@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/core/oauth2/federated-login/constants.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Lifetime of a pending federated login (plan 094).
+ *
+ * It is completed by the very next page load, so it needs to cover a redirect
+ * and a bootstrap, not a user's attention span. It is also the lifetime of the
+ * session the callback creates, so an abandoned login self-expires and is
+ * swept with the regular session sweep; completion extends it to the full
+ * session lifetime.
+ */
+export declare const OAUTH2_FEDERATED_LOGIN_TTL: number;
+/**
+ * The cookie carrying the pending login between the provider callback and the
+ * hosted page that completes it.
+ *
+ * A cookie rather than a query parameter, which is what Keycloak and Authentik
+ * both do: the browser that STARTED the login is the only one that can present
+ * it, no other origin can set it, and nothing redeemable travels in a URL that
+ * reaches history, logs or a referrer. `SameSite=Lax` keeps it off cross-site
+ * requests, so a page on another origin cannot drive the completion.
+ */
+export declare const OAUTH2_FEDERATED_LOGIN_COOKIE = "authup_federated_login";
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/oauth2/federated-login/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/constants.ts"],"names":[],"mappings":"AAOA;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,QAAgB,CAAC;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,2BAA2B,CAAC"}

package/dist/core/oauth2/federated-login/constants.mjs

@@ -0,0 +1,27 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/oauth2/federated-login/constants.ts
+/**
+* Lifetime of a pending federated login (plan 094).
+*
+* It is completed by the very next page load, so it needs to cover a redirect
+* and a bootstrap, not a user's attention span. It is also the lifetime of the
+* session the callback creates, so an abandoned login self-expires and is
+* swept with the regular session sweep; completion extends it to the full
+* session lifetime.
+*/ const OAUTH2_FEDERATED_LOGIN_TTL = 3e5;
+/**
+* The cookie carrying the pending login between the provider callback and the
+* hosted page that completes it.
+*
+* A cookie rather than a query parameter, which is what Keycloak and Authentik
+* both do: the browser that STARTED the login is the only one that can present
+* it, no other origin can set it, and nothing redeemable travels in a URL that
+* reaches history, logs or a referrer. `SameSite=Lax` keeps it off cross-site
+* requests, so a page on another origin cannot drive the completion.
+*/ const OAUTH2_FEDERATED_LOGIN_COOKIE = "authup_federated_login";
+//#endregion
+export { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/oauth2/federated-login/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["OAUTH2_FEDERATED_LOGIN_TTL","OAUTH2_FEDERATED_LOGIN_COOKIE"],"sources":["../../../../src/core/oauth2/federated-login/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Lifetime of a pending federated login (plan 094).\n *\n * It is completed by the very next page load, so it needs to cover a redirect\n * and a bootstrap, not a user's attention span. It is also the lifetime of the\n * session the callback creates, so an abandoned login self-expires and is\n * swept with the regular session sweep; completion extends it to the full\n * session lifetime.\n */\nexport const OAUTH2_FEDERATED_LOGIN_TTL = 1000 * 60 * 5;\n\n/**\n * The cookie carrying the pending login between the provider callback and the\n * hosted page that completes it.\n *\n * A cookie rather than a query parameter, which is what Keycloak and Authentik\n * both do: the browser that STARTED the login is the only one that can present\n * it, no other origin can set it, and nothing redeemable travels in a URL that\n * reaches history, logs or a referrer. `SameSite=Lax` keeps it off cross-site\n * requests, so a page on another origin cannot drive the completion.\n */\nexport const OAUTH2_FEDERATED_LOGIN_COOKIE = 'authup_federated_login';\n"],"mappings":";;;;;;;;;;;;GAgBA,MAAaA,6BAA6B;;;;;;;;;;GAY1C,MAAaC,gCAAgC"}

package/dist/core/oauth2/federated-login/index.d.ts

@@ -1,3 +1,4 @@
+export * from './constants.ts';
 export * from './module.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/federated-login/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/federated-login/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL } from "./constants.mjs";
 import { OAuth2FederatedLoginRefusal } from "./types.mjs";
 import { OAuth2FederatedLoginService } from "./module.mjs";
-export { OAuth2FederatedLoginRefusal, OAuth2FederatedLoginService };
+export { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL, OAuth2FederatedLoginRefusal, OAuth2FederatedLoginService };

package/dist/core/oauth2/federated-login/module.d.ts

@@ -1,20 +1,29 @@
 import type { Logger } from '@authup/server-kit';
+import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IEventService, IRealmRepository } from '../../entities/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
+import type { ISessionManager } from '../../authentication/index.ts';
 import type { IIdentityProviderAccountManager } from '../../identity/provider/account/types.ts';
 import type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';
-import type { IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier } from '../authorization/index.ts';
-import type { IOAuth2FederatedLoginService, OAuth2FederatedLoginAuthenticatorFactory, OAuth2FederatedLoginCompleteInput, OAuth2FederatedLoginCompleteResult, OAuth2FederatedLoginServiceContext, OAuth2FederatedLoginServiceOptions } from './types.ts';
+import type { IOAuth2AuthorizationCodeRequestVerifier } from '../authorization/index.ts';
