user name\n                    claims.name,\n                    claims.sub,\n                ],\n                email: [\n                    claims.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;GA+BA,MAAMO,mBAAmB;AAEzB,IAAaC,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;EACzD,KAAKJ,UAAUI,IAAIJ;EACnB,KAAKC,iBAAiBG,IAAIH;EAC1B,KAAKC,WAAWE,IAAIF;EACpB,KAAKC,SAASC,IAAID;EAElB,KAAKJ,SAAS,IAAIL,aAAa,EAC3BM,SAAS;GACLK,UAAUD,IAAIF,SAASG;GACvBC,cAAcF,IAAIF,SAASI;GAK3BC,aAAahB,WACTa,IAAIJ,QAAQQ,SACZlB,2CAA2Cc,IAAIF,SAASO,EAAE,CAAA;GAE9DC,OAAON,IAAIF,SAASQ,SAASC,KAAAA;GAC7BC,uBAAuBR,IAAIF,SAASW;GACpCC,eAAeV,IAAIF,SAASa;GAC5BC,kBAAkBZ,IAAIF,SAASe,eAAeN,KAAAA;EAClD,EACJ,CAAA;CACJ;CAIAO,iBAAiBC,aAA2C,CAAC,GAAY;EACrE,IAAI;GACA,MAAMC,MAAM,IAAIC,IAAI,KAAKtB,OAAOuB,UAAUC,SAASJ,UAAAA,CAAAA;GASnD,MAAMK,YAAY5B,+BAA+B,KAAKM,QAAQ;GAC9D,IAAIsB,WACAJ,IAAIK,aAAaC,IAAI,cAAcF,SAAAA;GAGvC,OAAOJ,IAAIO;EACf,QAAQ;GACJ,MAAM,IAAInC,gBACN,qFAAA;EAER;CACJ;CAIA,MAAMoC,gBAAgBC,QAAgF;EAClG,MAAMC,QAAQ,MAAM,KAAK/B,OAAO+B,MAAMC,4BAA4BF,MAAAA;EAMlElC,gCAAgC,KAAKO,UAAU4B,MAAME,QAAQ;EAE7D,MAAMC,WAAW,MAAM,KAAKC,oCAAoCJ,KAAAA;EAChE,IAAI,KAAK9B,QAAQK,UACb4B,SAAS5B,WAAW,KAAKL,QAAQK;EAGrC,OAAO4B;CACX;CAEA,MAAME,aAAaN,QAA4D;EAC3E,MAAMI,WAAW,MAAM,KAAKL,gBAAgBC,MAAAA;EAI5C,QAAOO,MAFe,KAAKnC,eAAeoC,KAAKJ,QAAAA,EAAAA,CAEhCK;CACnB;CAEA,MAAMC,iBAAiBV,QAAoE;EACvF,IAAI;GAEA,OAAO;IACHY,SAAS;IACTD,MAAAA,MAHe,KAAKL,aAAaN,MAAAA;GAIrC;EACJ,SAASa,GAAG;GACR,OAAO;IACHD,SAAS;IACTE,OAAOD;GACX;EACJ;CACJ;;;;;;;;IAYA,MAAgBE,cAAcC,OAA2BC,SAAyC;EAC9F,IAAIC,SAASD;EAEb,IAAI,OAAOD,MAAMb,aAAa,UAC1B,IAAI;GACAe,SAAS;IACL,GAAGA;IACH,GAAGtD,oBAAoBoD,MAAMb,QAAQ;GACzC;EACJ,SAASU,GAAG;GAMR,KAAKvC,QAAQ6C,KACT,0BAA0B,KAAK9C,SAASO,GAAG,gCAAgC,EAAawC,SAAS;EAEzG;EAGJ,IAAI,KAAK/C,SAASe,aAGd,IAAI;GACA,MAAMiC,WAAW,MAAM,KAAKC,YAAY,KAAKpD,OAAOmD,SAASE,IAAI;IAC7DC,MAAM;IACNvB,OAAOe,MAAMS;GACjB,CAAA,CAAA;GAOA,IACI,OAAOJ,SAASK,QAAQ,YACxB,OAAOT,QAAQS,QAAQ,YACvBL,SAASK,QAAQT,QAAQS,KAEzB,KAAKpD,QAAQ6C,KACT,0BAA0B,KAAK9C,SAASO,GAAG,qDAAqD;QAGpGsC,SAAS;IAAE,GAAGA;IAAQ,GAAGG;GAAS;EAE1C,SAASR,GAAG;GAER,KAAKvC,QAAQ6C,KACT,0BAA0B,KAAK9C,SAASO,GAAG,6BAA6B,EAAawC,SAAS;EAEtG;EAGJ,OAAOF;CACX;;;;;IAOA,YAAyBS,SAAkC;EACvD,OAAOC,QAAQC,KAAK,CAChBF,SACA,IAAIC,SAAYE,UAAUC,WAAAA;GACtBC,iBACUD,uBAAO,IAAIE,MAAM,wBAAwBjE,iBAAiB,GAAG,CAAA,GACnEA,gBAAAA,CAAAA,CACFkE,MAAK;EACX,CAAA,CACH,CAAA;CACL;CAEA,MAAgB7B,oCAAoCW,OAA+D;EAC/G,MAAMC,UAAUrD,oBAAoBoD,MAAMS,YAAY;EACtD,MAAMP,SAAS,MAAM,KAAKH,cAAcC,OAAOC,OAAAA;EAE/C,OAAO;GAGHrC,IAAIqC,QAAQS;GACZS,qBAAqB;IACjBC,MAAM;KAIFlB,OAAOmB;KACPnB,OAAOoB;KAEPpB,OAAOkB;KACPlB,OAAOQ;IACV;IACDa,OAAO,CACHrB,OAAOqB,KACV;GACL;GACA5B,MAAMM;GACN5C,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/index.mjs

@@ -3,6 +3,7 @@ import "node:url";
 import.meta.url;
 import { IdentityProviderLdapAuthenticator } from "./authentication/protocols/ldap/module.mjs";
 import { IdentityProviderLdapCollectionAuthenticator } from "./authentication/protocols/ldap/collection.mjs";
+import { IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE, IdentityProviderAssuranceError, assertIdentityProviderAssurance, buildIdentityProviderAcrValues, isIdentityProviderAssuranceError } from "./authentication/protocols/oauth2/assurance.mjs";
 import { IdentityProviderOAuth2Authenticator } from "./authentication/protocols/oauth2/module.mjs";
 import { IdentityProviderOpenIDAuthenticator } from "./authentication/protocols/open-id/module.mjs";
 import { IdentityProviderFacebookAuthenticator } from "./authentication/presets/facebook.mjs";
@@ -23,4 +24,4 @@ import { IdentityProviderAccountManager } from "./account/module.mjs";
 import "./account/index.mjs";
 import { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN } from "./authentication/constants.mjs";
 import "./authentication/index.mjs";
-export { IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IDENTITY_PROVIDER_ACCOUNT_LINK_TTL, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityProviderAccountAlreadyLinkedError, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, createIdentityProviderOAuth2Authenticator, isIdentityProviderAccountAlreadyLinkedError };
+export { IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IDENTITY_PROVIDER_ACCOUNT_LINK_TTL, IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityProviderAccountAlreadyLinkedError, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAssuranceError, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, assertIdentityProviderAssurance, buildIdentityProviderAcrValues, createIdentityProviderOAuth2Authenticator, isIdentityProviderAccountAlreadyLinkedError, isIdentityProviderAssuranceError };

package/dist/core/identity/registration/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAEtD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;gBAE3B,GAAG,EAAE,0BAA0B;IASrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoEnG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAyBzD"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAEtD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;gBAE3B,GAAG,EAAE,0BAA0B;IASrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoEnG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CA6BzD"}

package/dist/core/identity/registration/service.mjs

@@ -85,7 +85,8 @@ var RegistrationService = class {
 		if (!entity) throw new EntityNotFoundError();
 		const merged = this.repository.merge(entity, {
 			active: true,
-			activateHash: null
+			activateHash: null,
+			emailVerified: true
 		});
 		await this.repository.save(merged);
 		await this.eventService?.record({