+import type { IOAuth2TokenIssuer } from '../token/index.ts';
+import type { IOAuth2FederatedLoginService, IOAuth2FederatedLoginStore, OAuth2FederatedLoginAuthenticatorFactory, OAuth2FederatedLoginCompleteHandoffInput, OAuth2FederatedLoginCompleteInput, OAuth2FederatedLoginCompleteResult, OAuth2FederatedLoginServiceContext, OAuth2FederatedLoginServiceOptions } from './types.ts';
 export declare class OAuth2FederatedLoginService implements IOAuth2FederatedLoginService {
     protected options: OAuth2FederatedLoginServiceOptions;
     protected accountManager: IIdentityProviderAccountManager;
     protected realmRepository: IRealmRepository;
     protected codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
-    protected codeIssuer: IOAuth2AuthorizationCodeIssuer;
+    protected sessionManager: ISessionManager;
+    protected pendingLoginStore: IOAuth2FederatedLoginStore;
+    protected accessTokenIssuer: IOAuth2TokenIssuer;
+    protected refreshTokenIssuer: IOAuth2TokenIssuer;
     protected accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
     protected eventService?: IEventService;
+    protected metrics?: IAuthFlowMetrics;
     protected logger?: Logger;
     protected authenticatorFactory: OAuth2FederatedLoginAuthenticatorFactory;
     constructor(ctx: OAuth2FederatedLoginServiceContext);
     complete(input: OAuth2FederatedLoginCompleteInput): Promise<OAuth2FederatedLoginCompleteResult>;
+    completeHandoff(input: OAuth2FederatedLoginCompleteHandoffInput): Promise<OAuth2TokenGrantResponse>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/federated-login/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/module.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG/E,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAGhG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EACR,8BAA8B,EAC9B,uCAAuC,EAE1C,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EACR,4BAA4B,EAC5B,wCAAwC,EACxC,iCAAiC,EACjC,kCAAkC,EAClC,kCAAkC,EAClC,kCAAkC,EACrC,MAAM,YAAY,CAAC;AAGpB,qBAAa,2BAA4B,YAAW,4BAA4B;IAC5E,SAAS,CAAC,OAAO,EAAG,kCAAkC,CAAC;IAEvD,SAAS,CAAC,cAAc,EAAG,+BAA+B,CAAC;IAE3D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;IAEhE,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAE3B,SAAS,CAAC,oBAAoB,EAAG,wCAAwC,CAAC;gBAE9D,GAAG,EAAE,kCAAkC;IAqB7C,QAAQ,CAAC,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC,kCAAkC,CAAC;CA0LxG"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/module.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAQlF,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGrE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAIhG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EACR,uCAAuC,EAE1C,MAAM,2BAA2B,CAAC;AAGnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,KAAK,EACR,4BAA4B,EAC5B,0BAA0B,EAC1B,wCAAwC,EACxC,wCAAwC,EACxC,iCAAiC,EACjC,kCAAkC,EAClC,kCAAkC,EAClC,kCAAkC,EACrC,MAAM,YAAY,CAAC;AAGpB,qBAAa,2BAA4B,YAAW,4BAA4B;IAC5E,SAAS,CAAC,OAAO,EAAG,kCAAkC,CAAC;IAEvD,SAAS,CAAC,cAAc,EAAG,+BAA+B,CAAC;IAE3D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,iBAAiB,EAAG,0BAA0B,CAAC;IAEzD,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAElD,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;IAEhE,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAE3B,SAAS,CAAC,oBAAoB,EAAG,wCAAwC,CAAC;gBAE9D,GAAG,EAAE,kCAAkC;IAyB7C,QAAQ,CAAC,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC,kCAAkC,CAAC;IA4L/F,eAAe,CAAC,KAAK,EAAE,wCAAwC,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAqF5G"}

package/dist/core/oauth2/federated-login/module.mjs

@@ -1,22 +1,32 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { deriveAmrAcr } from "../authorization/helpers.mjs";
 import { toIdentityPolicyData } from "../../identity/permission/identity-policy-data.mjs";
+import { describeError } from "../../../utils/error.mjs";
+import "../../../utils/index.mjs";
+import { OAUTH2_FEDERATED_LOGIN_TTL } from "./constants.mjs";
+import { isIdentityProviderAssuranceError } from "../../identity/provider/authentication/protocols/oauth2/assurance.mjs";
 import { createIdentityProviderOAuth2Authenticator } from "../../identity/provider/authentication/factory.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
 import { OAuth2FederatedLoginRefusal } from "./types.mjs";
 import { isSafeRedirectURLScheme } from "@authup/kit";
-import { EventName, EventRefType, EventScope, IdentityType, SessionAuthMethod } from "@authup/core-kit";
-import { InternalError } from "@authup/errors";
-import { OAuth2ErrorCode, OAuth2RequestError, isOAuth2Error } from "@authup/specs";
+import { EventName, EventRefType, EventScope, IdentityType, ScopeName, SessionAuthMethod } from "@authup/core-kit";
+import { BadRequestError, InternalError } from "@authup/errors";
+import { OAuth2ErrorCode, OAuth2RequestError, OAuth2SubKind, isOAuth2Error } from "@authup/specs";
 //#region src/core/oauth2/federated-login/module.ts
 var OAuth2FederatedLoginService = class {
 	options;
 	accountManager;
 	realmRepository;
 	codeRequestVerifier;
-	codeIssuer;
+	sessionManager;
+	pendingLoginStore;
+	accessTokenIssuer;
+	refreshTokenIssuer;
 	accessPolicyEvaluator;
 	eventService;
+	metrics;
 	logger;
 	authenticatorFactory;
 	constructor(ctx) {
@@ -24,9 +34,13 @@ var OAuth2FederatedLoginService = class {
 		this.accountManager = ctx.accountManager;
 		this.realmRepository = ctx.realmRepository;
 		this.codeRequestVerifier = ctx.codeRequestVerifier;
-		this.codeIssuer = ctx.codeIssuer;
+		this.sessionManager = ctx.sessionManager;
+		this.pendingLoginStore = ctx.pendingLoginStore;
+		this.accessTokenIssuer = ctx.accessTokenIssuer;
+		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
 		this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;
 		this.eventService = ctx.eventService;
+		this.metrics = ctx.metrics;
 		this.logger = ctx.logger;
 		this.authenticatorFactory = ctx.authenticatorFactory ?? ((provider, options) => createIdentityProviderOAuth2Authenticator({
 			accountManager: this.accountManager,
@@ -53,7 +67,7 @@ var OAuth2FederatedLoginService = class {
 		}
 		if (provider.realmId && verified.client.realmId !== provider.realmId) throw OAuth2RequestError.malformed("The provider and client realm do not match.");
 		const redirectUri = verified.data.redirect_uri;
-		if (!verified.redirectUriVerified || !redirectUri) throw OAuth2RequestError.malformed("The redirect_uri was not verified.");
+		if (!redirectUri || !verified.redirectUriVerified) throw OAuth2RequestError.malformed("The redirect_uri was not verified.");
 		if (!isSafeRedirectURLScheme(redirectUri)) throw new InternalError("The redirect_uri scheme is not allowed.");
 		if (!provider.enabled) return {
 			kind: "refused",
@@ -61,19 +75,32 @@ var OAuth2FederatedLoginService = class {
 			error: OAuth2ErrorCode.LOGIN_REQUIRED,
 			codeRequest: verified.data
 		};
-		const user = await this.authenticatorFactory(provider, {
+		const authenticator = this.authenticatorFactory(provider, {
 			baseURL: this.options.baseURL,
 			clientId: verified.data.client_id,
 			logger: this.logger
-		}).authenticate({ code });
+		});
+		let user;
+		try {
+			user = await authenticator.authenticate({ code });
+		} catch (e) {
+			if (!isIdentityProviderAssuranceError(e)) throw e;
+			this.logger?.warn(describeError(e, `The identity provider (${provider.id}) login was refused.`));
+			return {
+				kind: "refused",
+				refusal: OAuth2FederatedLoginRefusal.ASSURANCE_INSUFFICIENT,
+				error: OAuth2ErrorCode.ACCESS_DENIED,
+				codeRequest: verified.data
+			};
+		}
 		if (!user.active) return {
 			kind: "refused",
 			refusal: OAuth2FederatedLoginRefusal.USER_INACTIVE,
 			error: OAuth2ErrorCode.ACCESS_DENIED,
 			codeRequest: verified.data
 		};
-		const realm = await this.realmRepository.resolve(provider.realmId, true);
 		if (verified.client.accessPolicyId) {
+			const realm = await this.realmRepository.resolve(provider.realmId, true);
 			let allowed = false;
 			const subject = toIdentityPolicyData({
 				type: IdentityType.USER,
@@ -82,7 +109,7 @@ var OAuth2FederatedLoginService = class {
 					realm
 				}
 			});
-			if (this.accessPolicyEvaluator && subject) allowed = await this.accessPolicyEvaluator.evaluate(verified.client.accessPolicyId, subject);
+			if (subject && this.accessPolicyEvaluator) allowed = await this.accessPolicyEvaluator.evaluate(verified.client.accessPolicyId, subject);
 			if (!allowed) return {
 				kind: "refused",
 				refusal: OAuth2FederatedLoginRefusal.ACCESS_DENIED,
@@ -90,45 +117,74 @@ var OAuth2FederatedLoginService = class {
 				codeRequest: verified.data
 			};
 		}
-		const authorizationCode = await this.codeIssuer.issue(verified.data, {
-			type: IdentityType.USER,
-			data: {
-				...user,
-				realm
-			}
-		}, { authMethod: SessionAuthMethod.EXTERNAL });
+		const session = await this.sessionManager.create({
+			userAgent: input.request?.userAgent ?? void 0,
+			ipAddress: input.request?.ipAddress ?? void 0,
+			realmId: user.realmId,
+			sub: user.id,
+			subKind: IdentityType.USER,
+			mfaAt: null,
+			authMethod: SessionAuthMethod.EXTERNAL,
+			expiresAt: new Date(Date.now() + OAUTH2_FEDERATED_LOGIN_TTL).toISOString()
+		});
+		return {
+			kind: "issued",
+			pendingLoginId: await this.pendingLoginStore.save({
+				sessionId: session.id,
+				providerId: provider.id,
+				userName: user.name
+			}),
+			codeRequest: verified.data
+		};
+	}
+	async completeHandoff(input) {
+		const refuse = () => new BadRequestError("The login request is unknown or expired.");
+		const pending = await this.pendingLoginStore.consume(input.pendingLoginId);
+		if (!pending) throw refuse();
+		if (pending.providerId !== input.providerId) throw refuse();
+		const existing = await this.sessionManager.findOneById(pending.sessionId);
+		if (!existing) throw refuse();
+		if (Date.parse(existing.expiresAt) <= Date.now()) throw refuse();
+		const realm = await this.realmRepository.resolve(existing.realmId, true);
+		const session = await this.sessionManager.refresh(existing);
+		const payload = {
+			session_id: session.id,
+			user_agent: session.userAgent,
+			remote_address: session.ipAddress,
+			scope: ScopeName.GLOBAL,
+			sub: session.sub,
+			sub_kind: OAuth2SubKind.USER,
+			realm_id: session.realmId,
+			realm_name: realm.name,
+			...deriveAmrAcr(session)
+		};
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(payload);
+		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(payload);
 		await this.eventService?.record({
 			scope: EventScope.OAUTH2,
-			name: EventName.AUTHORIZE,
-			refType: EventRefType.CLIENT,
-			refId: verified.data.client_id ?? null,
-			clientId: verified.data.client_id ?? null,
-			sessionId: null,
+			name: EventName.LOGIN,
+			refType: EventRefType.SESSION,
+			refId: session.id,
+			clientId: null,
+			sessionId: session.id,
 			actorType: IdentityType.USER,
-			actorId: user.id,
-			actorName: user.name,
-			realmId: verified.data.realm_id ?? realm.id,
-			requestIpAddress: input.request?.ipAddress ?? null,
-			requestUserAgent: input.request?.userAgent ?? null,
+			actorId: session.sub,
+			actorName: pending.userName ?? null,
+			realmId: session.realmId,
+			requestIpAddress: session.ipAddress ?? null,
+			requestUserAgent: session.userAgent ?? null,
 			data: {
 				reason: "federated",
-				providerId: provider.id,
-				providerName: provider.name,
-				...verified.data.scope ? { scope: verified.data.scope } : {}
+				providerId: pending.providerId
 			}
 		});
-		return {