package/dist/core/identity/registration/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["EventName","EventRefType","EventScope","IdentityType","UserValidator","createNanoID","EntityNotFoundError","ValidationError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","MailTemplateName","RegistrationService","options","mailClient","mailTemplateRenderer","repository","realmRepository","eventService","ctx","register","data","context","registrationEnabled","validator","mount","pathsToInclude","passwordMinLength","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activateHash","toString","entity","create","credentialsService","password","protect","realm","resolve","realmId","id","save","activateUrl","publicUrl","replace","undefined","mail","render","template","REGISTRATION_ACTIVATION","params","code","url","locale","send","to","email","remove","record","scope","IDENTITY","name","REGISTER","refType","USER","refId","actorType","actorId","actorName","activate","findOneBy","token","merged","merge","ACCOUNT_ACTIVATED"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    UserValidator,\n} from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected eventService?: IEventService;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.eventService = ctx.eventService;\n    }\n\n    async register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({\n            pathsToInclude: ['email', 'name', 'password', 'realmId'],\n            passwordMinLength: this.options.passwordMinLength,\n        }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activateHash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realmId, true);\n        entity.realmId = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                const activateUrl = this.options.publicUrl ?\n                    `${this.options.publicUrl.replace(/\\/+$/, '')}/activate?token=${entity.activateHash}` :\n                    undefined;\n\n                const mail = await this.mailTemplateRenderer.render({\n                    template: MailTemplateName.REGISTRATION_ACTIVATION,\n                    params: { code: entity.activateHash!, url: activateUrl },\n                    locale: context?.locale,\n                });\n\n                await this.mailClient.send({\n                    to: entity.email,\n                    ...mail,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new ValidationError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.REGISTER,\n            refType: EventRefType.USER,\n            refId: entity.id,\n            actorType: IdentityType.USER,\n            actorId: entity.id,\n            actorName: entity.name,\n            realmId: entity.realmId,\n        });\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activateHash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activateHash: null,\n        });\n\n        await this.repository.save(merged);\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.ACCOUNT_ACTIVATED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realmId,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA+BA,IAAaa,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKN,UAAUM,IAAIN;EACnB,KAAKC,aAAaK,IAAIL;EACtB,KAAKC,uBAAuBI,IAAIJ;EAChC,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,SAASC,MAA2BC,SAAgE;EACtG,IAAI,CAAC,KAAKT,QAAQU,qBACd,MAAM,IAAIhB,0BAAAA;EAGd,MAAMiB,YAAY,IAAIf,UAAU,CAAC,CAAA;EACjCe,UAAUC,MAAM,IAAItB,cAAc;GAC9BuB,gBAAgB;IAAC;IAAS;IAAQ;IAAY;GAAU;GACxDC,mBAAmB,KAAKd,QAAQc;EACpC,CAAA,CAAA;EACA,MAAMC,YAAY,MAAMJ,UAAUK,IAAIR,MAAM,EAAES,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKd,WAAWe,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKf,QAAQmB,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,eAAe1B,YAAY,EAAA,CAAA,CAAI2B,SAAS,KAAA;EACtD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKpB,WAAWqB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAI5B,uBAAAA;EAC/B0B,OAAOG,WAAWH,OAAOG,YAAYnC,aAAa,EAAA;EAClDgC,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,WAAUF,MADG,KAAKxB,gBAAgByB,QAAQN,OAAOO,SAAS,IAAA,EAAA,CAC1CC;EAEvB,MAAM,KAAK5B,WAAW6B,KAAKT,MAAAA;EAE3B,IAAI,KAAKvB,QAAQmB,0BACb,IAAI;GACA,MAAMc,cAAc,KAAKjC,QAAQkC,YAC7B,GAAG,KAAKlC,QAAQkC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,kBAAkBZ,OAAOF,iBACvEe,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKnC,qBAAqBoC,OAAO;IAChDC,UAAUzC,iBAAiB0C;IAC3BC,QAAQ;KAAEC,MAAMnB,OAAOF;KAAesB,KAAKV;IAAY;IACvDW,QAAQnC,SAASmC;GACrB,CAAA;GAEA,MAAM,KAAK3C,WAAW4C,KAAK;IACvBC,IAAIvB,OAAOwB;IACX,GAAGV;GACP,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKlC,WAAW6C,OAAOzB,MAAAA;GAC7B,MAAM,IAAI9B,gBAAgB,uDAAA;EAC9B;EAGJ,MAAM,KAAKY,cAAc4C,OAAO;GAC5BC,OAAO9D,WAAW+D;GAClBC,MAAMlE,UAAUmE;GAChBC,SAASnE,aAAaoE;GACtBC,OAAOjC,OAAOQ;GACd0B,WAAWpE,aAAakE;GACxBG,SAASnC,OAAOQ;GAChB4B,WAAWpC,OAAO6B;GAClBtB,SAASP,OAAOO;EACpB,CAAA;EAEA,OAAO,EAAEV,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAMwC,SAASpD,MAAwC;EACnD,MAAMe,SAAS,MAAM,KAAKpB,WAAW0D,UAAU,EAAExC,cAAcb,KAAKsD,MAAM,CAAA;EAE1E,IAAI,CAACvC,QACD,MAAM,IAAI/B,oBAAAA;EAGd,MAAMuE,SAAS,KAAK5D,WAAW6D,MAAMzC,QAAQ;GACzCH,QAAQ;GACRC,cAAc;EAClB,CAAA;EAEA,MAAM,KAAKlB,WAAW6B,KAAK+B,MAAAA;EAE3B,MAAM,KAAK1D,cAAc4C,OAAO;GAC5BC,OAAO9D,WAAW+D;GAClBC,MAAMlE,UAAU+E;GAChBX,SAASnE,aAAaoE;GACtBC,OAAOO,OAAOhC;GACd0B,WAAWpE,aAAakE;GACxBG,SAASK,OAAOhC;GAChB4B,WAAWI,OAAOX;GAClBtB,SAASiC,OAAOjC;EACpB,CAAA;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["EventName","EventRefType","EventScope","IdentityType","UserValidator","createNanoID","EntityNotFoundError","ValidationError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","MailTemplateName","RegistrationService","options","mailClient","mailTemplateRenderer","repository","realmRepository","eventService","ctx","register","data","context","registrationEnabled","validator","mount","pathsToInclude","passwordMinLength","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activateHash","toString","entity","create","credentialsService","password","protect","realm","resolve","realmId","id","save","activateUrl","publicUrl","replace","undefined","mail","render","template","REGISTRATION_ACTIVATION","params","code","url","locale","send","to","email","remove","record","scope","IDENTITY","name","REGISTER","refType","USER","refId","actorType","actorId","actorName","activate","findOneBy","token","merged","merge","emailVerified","ACCOUNT_ACTIVATED"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    UserValidator,\n} from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected eventService?: IEventService;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.eventService = ctx.eventService;\n    }\n\n    async register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({\n            pathsToInclude: ['email', 'name', 'password', 'realmId'],\n            passwordMinLength: this.options.passwordMinLength,\n        }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activateHash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realmId, true);\n        entity.realmId = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                const activateUrl = this.options.publicUrl ?\n                    `${this.options.publicUrl.replace(/\\/+$/, '')}/activate?token=${entity.activateHash}` :\n                    undefined;\n\n                const mail = await this.mailTemplateRenderer.render({\n                    template: MailTemplateName.REGISTRATION_ACTIVATION,\n                    params: { code: entity.activateHash!, url: activateUrl },\n                    locale: context?.locale,\n                });\n\n                await this.mailClient.send({\n                    to: entity.email,\n                    ...mail,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new ValidationError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.REGISTER,\n            refType: EventRefType.USER,\n            refId: entity.id,\n            actorType: IdentityType.USER,\n            actorId: entity.id,\n            actorName: entity.name,\n            realmId: entity.realmId,\n        });\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activateHash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Following the mailed code IS the proof of control over the address,\n        // and it is the only place authup obtains one — which is why the claim\n        // is stamped here rather than derived from `active` (#3519).\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activateHash: null,\n            emailVerified: true,\n        });\n\n        await this.repository.save(merged);\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.ACCOUNT_ACTIVATED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realmId,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA+BA,IAAaa,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKN,UAAUM,IAAIN;EACnB,KAAKC,aAAaK,IAAIL;EACtB,KAAKC,uBAAuBI,IAAIJ;EAChC,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,SAASC,MAA2BC,SAAgE;EACtG,IAAI,CAAC,KAAKT,QAAQU,qBACd,MAAM,IAAIhB,0BAAAA;EAGd,MAAMiB,YAAY,IAAIf,UAAU,CAAC,CAAA;EACjCe,UAAUC,MAAM,IAAItB,cAAc;GAC9BuB,gBAAgB;IAAC;IAAS;IAAQ;IAAY;GAAU;GACxDC,mBAAmB,KAAKd,QAAQc;EACpC,CAAA,CAAA;EACA,MAAMC,YAAY,MAAMJ,UAAUK,IAAIR,MAAM,EAAES,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKd,WAAWe,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKf,QAAQmB,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,eAAe1B,YAAY,EAAA,CAAA,CAAI2B,SAAS,KAAA;EACtD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKpB,WAAWqB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAI5B,uBAAAA;EAC/B0B,OAAOG,WAAWH,OAAOG,YAAYnC,aAAa,EAAA;EAClDgC,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,WAAUF,MADG,KAAKxB,gBAAgByB,QAAQN,OAAOO,SAAS,IAAA,EAAA,CAC1CC;EAEvB,MAAM,KAAK5B,WAAW6B,KAAKT,MAAAA;EAE3B,IAAI,KAAKvB,QAAQmB,0BACb,IAAI;GACA,MAAMc,cAAc,KAAKjC,QAAQkC,YAC7B,GAAG,KAAKlC,QAAQkC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,kBAAkBZ,OAAOF,iBACvEe,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKnC,qBAAqBoC,OAAO;IAChDC,UAAUzC,iBAAiB0C;IAC3BC,QAAQ;KAAEC,MAAMnB,OAAOF;KAAesB,KAAKV;IAAY;IACvDW,QAAQnC,SAASmC;GACrB,CAAA;GAEA,MAAM,KAAK3C,WAAW4C,KAAK;IACvBC,IAAIvB,OAAOwB;IACX,GAAGV;GACP,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKlC,WAAW6C,OAAOzB,MAAAA;GAC7B,MAAM,IAAI9B,gBAAgB,uDAAA;EAC9B;EAGJ,MAAM,KAAKY,cAAc4C,OAAO;GAC5BC,OAAO9D,WAAW+D;GAClBC,MAAMlE,UAAUmE;GAChBC,SAASnE,aAAaoE;GACtBC,OAAOjC,OAAOQ;GACd0B,WAAWpE,aAAakE;GACxBG,SAASnC,OAAOQ;GAChB4B,WAAWpC,OAAO6B;GAClBtB,SAASP,OAAOO;EACpB,CAAA;EAEA,OAAO,EAAEV,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAMwC,SAASpD,MAAwC;EACnD,MAAMe,SAAS,MAAM,KAAKpB,WAAW0D,UAAU,EAAExC,cAAcb,KAAKsD,MAAM,CAAA;EAE1E,IAAI,CAACvC,QACD,MAAM,IAAI/B,oBAAAA;EAMd,MAAMuE,SAAS,KAAK5D,WAAW6D,MAAMzC,QAAQ;GACzCH,QAAQ;GACRC,cAAc;GACd4C,eAAe;EACnB,CAAA;EAEA,MAAM,KAAK9D,WAAW6B,KAAK+B,MAAAA;EAE3B,MAAM,KAAK1D,cAAc4C,OAAO;GAC5BC,OAAO9D,WAAW+D;GAClBC,MAAMlE,UAAUgF;GAChBZ,SAASnE,aAAaoE;GACtBC,OAAOO,OAAOhC;GACd0B,WAAWpE,aAAakE;GACxBG,SAASK,OAAOhC;GAChB4B,WAAWI,OAAOX;GAClBtB,SAASiC,OAAOjC;EACpB,CAAA;CACJ;AACJ"}