-			kind: "issued",
-			redirectUri,
-			code: authorizationCode.id,
-			state: verified.data.state,
-			codeRequest: verified.data,
-			client: {
-				id: verified.client.id,
-				name: verified.client.name,
-				displayName: verified.client.displayName ?? null
-			}
-		};
+		this.metrics?.recordLogin("success");
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload,
+			refreshToken,
+			refreshTokenPayload
+		});
 	}
 };
 //#endregion

package/dist/core/oauth2/federated-login/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["isSafeRedirectURLScheme","EventName","EventRefType","EventScope","IdentityType","SessionAuthMethod","InternalError","OAuth2ErrorCode","OAuth2RequestError","isOAuth2Error","createIdentityProviderOAuth2Authenticator","toIdentityPolicyData","OAuth2FederatedLoginRefusal","OAuth2FederatedLoginService","options","accountManager","realmRepository","codeRequestVerifier","codeIssuer","accessPolicyEvaluator","eventService","logger","authenticatorFactory","ctx","provider","baseURL","clientId","complete","input","code","codeRequest","verified","verify","e","kind","refusal","CODE_REQUEST","realmId","client","malformed","redirectUri","data","redirect_uri","redirectUriVerified","enabled","PROVIDER_DISABLED","error","LOGIN_REQUIRED","authenticator","client_id","user","authenticate","active","USER_INACTIVE","ACCESS_DENIED","realm","resolve","accessPolicyId","allowed","subject","type","USER","evaluate","authorizationCode","issue","authMethod","EXTERNAL","record","scope","OAUTH2","name","AUTHORIZE","refType","CLIENT","refId","sessionId","actorType","actorId","id","actorName","realm_id","requestIpAddress","request","ipAddress","requestUserAgent","userAgent","reason","providerId","providerName","state","displayName"],"sources":["../../../../src/core/oauth2/federated-login/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isSafeRedirectURLScheme } from '@authup/kit';\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport { InternalError } from '@authup/errors';\nimport type { Logger } from '@authup/server-kit';\nimport { OAuth2ErrorCode, OAuth2RequestError, isOAuth2Error } from '@authup/specs';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\n// Deep imports, never the `core/identity` barrel: it reaches back into\n// this module through the core barrel, and the cycle would TDZ-crash.\nimport type { IIdentityProviderAccountManager } from '../../identity/provider/account/types.ts';\nimport { createIdentityProviderOAuth2Authenticator } from '../../identity/provider/authentication/factory.ts';\nimport { toIdentityPolicyData } from '../../identity/permission/identity-policy-data.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeIssuer,\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n} from '../authorization/index.ts';\nimport type {\n    IOAuth2FederatedLoginService,\n    OAuth2FederatedLoginAuthenticatorFactory,\n    OAuth2FederatedLoginCompleteInput,\n    OAuth2FederatedLoginCompleteResult,\n    OAuth2FederatedLoginServiceContext,\n    OAuth2FederatedLoginServiceOptions,\n} from './types.ts';\nimport { OAuth2FederatedLoginRefusal } from './types.ts';\n\nexport class OAuth2FederatedLoginService implements IOAuth2FederatedLoginService {\n    protected options : OAuth2FederatedLoginServiceOptions;\n\n    protected accountManager : IIdentityProviderAccountManager;\n\n    protected realmRepository : IRealmRepository;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n    protected eventService? : IEventService;\n\n    protected logger? : Logger;\n\n    protected authenticatorFactory : OAuth2FederatedLoginAuthenticatorFactory;\n\n    constructor(ctx: OAuth2FederatedLoginServiceContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.realmRepository = ctx.realmRepository;\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n        this.codeIssuer = ctx.codeIssuer;\n        this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n        this.eventService = ctx.eventService;\n        this.logger = ctx.logger;\n        this.authenticatorFactory = ctx.authenticatorFactory ??\n            ((provider, options) => createIdentityProviderOAuth2Authenticator({\n                accountManager: this.accountManager,\n                provider,\n                logger: options.logger,\n                options: {\n                    baseURL: options.baseURL,\n                    clientId: options.clientId,\n                },\n            }));\n    }\n\n    async complete(input: OAuth2FederatedLoginCompleteInput): Promise<OAuth2FederatedLoginCompleteResult> {\n        const {\n            code, \n            codeRequest, \n            provider, \n        } = input;\n\n        // Re-verify the request BEFORE the provider's single-use code is\n        // spent. It re-resolves the client (active, grant allowlist, scopes)\n        // and re-matches the redirect_uri against the client's registered\n        // patterns, so a client deactivated (or a pattern removed) while the\n        // person was away at the provider cannot still receive a code, and a\n        // refused completion provisions no user.\n        //\n        // Only a refusal is reported as one; a server failure keeps throwing.\n        let verified : OAuth2AuthorizationCodeRequestVerificationResult;\n        try {\n            verified = await this.codeRequestVerifier.verify(codeRequest);\n        } catch (e) {\n            if (!isOAuth2Error(e)) {\n                throw e;\n            }\n\n            return {\n                kind: 'refused',\n                refusal: OAuth2FederatedLoginRefusal.CODE_REQUEST,\n                codeRequest,\n            };\n        }\n\n        // The provider and the client must share a realm, the completion-side\n        // half of the plan-041 binding. It rests on the client the\n        // verification just resolved rather than the `realm_id` carried on\n        // the state blob: that value is only there because `authorize-out`\n        // stores the VERIFIED request, so a guard reading it would disappear\n        // silently for any state that reached here without the stamp. A\n        // realm-less (global) provider matches every client by design.