package/dist/core/index.mjs

@@ -10,6 +10,7 @@ import { UserAuthenticator } from "./authentication/entities/user/module.mjs";
 import { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EVENT_RETENTION_SWEEP_BATCH_SIZE } from "./entities/event/constants.mjs";
 import { LoginThrottleService } from "./authentication/login-throttle/service.mjs";
 import { CredentialsAuthenticator } from "./authentication/module.mjs";
+import { SESSION_EXPIRY_SWEEP_BATCH_SIZE } from "./authentication/session/constants.mjs";
 import { SessionManager } from "./authentication/session/module.mjs";
 import { SESSION_FILTER_KEYS } from "./authentication/session/types.mjs";
 import "./authentication/index.mjs";
@@ -102,7 +103,7 @@ import { PermissionBindingPolicyEvaluator } from "./security/policy/evaluator.mj
 import { PolicyEngine } from "./security/policy/engine.mjs";
 import { OAuth2AccessPolicyEvaluator } from "./oauth2/access-policy/module.mjs";
 import { OAuth2AuthorizationCodeIssuer } from "./oauth2/authorization/code/issuer/module.mjs";
-import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier } from "./oauth2/authorization/helpers.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createOAuth2PKCE, deriveAmrAcr, generateOAuth2CodeVerifier } from "./oauth2/authorization/helpers.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./oauth2/authorization/code/verifier/module.mjs";
 import { OAuth2ClientAuthenticator } from "./oauth2/client/authenticator.mjs";
 import { assertClientGrantAllowed } from "./oauth2/client/grant-type.mjs";
@@ -111,10 +112,17 @@ import { OAuth2AuthorizationCodeRequestValidator } from "./oauth2/authorization/
 import { OAuth2AuthorizationStateManager } from "./oauth2/authorization/state/module.mjs";
 import { toIdentityPolicyData } from "./identity/permission/identity-policy-data.mjs";
 import { OAuth2Authorization } from "./oauth2/authorization/module.mjs";
+import { OAUTH2_BACKCHANNEL_LOGOUT_EVENT, OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE, OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT } from "./oauth2/backchannel-logout/constants.mjs";
+import { OAuth2BackchannelLogoutNotifier } from "./oauth2/backchannel-logout/module.mjs";
+import { CONSOLE_LOGIN_COOKIE, CONSOLE_LOGIN_TTL } from "./oauth2/console-login/constants.mjs";
+import { SESSION_COOKIE, SESSION_REFRESH_THROTTLE, SESSION_SECRET_LENGTH } from "./oauth2/session-credential/constants.mjs";
+import { createSessionSecret, hashSessionSecret } from "./oauth2/session-credential/module.mjs";
 import { OAuth2EndSessionService } from "./oauth2/end-session/service.mjs";
 import { OAuth2EndSessionRequestValidator } from "./oauth2/end-session/validator.mjs";
+import { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL } from "./oauth2/federated-login/constants.mjs";
 import { IdentityProviderLdapAuthenticator } from "./identity/provider/authentication/protocols/ldap/module.mjs";
 import { IdentityProviderLdapCollectionAuthenticator } from "./identity/provider/authentication/protocols/ldap/collection.mjs";
+import { IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE, IdentityProviderAssuranceError, assertIdentityProviderAssurance, buildIdentityProviderAcrValues, isIdentityProviderAssuranceError } from "./identity/provider/authentication/protocols/oauth2/assurance.mjs";
 import { IdentityProviderOAuth2Authenticator } from "./identity/provider/authentication/protocols/oauth2/module.mjs";
 import { IdentityProviderOpenIDAuthenticator } from "./identity/provider/authentication/protocols/open-id/module.mjs";
 import { IdentityProviderFacebookAuthenticator } from "./identity/provider/authentication/presets/facebook.mjs";
@@ -123,17 +131,19 @@ import { IdentityProviderGoogleAuthenticator } from "./identity/provider/authent
 import { IdentityProviderInstagramAuthenticator } from "./identity/provider/authentication/presets/instagram.mjs";
 import { IdentityProviderPaypalAuthenticator } from "./identity/provider/authentication/presets/paypal.mjs";
 import { createIdentityProviderOAuth2Authenticator } from "./identity/provider/authentication/factory.mjs";
+import { buildOAuth2BearerTokenResponse } from "./oauth2/response/bearer.mjs";
 import { OAuth2FederatedLoginRefusal } from "./oauth2/federated-login/types.mjs";
 import { OAuth2FederatedLoginService } from "./oauth2/federated-login/module.mjs";
-import { buildOAuth2BearerTokenResponse } from "./oauth2/response/bearer.mjs";
 import { OAuth2AuthorizeGrant } from "./oauth2/grant-types/authorize.mjs";
 import { ClientCredentialsGrant } from "./oauth2/grant-types/client-credentials.mjs";
 import { IdentityGrantType } from "./oauth2/grant-types/identity.mjs";
 import { PasswordGrantType } from "./oauth2/grant-types/password.mjs";
+import { SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE } from "./oauth2/session-token/constants.mjs";
 import { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError } from "./oauth2/session-token/error.mjs";
 import { OAuth2RefreshTokenGrant } from "./oauth2/grant-types/refresh-token.mjs";
-import { OAuth2MfaLoginService } from "./oauth2/mfa-login/module.mjs";
 import { OAuth2OpenIDClaimsBuilder } from "./oauth2/openid/claims.mjs";
+import { resolveIntrospectionSubject } from "./oauth2/introspection/module.mjs";
+import { OAuth2MfaLoginService } from "./oauth2/mfa-login/module.mjs";
 import { OAuth2ScopeAttributesResolver } from "./oauth2/scope/resolver.mjs";
 import { OAuth2AccessTokenIssuer } from "./oauth2/token/issuer/access/module.mjs";
 import { OAuth2MfaTokenIssuer } from "./oauth2/token/issuer/mfa/module.mjs";
@@ -190,4 +200,4 @@ import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/m
 import { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry } from "./provisioning/wildcard/module.mjs";
 import "./provisioning/index.mjs";
 import "./security/index.mjs";
-export { BaseCredentialsAuthenticator, CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EVENT_RETENTION_SWEEP_BATCH_SIZE, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, IDENTITY_PROVIDER_ACCOUNT_LINK_TTL, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountAlreadyLinkedError, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAccountService, IdentityProviderAccountUnlinkBlockedError, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2FederatedLoginRefusal, OAuth2FederatedLoginService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, REALM_WILDCARD_NAME, RECORD_QUERY_PARAMETERS, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RealmWildcardProvisioningValidator, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, SESSION_TOKEN_FILTER_KEYS, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, SessionTokenRelationMissingError, SessionTokenService, SystemClientProvisioner, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WildcardRealmProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildProvisioningEntityKey, buildSystemClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, createRelationsReadGate, decodeQuery, defineMailTemplate, deriveAmrAcr, describeQuerySchema, eventSchema, expandWildcardRealmEntry, extractWildcardRealmEntry, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderAccountSchema, identityProviderRoleMappingSchema, identityProviderSchema, isIdentityProviderAccountAlreadyLinkedError, isIdentityProviderAccountUnlinkBlockedError, isRealmCipherBlobError, isSessionTokenRelationMissingError, isWrappedKeyMaterial, keySchema, mergeProvisioningEntities, mergeProvisioningEntity, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, schemas, scopeSchema, sessionSchema, sessionTokenSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };
+export { BaseCredentialsAuthenticator, CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, CONSOLE_LOGIN_COOKIE, CONSOLE_LOGIN_TTL, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EVENT_RETENTION_SWEEP_BATCH_SIZE, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, IDENTITY_PROVIDER_ACCOUNT_LINK_TTL, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountAlreadyLinkedError, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAccountService, IdentityProviderAccountUnlinkBlockedError, IdentityProviderAssuranceError, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAUTH2_BACKCHANNEL_LOGOUT_EVENT, OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE, OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT, OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2BackchannelLogoutNotifier, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2FederatedLoginRefusal, OAuth2FederatedLoginService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, REALM_WILDCARD_NAME, RECORD_QUERY_PARAMETERS, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RealmWildcardProvisioningValidator, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_COOKIE, SESSION_EXPIRY_SWEEP_BATCH_SIZE, SESSION_FILTER_KEYS, SESSION_REFRESH_THROTTLE, SESSION_SECRET_LENGTH, SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE, SESSION_TOKEN_FILTER_KEYS, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, SessionTokenRelationMissingError, SessionTokenService, SystemClientProvisioner, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WildcardRealmProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, assertIdentityProviderAssurance, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildIdentityProviderAcrValues, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildProvisioningEntityKey, buildSystemClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createOAuth2PKCE, createProvisioningEntitiesValidator, createRelationsReadGate, createSessionSecret, decodeQuery, defineMailTemplate, deriveAmrAcr, describeQuerySchema, eventSchema, expandWildcardRealmEntry, extractWildcardRealmEntry, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, hashSessionSecret, identityProviderAccountSchema, identityProviderRoleMappingSchema, identityProviderSchema, isIdentityProviderAccountAlreadyLinkedError, isIdentityProviderAccountUnlinkBlockedError, isIdentityProviderAssuranceError, isRealmCipherBlobError, isSessionTokenRelationMissingError, isWrappedKeyMaterial, keySchema, mergeProvisioningEntities, mergeProvisioningEntity, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, resolveIntrospectionSubject, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, schemas, scopeSchema, sessionSchema, sessionTokenSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };

package/dist/core/oauth2/authorization/helpers.d.ts

@@ -11,5 +11,19 @@ export declare function deriveAmrAcr(session: Pick<Session, 'authMethod' | 'mfaA
 export declare function generateOAuth2CodeVerifier(): string;
 export declare function base64URLEncode(arrayBuffer: ArrayBuffer): string;
 export declare function buildOAuth2TokenHash(value: string, alg?: `${JWTAlgorithm}` | null): Promise<string>;
+/**
+ * A PKCE pair for a server-side authorization request (plan 088: the console
+ * login kick mints one, keeps the verifier in the pending login and sends the
+ * challenge to `/authorize`).
+ *
+ * Snake_case because these are wire parameters, not domain properties, and it
+ * mirrors the kit's browser-side `createPKCE()` so the two paths read alike.
+ */
+export type OAuth2PKCE = {
+    code_verifier: string;
+    code_challenge: string;
+    code_challenge_method: 'S256';
+};
+export declare function createOAuth2PKCE(): Promise<OAuth2PKCE>;
 export declare function buildOAuth2CodeChallenge(codeVerifier: string): Promise<string>;
 //# sourceMappingURL=helpers.d.ts.map