\n        if (provider.realmId && verified.client.realmId !== provider.realmId) {\n            throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n        }\n\n        // A stored code request always carries a redirect_uri (that mount is\n        // required in OAuth2AuthorizationCodeRequestValidator, unlike\n        // `state`), so a verified request is a verified redirect target. The\n        // guard keeps the redirect decision resting on the match itself,\n        // which is the only thing here that knows the uri was ever matched.\n        const redirectUri = verified.data.redirect_uri;\n        if (!verified.redirectUriVerified || !redirectUri) {\n            throw OAuth2RequestError.malformed('The redirect_uri was not verified.');\n        }\n\n        // A non-http(s) target is navigated from the interstitial page, which\n        // `location.assign`s it and renders it as an href, so a\n        // script-capable scheme would execute on the IdP origin. The client\n        // validator and the code-request verifier both refuse such a scheme;\n        // this fails closed should either gap, and it runs before the\n        // provider's single-use code is spent, a user provisioned or a code\n        // minted.\n        if (!isSafeRedirectURLScheme(redirectUri)) {\n            throw new InternalError('The redirect_uri scheme is not allowed.');\n        }\n\n        // The provider must still be enabled, the rule the link path already\n        // applies. Disabling a provider has to stop logins in flight too,\n        // otherwise it only stops new ones. Checked before the exchange, so\n        // the refusal contacts the provider not at all.\n        if (!provider.enabled) {\n            return {\n                kind: 'refused',\n                refusal: OAuth2FederatedLoginRefusal.PROVIDER_DISABLED,\n                error: OAuth2ErrorCode.LOGIN_REQUIRED,\n                codeRequest: verified.data,\n            };\n        }\n\n        const authenticator = this.authenticatorFactory(provider, {\n            baseURL: this.options.baseURL,\n            clientId: verified.data.client_id,\n            logger: this.logger,\n        });\n\n        const user = await authenticator.authenticate({ code });\n\n        // The local login path refuses an inactive user (EntityInactiveError),\n        // and a federated login must not be the way around that. Only\n        // reachable for an already-linked user: a first login provisions an\n        // active one.\n        if (!user.active) {\n            return {\n                kind: 'refused',\n                refusal: OAuth2FederatedLoginRefusal.USER_INACTIVE,\n                error: OAuth2ErrorCode.ACCESS_DENIED,\n                codeRequest: verified.data,\n            };\n        }\n\n        const realm = await this.realmRepository.resolve(provider.realmId, true);\n\n        // Application access policy (plan 052), federated leg. A policy id\n        // with no wired evaluator denies (fail closed).\n        if (verified.client.accessPolicyId) {\n            let allowed = false;\n\n            const subject = toIdentityPolicyData({\n                type: IdentityType.USER,\n                data: {\n                    ...user,\n                    realm,\n                },\n            });\n            if (this.accessPolicyEvaluator && subject) {\n                allowed = await this.accessPolicyEvaluator.evaluate(\n                    verified.client.accessPolicyId,\n                    subject,\n                );\n            }\n\n            if (!allowed) {\n                return {\n                    kind: 'refused',\n                    refusal: OAuth2FederatedLoginRefusal.ACCESS_DENIED,\n                    error: OAuth2ErrorCode.ACCESS_DENIED,\n                    codeRequest: verified.data,\n                };\n            }\n        }\n\n        // The WHOLE verified request reaches the issuer, never a hand-picked\n        // subset: it carries code_challenge / code_challenge_method and nonce\n        // (plus acr_values, which no redemption path reads yet). A code that\n        // lost its PKCE challenge cannot be redeemed by a public client at\n        // all (`PKCE is required for public clients`), which is every console\n        // client.\n        const authorizationCode = await this.codeIssuer.issue(\n            verified.data,\n            {\n                type: IdentityType.USER,\n                data: {\n                    ...user,\n                    realm,\n                },\n            },\n            { authMethod: SessionAuthMethod.EXTERNAL },\n        );\n\n        // The interactive path records this in OAuth2Authorization.authorize();\n        // this leg issues its code directly, so without an emit here a\n        // federated authorization leaves no trace in auth_events while every\n        // other one does. `reason: federated` is what tells the two apart:\n        // there was no consent step to report. No session exists yet (the\n        // /token exchange creates it), hence a null sessionId. Metrics stay\n        // uninstrumented on this leg, as they already are.