package/dist/core/oauth2/authorization/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAMtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIhD;;;;;;GAMG;AACH,wBAAgB,YAAY,CACxB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG,IAAI,GACtD,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,KAAK,CAAC,CAiCzC;AAED,wBAAgB,0BAA0B,WAazC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,UAWvD;AAWD,wBAAsB,oBAAoB,CACtC,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,GAC9B,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAMtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIhD;;;;;;GAMG;AACH,wBAAgB,YAAY,CACxB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG,IAAI,GACtD,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,KAAK,CAAC,CA0CzC;AAED,wBAAgB,0BAA0B,WAazC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,UAWvD;AAWD,wBAAsB,oBAAoB,CACtC,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,GAC9B,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,wBAAsB,gBAAgB,IAAK,OAAO,CAAC,UAAU,CAAC,CAQ7D;AAED,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}

package/dist/core/oauth2/authorization/helpers.mjs

@@ -25,9 +25,14 @@ import { subtle } from "uncrypto";
 		default: return {};
 	}
 	if (session.mfaAt) amr.push(OAuth2AuthenticationMethodReference.OTP);
+	if (session.mfaAt) return {
+		amr,
+		acr: OAuth2AuthenticationContextClass.MFA
+	};
+	if (session.authMethod === SessionAuthMethod.EXTERNAL) return { amr };
 	return {
 		amr,
-		acr: session.mfaAt ? OAuth2AuthenticationContextClass.MFA : OAuth2AuthenticationContextClass.PASSWORD
+		acr: OAuth2AuthenticationContextClass.PASSWORD
 	};
 }
 function generateOAuth2CodeVerifier() {
@@ -63,11 +68,19 @@ async function buildOAuth2TokenHash(value, alg) {
 	const data = new TextEncoder().encode(value);
 	return base64URLEncode((await subtle.digest(digest.name, data)).slice(0, digest.halfLength));
 }
+async function createOAuth2PKCE() {
+	const codeVerifier = generateOAuth2CodeVerifier();
+	return {
+		code_verifier: codeVerifier,
+		code_challenge: await buildOAuth2CodeChallenge(codeVerifier),
+		code_challenge_method: "S256"
+	};
+}
 async function buildOAuth2CodeChallenge(codeVerifier) {
 	const data = new TextEncoder().encode(codeVerifier);
 	return base64URLEncode(await subtle.digest("SHA-256", data));
 }
 //#endregion
-export { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier };
+export { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createOAuth2PKCE, deriveAmrAcr, generateOAuth2CodeVerifier };
 