\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.AUTHORIZE,\n            refType: EventRefType.CLIENT,\n            refId: verified.data.client_id ?? null,\n            clientId: verified.data.client_id ?? null,\n            sessionId: null,\n            actorType: IdentityType.USER,\n            actorId: user.id,\n            actorName: user.name,\n            realmId: verified.data.realm_id ?? realm.id,\n            requestIpAddress: input.request?.ipAddress ?? null,\n            requestUserAgent: input.request?.userAgent ?? null,\n            data: {\n                reason: 'federated',\n                providerId: provider.id,\n                providerName: provider.name,\n                ...(verified.data.scope ? { scope: verified.data.scope } : {}),\n            },\n        });\n\n        return {\n            kind: 'issued',\n            redirectUri,\n            code: authorizationCode.id,\n            state: verified.data.state,\n            codeRequest: verified.data,\n            client: {\n                id: verified.client.id,\n                name: verified.client.name,\n                displayName: verified.client.displayName ?? null,\n            },\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;AAwCA,IAAaa,8BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,KAAKT,UAAUS,IAAIT;EACnB,KAAKC,iBAAiBQ,IAAIR;EAC1B,KAAKC,kBAAkBO,IAAIP;EAC3B,KAAKC,sBAAsBM,IAAIN;EAC/B,KAAKC,aAAaK,IAAIL;EACtB,KAAKC,wBAAwBI,IAAIJ;EACjC,KAAKC,eAAeG,IAAIH;EACxB,KAAKC,SAASE,IAAIF;EAClB,KAAKC,uBAAuBC,IAAID,0BAC1BE,UAAUV,YAAYJ,0CAA0C;GAC9DK,gBAAgB,KAAKA;GACrBS;GACAH,QAAQP,QAAQO;GAChBP,SAAS;IACLW,SAASX,QAAQW;IACjBC,UAAUZ,QAAQY;GACtB;EACJ,CAAA;CACR;CAEA,MAAMC,SAASC,OAAuF;EAClG,MAAM,EACFC,MACAC,aACAN,aACAI;EAUJ,IAAIG;EACJ,IAAI;GACAA,WAAW,MAAM,KAAKd,oBAAoBe,OAAOF,WAAAA;EACrD,SAASG,GAAG;GACR,IAAI,CAACxB,cAAcwB,CAAAA,GACf,MAAMA;GAGV,OAAO;IACHC,MAAM;IACNC,SAASvB,4BAA4BwB;IACrCN;GACJ;EACJ;EASA,IAAIN,SAASa,WAAWN,SAASO,OAAOD,YAAYb,SAASa,SACzD,MAAM7B,mBAAmB+B,UAAU,6CAAA;EAQvC,MAAMC,cAAcT,SAASU,KAAKC;EAClC,IAAI,CAACX,SAASY,uBAAuB,CAACH,aAClC,MAAMhC,mBAAmB+B,UAAU,oCAAA;EAUvC,IAAI,CAACvC,wBAAwBwC,WAAAA,GACzB,MAAM,IAAIlC,cAAc,yCAAA;EAO5B,IAAI,CAACkB,SAASoB,SACV,OAAO;GACHV,MAAM;GACNC,SAASvB,4BAA4BiC;GACrCC,OAAOvC,gBAAgBwC;GACvBjB,aAAaC,SAASU;EAC1B;EASJ,MAAMS,OAAO,MANS,KAAK5B,qBAAqBE,UAAU;GACtDC,SAAS,KAAKX,QAAQW;GACtBC,UAAUK,SAASU,KAAKQ;GACxB5B,QAAQ,KAAKA;EACjB,CAEmB2B,CAAAA,CAAcG,aAAa,EAAEtB,KAAK,CAAA;EAMrD,IAAI,CAACqB,KAAKE,QACN,OAAO;GACHlB,MAAM;GACNC,SAASvB,4BAA4ByC;GACrCP,OAAOvC,gBAAgB+C;GACvBxB,aAAaC,SAASU;EAC1B;EAGJ,MAAMc,QAAQ,MAAM,KAAKvC,gBAAgBwC,QAAQhC,SAASa,SAAS,IAAA;EAInE,IAAIN,SAASO,OAAOmB,gBAAgB;GAChC,IAAIC,UAAU;GAEd,MAAMC,UAAUhD,qBAAqB;IACjCiD,MAAMxD,aAAayD;IACnBpB,MAAM;KACF,GAAGS;KACHK;IACJ;GACJ,CAAA;GACA,IAAI,KAAKpC,yBAAyBwC,SAC9BD,UAAU,MAAM,KAAKvC,sBAAsB2C,SACvC/B,SAASO,OAAOmB,gBAChBE,OAAAA;GAIR,IAAI,CAACD,SACD,OAAO;IACHxB,MAAM;IACNC,SAASvB,4BAA4B0C;IACrCR,OAAOvC,gBAAgB+C;IACvBxB,aAAaC,SAASU;GAC1B;EAER;EAQA,MAAMsB,oBAAoB,MAAM,KAAK7C,WAAW8C,MAC5CjC,SAASU,MACT;GACImB,MAAMxD,aAAayD;GACnBpB,MAAM;IACF,GAAGS;IACHK;GACJ;EACJ,GACA,EAAEU,YAAY5D,kBAAkB6D,SAAS,CAAA;EAU7C,MAAM,KAAK9C,cAAc+C,OAAO;GAC5BC,OAAOjE,WAAWkE;GAClBC,MAAMrE,UAAUsE;GAChBC,SAAStE,aAAauE;GACtBC,OAAO3C,SAASU,KAAKQ,aAAa;GAClCvB,UAAUK,SAASU,KAAKQ,aAAa;GACrC0B,WAAW;GACXC,WAAWxE,aAAayD;GACxBgB,SAAS3B,KAAK4B;GACdC,WAAW7B,KAAKoB;GAChBjC,SAASN,SAASU,KAAKuC,YAAYzB,MAAMuB;GACzCG,kBAAkBrD,MAAMsD,SAASC,aAAa;GAC9CC,kBAAkBxD,MAAMsD,SAASG,aAAa;GAC9C5C,MAAM;IACF6C,QAAQ;IACRC,YAAY/D,SAASsD;IACrBU,cAAchE,SAAS8C;IACvB,GAAIvC,SAASU,KAAK2B,QAAQ,EAAEA,OAAOrC,SAASU,KAAK2B,MAAM,IAAI,CAAC;GAChE;EACJ,CAAA;EAEA,OAAO;GACHlC,MAAM;GACNM;GACAX,MAAMkC,kBAAkBe;GACxBW,OAAO1D,SAASU,KAAKgD;GACrB3D,aAAaC,SAASU;GACtBH,QAAQ;IACJwC,IAAI/C,SAASO,OAAOwC;IACpBR,MAAMvC,SAASO,OAAOgC;IACtBoB,aAAa3D,SAASO,OAAOoD,eAAe;GAChD;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["isSafeRedirectURLScheme","EventName","EventRefType","EventScope","IdentityType","ScopeName","SessionAuthMethod","BadRequestError","InternalError","OAuth2ErrorCode","OAuth2RequestError","OAuth2SubKind","isOAuth2Error","describeError","createIdentityProviderOAuth2Authenticator","isIdentityProviderAssuranceError","toIdentityPolicyData","deriveAmrAcr","buildOAuth2BearerTokenResponse","OAUTH2_FEDERATED_LOGIN_TTL","OAuth2FederatedLoginRefusal","OAuth2FederatedLoginService","options","accountManager","realmRepository","codeRequestVerifier","sessionManager","pendingLoginStore","accessTokenIssuer","refreshTokenIssuer","accessPolicyEvaluator","eventService","metrics","logger","authenticatorFactory","ctx","provider","baseURL","clientId","complete","input","code","codeRequest","verified","verify","e","kind","refusal","CODE_REQUEST","realmId","client","malformed","redirectUri","data","redirect_uri","redirectUriVerified","enabled","PROVIDER_DISABLED","error","LOGIN_REQUIRED","authenticator","client_id","user","authenticate","warn","id","ASSURANCE_INSUFFICIENT","ACCESS_DENIED","active","USER_INACTIVE","accessPolicyId","realm","resolve","allowed","subject","type","USER","evaluate","session","create","userAgent","request","undefined","ipAddress","sub","subKind","mfaAt","authMethod","EXTERNAL","expiresAt","Date","now","toISOString","pendingLoginId","save","sessionId","providerId","userName","name","completeHandoff","refuse","pending","consume","existing","findOneById","parse","refresh","payload","session_id","user_agent","remote_address","scope","GLOBAL","sub_kind","realm_id","realm_name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload","record","OAUTH2","LOGIN","refType","SESSION","refId","actorType","actorId","actorName","requestIpAddress","requestUserAgent","reason","recordLogin"],"sources":["../../../../src/core/oauth2/federated-login/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isSafeRedirectURLScheme } from '@authup/kit';\nimport type { User } from '@authup/core-kit';\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    ScopeName,\n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport { BadRequestError, InternalError } from '@authup/errors';\nimport type { Logger } from '@authup/server-kit';\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport {\n    OAuth2ErrorCode,\n    OAuth2RequestError,\n    OAuth2SubKind,\n    isOAuth2Error,\n} from '@authup/specs';\nimport { describeError } from '../../../utils/index.ts';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\n// Deep imports, never the `core/identity` barrel: it reaches back into\n// this module through the core barrel, and the cycle would TDZ-crash.\nimport type { IIdentityProviderAccountManager } from '../../identity/provider/account/types.ts';\nimport { createIdentityProviderOAuth2Authenticator } from '../../identity/provider/authentication/factory.ts';\nimport { isIdentityProviderAssuranceError } from '../../identity/provider/authentication/protocols/oauth2/assurance.ts';\nimport { toIdentityPolicyData } from '../../identity/permission/identity-policy-data.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n} from '../authorization/index.ts';\nimport { deriveAmrAcr } from '../authorization/helpers.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAUTH2_FEDERATED_LOGIN_TTL } from './constants.ts';\nimport type {\n    IOAuth2FederatedLoginService,\n    IOAuth2FederatedLoginStore,\n    OAuth2FederatedLoginAuthenticatorFactory,\n    OAuth2FederatedLoginCompleteHandoffInput,\n    OAuth2FederatedLoginCompleteInput,\n    OAuth2FederatedLoginCompleteResult,\n    OAuth2FederatedLoginServiceContext,\n    OAuth2FederatedLoginServiceOptions,\n} from './types.ts';\nimport { OAuth2FederatedLoginRefusal } from './types.ts';\n\nexport class OAuth2FederatedLoginService implements IOAuth2FederatedLoginService {\n    protected options : OAuth2FederatedLoginServiceOptions;\n\n    protected accountManager : IIdentityProviderAccountManager;\n\n    protected realmRepository : IRealmRepository;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected sessionManager : ISessionManager;\n\n    protected pendingLoginStore : IOAuth2FederatedLoginStore;\n\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected logger? : Logger;\n\n    protected authenticatorFactory : OAuth2FederatedLoginAuthenticatorFactory;\n\n    constructor(ctx: OAuth2FederatedLoginServiceContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.realmRepository = ctx.realmRepository;\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n        this.sessionManager = ctx.sessionManager;\n        this.pendingLoginStore = ctx.pendingLoginStore;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n        this.logger = ctx.logger;\n        this.authenticatorFactory = ctx.authenticatorFactory ??\n            ((provider, options) => createIdentityProviderOAuth2Authenticator({\n                accountManager: this.accountManager,\n                provider,\n                logger: options.logger,\n                options: {\n                    baseURL: options.baseURL,\n                    clientId: options.clientId,\n                },\n            }));\n    }\n\n    async complete(input: OAuth2FederatedLoginCompleteInput): Promise<OAuth2FederatedLoginCompleteResult> {\n        const {\n            code, \n            codeRequest, \n            provider, \n        } = input;\n\n        // Re-verify the request BEFORE the provider's single-use code is\n        // spent. It re-resolves the client (active, grant allowlist, scopes)\n        // and re-matches the redirect_uri against the client's registered\n        // patterns, so a client deactivated (or a pattern removed) while the\n        // person was away at the provider cannot still receive a code, and a\n        // refused completion provisions no user.\n        //\n        // Only a refusal is reported as one; a server failure keeps throwing.\n        let verified : OAuth2AuthorizationCodeRequestVerificationResult;\n        try {\n            verified = await this.codeRequestVerifier.verify(codeRequest);\n        } catch (e) {\n            if (!isOAuth2Error(e)) {\n                throw e;\n            }\n\n            return {\n                kind: 'refused',\n                refusal: OAuth2FederatedLoginRefusal.CODE_REQUEST,\n                codeRequest,\n            };\n        }\n\n        // The provider and the client must share a realm, the completion-side\n        // half of the plan-041 binding. It rests on the client the\n        // verification just resolved rather than the `realm_id` carried on\n        // the state blob: that value is only there because `authorize-out`\n        // stores the VERIFIED request, so a guard reading it would disappear\n        // silently for any state that reached here without the stamp. A\n        // realm-less (global) provider matches every client by design.\n        if (provider.realmId && verified.client.realmId !== provider.realmId) {\n            throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n        }\n\n        // A stored code request always carries a redirect_uri (that mount is\n        // required in OAuth2AuthorizationCodeRequestValidator, unlike\n        // `state`), so a verified request is a verified redirect target. The\n        // guard keeps the redirect decision resting on the match itself,\n        // which is the only thing here that knows the uri was ever matched.\n        const redirectUri = verified.data.redirect_uri;\n        if (!redirectUri || !verified.redirectUriVerified) {\n            throw OAuth2RequestError.malformed('The redirect_uri was not verified.');\n        }\n\n        // A non-http(s) target is navigated from the interstitial page, which\n        // `location.assign`s it and renders it as an href, so a\n        // script-capable scheme would execute on the IdP origin. The client\n        // validator and the code-request verifier both refuse such a scheme;\n        // this fails closed should either gap, and it runs before the\n        // provider's single-use code is spent, a user provisioned or a code\n        // minted.