 //# sourceMappingURL=helpers.mjs.map

package/dist/core/oauth2/authorization/helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.mjs","names":["JWTError","OAuth2AuthenticationContextClass","OAuth2AuthenticationMethodReference","SessionAuthMethod","subtle","deriveAmrAcr","session","authMethod","amr","PASSWORD","LDAP","push","EXTERNAL","mfaAt","OTP","acr","MFA","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","TOKEN_HASH_DIGESTS","name","halfLength","buildOAuth2TokenHash","value","alg","digest","slice","headerPropertyInvalid","encoder","TextEncoder","data","encode","hashBuffer","halfHash","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { JWTAlgorithm, OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWTError,\n    OAuth2AuthenticationContextClass,\n    OAuth2AuthenticationMethodReference,\n} from '@authup/specs';\nimport type { Session } from '@authup/core-kit';\nimport { SessionAuthMethod } from '@authup/core-kit';\nimport { subtle } from 'uncrypto';\n\n/**\n * Derive the OIDC `amr` / `acr` claims from the backing session's\n * authMethod + mfaAt (plan 050). Pre-column sessions (null authMethod)\n * yield no claims — authup cannot retroactively know how an old session\n * authenticated. M2M methods yield none either (amr/acr are user-flow\n * claims; those grants mint no id_token).\n */\nexport function deriveAmrAcr(\n    session: Pick<Session, 'authMethod' | 'mfaAt'> | null,\n): Pick<OAuth2TokenPayload, 'amr' | 'acr'> {\n    if (!session || !session.authMethod) {\n        return {};\n    }\n\n    const amr : string[] = [];\n    switch (session.authMethod) {\n        case SessionAuthMethod.PASSWORD:\n        case SessionAuthMethod.LDAP: {\n            // LDAP is still a password factor for amr — the finer\n            // distinction lives in the authup-local authMethod.\n            amr.push(OAuth2AuthenticationMethodReference.PASSWORD);\n            break;\n        }\n        case SessionAuthMethod.EXTERNAL: {\n            amr.push(OAuth2AuthenticationMethodReference.EXTERNAL);\n            break;\n        }\n        default: {\n            return {};\n        }\n    }\n\n    if (session.mfaAt) {\n        amr.push(OAuth2AuthenticationMethodReference.OTP);\n    }\n\n    return {\n        amr,\n        acr: session.mfaAt ?\n            OAuth2AuthenticationContextClass.MFA :\n            OAuth2AuthenticationContextClass.PASSWORD,\n    };\n}\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\n// OIDC Core §3.1.3.6: at_hash / c_hash use the hash algorithm of the id_token's\n// JWS alg (…S256 → SHA-256, …S384 → SHA-384, …S512 → SHA-512) and keep the LEFT\n// HALF of the digest — so the half-length follows the digest (16/24/32 bytes).\nconst TOKEN_HASH_DIGESTS : Record<string, { name: string, halfLength: number }> = {\n    256: { name: 'SHA-256', halfLength: 16 },\n    384: { name: 'SHA-384', halfLength: 24 },\n    512: { name: 'SHA-512', halfLength: 32 },\n};\n\nexport async function buildOAuth2TokenHash(\n    value: string,\n    alg?: `${JWTAlgorithm}` | null,\n) : Promise<string> {\n    // A key row without a persisted alg (nullable legacy column) signs with\n    // the signer's *256 default (RS256/ES256/HS256) — derive the matching\n    // SHA-256 digest. An unrecognized alg still fails loud — silently\n    // defaulting there would mint a hash no conforming verifier accepts.\n    const digest = alg ?\n        TOKEN_HASH_DIGESTS[alg.slice(-3)] :\n        TOKEN_HASH_DIGESTS['256'];\n    if (!digest) {\n        throw JWTError.headerPropertyInvalid('alg');\n    }\n\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest(digest.name, data);\n    const halfHash = hashBuffer.slice(0, digest.halfLength);\n\n    return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;;;;;;;;;GAwBA,SAAgBK,aACZC,SAAqD;CAErD,IAAI,CAACA,WAAW,CAACA,QAAQC,YACrB,OAAO,CAAC;CAGZ,MAAMC,MAAiB,CAAA;CACvB,QAAQF,QAAQC,YAAhB;EACI,KAAKJ,kBAAkBM;EACvB,KAAKN,kBAAkBO;GAGnBF,IAAIG,KAAKT,oCAAoCO,QAAQ;GACrD;EAEJ,KAAKN,kBAAkBS;GACnBJ,IAAIG,KAAKT,oCAAoCU,QAAQ;GACrD;EAEJ,SACI,OAAO,CAAC;CAEhB;CAEA,IAAIN,QAAQO,OACRL,IAAIG,KAAKT,oCAAoCY,GAAG;CAGpD,OAAO;EACHN;EACAO,KAAKT,QAAQO,QACTZ,iCAAiCe,MACjCf,iCAAiCQ;CACzC;AACJ;AAEA,SAAgBQ,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAKA,MAAMC,qBAA4E;CAC9E,KAAK;EAAEC,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;AAC3C;AAEA,eAAsBC,qBAClBC,OACAC,KAA8B;CAM9B,MAAMC,SAASD,MACXL,mBAAmBK,IAAIE,MAAM,EAAC,KAC9BP,mBAAmB;CACvB,IAAI,CAACM,QACD,MAAM1C,SAAS4C,sBAAsB,KAAA;CAIzC,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOR,KAAAA;CAI5B,OAAOd,iBAFUuB,MADQ7C,OAAOsC,OAAOA,OAAOL,MAAMU,IAAAA,EAAAA,CACxBJ,MAAM,GAAGD,OAAOJ,UAErBY,CAAAA;AAC3B;AAEA,eAAsBC,yBAAyB/B,cAAoB;CAE/D,MAAM2B,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAO5B,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGvB,OAAOsC,OAAO,WAAWK,IAAAA,CAE5BpB;AAC3B"}
+{"version":3,"file":"helpers.mjs","names":["JWTError","OAuth2AuthenticationContextClass","OAuth2AuthenticationMethodReference","SessionAuthMethod","subtle","deriveAmrAcr","session","authMethod","amr","PASSWORD","LDAP","push","EXTERNAL","mfaAt","OTP","acr","MFA","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","TOKEN_HASH_DIGESTS","name","halfLength","buildOAuth2TokenHash","value","alg","digest","slice","headerPropertyInvalid","encoder","TextEncoder","data","encode","hashBuffer","halfHash","createOAuth2PKCE","code_verifier","code_challenge","buildOAuth2CodeChallenge","code_challenge_method"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { JWTAlgorithm, OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWTError,\n    OAuth2AuthenticationContextClass,\n    OAuth2AuthenticationMethodReference,\n} from '@authup/specs';\nimport type { Session } from '@authup/core-kit';\nimport { SessionAuthMethod } from '@authup/core-kit';\nimport { subtle } from 'uncrypto';\n\n/**\n * Derive the OIDC `amr` / `acr` claims from the backing session's\n * authMethod + mfaAt (plan 050). Pre-column sessions (null authMethod)\n * yield no claims — authup cannot retroactively know how an old session\n * authenticated. M2M methods yield none either (amr/acr are user-flow\n * claims; those grants mint no id_token).\n */\nexport function deriveAmrAcr(\n    session: Pick<Session, 'authMethod' | 'mfaAt'> | null,\n): Pick<OAuth2TokenPayload, 'amr' | 'acr'> {\n    if (!session || !session.authMethod) {\n        return {};\n    }\n\n    const amr : string[] = [];\n    switch (session.authMethod) {\n        case SessionAuthMethod.PASSWORD:\n        case SessionAuthMethod.LDAP: {\n            // LDAP is still a password factor for amr — the finer\n            // distinction lives in the authup-local authMethod.\n            amr.push(OAuth2AuthenticationMethodReference.PASSWORD);\n            break;\n        }\n        case SessionAuthMethod.EXTERNAL: {\n            amr.push(OAuth2AuthenticationMethodReference.EXTERNAL);\n            break;\n        }\n        default: {\n            return {};\n        }\n    }\n\n    if (session.mfaAt) {\n        amr.push(OAuth2AuthenticationMethodReference.OTP);\n    }\n\n    if (session.mfaAt) {\n        return { amr, acr: OAuth2AuthenticationContextClass.MFA };\n    }\n\n    // No `acr` for a session an external provider authenticated: authup\n    // verified no credential of its own, so it asserts no assurance level.\n    // `urn:authup:pwd` would say the subject authenticated with a password,\n    // which is exactly what did NOT happen (issue #3478). Per OIDC Core\n    // §2 the claim is voluntary, so the absence is the honest answer, and\n    // `amr: ['ext']` still says how the login happened.\n    if (session.authMethod === SessionAuthMethod.EXTERNAL) {\n        return { amr };\n    }\n\n    return { amr, acr: OAuth2AuthenticationContextClass.PASSWORD };\n}\n\nexport function generateOAuth2CodeVerifier() {\n    const length = 64;\n    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n    let codeVerifier = '';\n    const randomValues = new Uint8Array(length);\n    crypto.getRandomValues(randomValues);\n\n    for (let i = 0; i < length; i++) {\n        codeVerifier += charset[randomValues[i] % charset.length];\n    }\n\n    return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n    // Convert the ArrayBuffer to string using Uint8 array.\n    // btoa takes chars from 0-255 and base64 encodes.\n    // Then convert the base64 encoded to base64url encoded.\n    // (replace + with -, replace / with _, trim trailing =)\n    const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n    return btoa(String.fromCharCode.apply(null, charCode))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\n// OIDC Core §3.1.3.6: at_hash / c_hash use the hash algorithm of the id_token's\n// JWS alg (…S256 → SHA-256, …S384 → SHA-384, …S512 → SHA-512) and keep the LEFT\n// HALF of the digest — so the half-length follows the digest (16/24/32 bytes).\nconst TOKEN_HASH_DIGESTS : Record<string, { name: string, halfLength: number }> = {\n    256: { name: 'SHA-256', halfLength: 16 },\n    384: { name: 'SHA-384', halfLength: 24 },\n    512: { name: 'SHA-512', halfLength: 32 },\n};\n\nexport async function buildOAuth2TokenHash(\n    value: string,\n    alg?: `${JWTAlgorithm}` | null,\n) : Promise<string> {\n    // A key row without a persisted alg (nullable legacy column) signs with\n    // the signer's *256 default (RS256/ES256/HS256) — derive the matching\n    // SHA-256 digest. An unrecognized alg still fails loud — silently\n    // defaulting there would mint a hash no conforming verifier accepts.\n    const digest = alg ?\n        TOKEN_HASH_DIGESTS[alg.slice(-3)] :\n        TOKEN_HASH_DIGESTS['256'];\n    if (!digest) {\n        throw JWTError.headerPropertyInvalid('alg');\n    }\n\n    const encoder = new TextEncoder();\n    const data = encoder.encode(value);\n    const hashBuffer = await subtle.digest(digest.name, data);\n    const halfHash = hashBuffer.slice(0, digest.halfLength);\n\n    return base64URLEncode(halfHash);\n}\n\n/**\n * A PKCE pair for a server-side authorization request (plan 088: the console\n * login kick mints one, keeps the verifier in the pending login and sends the\n * challenge to `/authorize`).\n *\n * Snake_case because these are wire parameters, not domain properties, and it\n * mirrors the kit's browser-side `createPKCE()` so the two paths read alike.\n */\nexport type OAuth2PKCE = {\n    code_verifier: string,\n    code_challenge: string,\n    code_challenge_method: 'S256',\n};\n\nexport async function createOAuth2PKCE() : Promise<OAuth2PKCE> {\n    const codeVerifier = generateOAuth2CodeVerifier();\n\n    return {\n        code_verifier: codeVerifier,\n        code_challenge: await buildOAuth2CodeChallenge(codeVerifier),\n        code_challenge_method: 'S256',\n    };\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const arrayBuffer = await subtle.digest('SHA-256', data);\n\n    return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;;;;;;;;;GAwBA,SAAgBK,aACZC,SAAqD;CAErD,IAAI,CAACA,WAAW,CAACA,QAAQC,YACrB,OAAO,CAAC;CAGZ,MAAMC,MAAiB,CAAA;CACvB,QAAQF,QAAQC,YAAhB;EACI,KAAKJ,kBAAkBM;EACvB,KAAKN,kBAAkBO;GAGnBF,IAAIG,KAAKT,oCAAoCO,QAAQ;GACrD;EAEJ,KAAKN,kBAAkBS;GACnBJ,IAAIG,KAAKT,oCAAoCU,QAAQ;GACrD;EAEJ,SACI,OAAO,CAAC;CAEhB;CAEA,IAAIN,QAAQO,OACRL,IAAIG,KAAKT,oCAAoCY,GAAG;CAGpD,IAAIR,QAAQO,OACR,OAAO;EAAEL;EAAKO,KAAKd,iCAAiCe;CAAI;CAS5D,IAAIV,QAAQC,eAAeJ,kBAAkBS,UACzC,OAAO,EAAEJ,IAAI;CAGjB,OAAO;EAAEA;EAAKO,KAAKd,iCAAiCQ;CAAS;AACjE;AAEA,SAAgBQ,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAKA,MAAMC,qBAA4E;CAC9E,KAAK;EAAEC,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;AAC3C;AAEA,eAAsBC,qBAClBC,OACAC,KAA8B;CAM9B,MAAMC,SAASD,MACXL,mBAAmBK,IAAIE,MAAM,EAAC,KAC9BP,mBAAmB;CACvB,IAAI,CAACM,QACD,MAAM1C,SAAS4C,sBAAsB,KAAA;CAIzC,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOR,KAAAA;CAI5B,OAAOd,iBAFUuB,MADQ7C,OAAOsC,OAAOA,OAAOL,MAAMU,IAAAA,EAAAA,CACxBJ,MAAM,GAAGD,OAAOJ,UAErBY,CAAAA;AAC3B;AAgBA,eAAsBC,mBAAAA;CAClB,MAAM/B,eAAeH,2BAAAA;CAErB,OAAO;EACHmC,eAAehC;EACfiC,gBAAgB,MAAMC,yBAAyBlC,YAAAA;EAC/CmC,uBAAuB;CAC3B;AACJ;AAEA,eAAsBD,yBAAyBlC,cAAoB;CAE/D,MAAM2B,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAO5B,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGvB,OAAOsC,OAAO,WAAWK,IAAAA,CAE5BpB;AAC3B"}

package/dist/core/oauth2/authorization/index.mjs

@@ -2,7 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2AuthorizationCodeIssuer } from "./code/issuer/module.mjs";
-import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier } from "./helpers.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createOAuth2PKCE, deriveAmrAcr, generateOAuth2CodeVerifier } from "./helpers.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./code/verifier/module.mjs";
 import "./code/index.mjs";
 import { OAuth2AuthorizationCodeRequestVerifier } from "./code-request/verifier/module.mjs";
@@ -11,4 +11,4 @@ import "./code-request/index.mjs";
 import { OAuth2AuthorizationStateManager } from "./state/module.mjs";
 import "./state/index.mjs";
 import { OAuth2Authorization } from "./module.mjs";
-export { OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier };
+export { OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createOAuth2PKCE, deriveAmrAcr, generateOAuth2CodeVerifier };

package/dist/core/oauth2/authorization/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,QAAQ,EAER,8BAA8B,EAEjC,MAAM,kBAAkB,CAAC;AAsB1B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,KAAK,EACR,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAS/D,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,iBAAiB,EAAG,MAAM,CAAC;IAErC,SAAS,CAAC,kBAAkB,EAAG,MAAM,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAG,mCAAmC,CAAC;IAEtE,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;gBAEpD,GAAG,EAAE,iCAAiC;IAWlD;;;;;;OAMG;IACG,SAAS,CACX,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;cAmDtB,cAAc,CAC1B,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;CA4KzC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,QAAQ,EAER,8BAA8B,EAEjC,MAAM,kBAAkB,CAAC;AAuB1B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,KAAK,EACR,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAS/D,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,iBAAiB,EAAG,MAAM,CAAC;IAErC,SAAS,CAAC,kBAAkB,EAAG,MAAM,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAG,mCAAmC,CAAC;IAEtE,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;gBAEpD,GAAG,EAAE,iCAAiC;IAWlD;;;;;;OAMG;IACG,SAAS,CACX,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;cAmDtB,cAAc,CAC1B,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;CA+LzC"}