\n        if (!isSafeRedirectURLScheme(redirectUri)) {\n            throw new InternalError('The redirect_uri scheme is not allowed.');\n        }\n\n        // The provider must still be enabled, the rule the link path already\n        // applies. Disabling a provider has to stop logins in flight too,\n        // otherwise it only stops new ones. Checked before the exchange, so\n        // the refusal contacts the provider not at all.\n        if (!provider.enabled) {\n            return {\n                kind: 'refused',\n                refusal: OAuth2FederatedLoginRefusal.PROVIDER_DISABLED,\n                error: OAuth2ErrorCode.LOGIN_REQUIRED,\n                codeRequest: verified.data,\n            };\n        }\n\n        const authenticator = this.authenticatorFactory(provider, {\n            baseURL: this.options.baseURL,\n            clientId: verified.data.client_id,\n            logger: this.logger,\n        });\n\n        let user : User;\n        try {\n            user = await authenticator.authenticate({ code });\n        } catch (e) {\n            // The upstream did not meet the provider's assurance allow-list\n            // (issue #3477). No user is provisioned and no account linked\n            // because the gate throws inside `resolveIdentity`, before the\n            // account manager runs - not because of where this catch sits.\n            // The reason only goes to the log: the marker\n            // set the hosted page maps is deliberately closed, so `access_denied`\n            // is what the browser sees.\n            if (!isIdentityProviderAssuranceError(e)) {\n                throw e;\n            }\n\n            this.logger?.warn(describeError(\n                e,\n                `The identity provider (${provider.id}) login was refused.`,\n            ));\n\n            return {\n                kind: 'refused',\n                refusal: OAuth2FederatedLoginRefusal.ASSURANCE_INSUFFICIENT,\n                error: OAuth2ErrorCode.ACCESS_DENIED,\n                codeRequest: verified.data,\n            };\n        }\n\n        // The local login path refuses an inactive user (EntityInactiveError),\n        // and a federated login must not be the way around that. Only\n        // reachable for an already-linked user: a first login provisions an\n        // active one.\n        if (!user.active) {\n            return {\n                kind: 'refused',\n                refusal: OAuth2FederatedLoginRefusal.USER_INACTIVE,\n                error: OAuth2ErrorCode.ACCESS_DENIED,\n                codeRequest: verified.data,\n            };\n        }\n\n        // Application access policy (plan 052), federated leg. A policy id\n        // with no wired evaluator denies (fail closed).\n        if (verified.client.accessPolicyId) {\n            const realm = await this.realmRepository.resolve(provider.realmId, true);\n            let allowed = false;\n\n            const subject = toIdentityPolicyData({\n                type: IdentityType.USER,\n                data: {\n                    ...user,\n                    realm,\n                },\n            });\n            if (subject && this.accessPolicyEvaluator) {\n                allowed = await this.accessPolicyEvaluator.evaluate(\n                    verified.client.accessPolicyId,\n                    subject,\n                );\n            }\n\n            if (!allowed) {\n                return {\n                    kind: 'refused',\n                    refusal: OAuth2FederatedLoginRefusal.ACCESS_DENIED,\n                    error: OAuth2ErrorCode.ACCESS_DENIED,\n                    codeRequest: verified.data,\n                };\n            }\n        }\n\n        // The callback establishes the session and stops there. The RP's\n        // code is issued at the end of the hosted authorize ladder, so a\n        // federated login passes the same gates a password login does: the\n        // second factor, inline enrollment, prompt/max_age freshness,\n        // acr_values step-up and consent (plan 094).\n        //\n        // Its lifetime is the pending login's: an abandoned one self-expires and\n        // is swept with the regular session sweep, and redemption extends it\n        // to the regular one.\n        const session = await this.sessionManager.create({\n            userAgent: input.request?.userAgent ?? undefined,\n            ipAddress: input.request?.ipAddress ?? undefined,\n            realmId: user.realmId,\n            // no `clientId`: a USER-subject session, and the column is the\n            // client-SUBJECT foreign key. The application lands on the\n            // token rows at the /token exchange.\n            sub: user.id,\n            subKind: IdentityType.USER,\n            mfaAt: null,\n            authMethod: SessionAuthMethod.EXTERNAL,\n            expiresAt: new Date(Date.now() + OAUTH2_FEDERATED_LOGIN_TTL).toISOString(),\n        });\n\n        const pendingLoginId = await this.pendingLoginStore.save({\n            sessionId: session.id,\n            providerId: provider.id,\n            userName: user.name,\n        });\n\n        return {\n            kind: 'issued',\n            pendingLoginId,\n            codeRequest: verified.data,\n        };\n    }\n\n    async completeHandoff(input: OAuth2FederatedLoginCompleteHandoffInput): Promise<OAuth2TokenGrantResponse> {\n        // One message for every refusal: the caller is anonymous, so an\n        // unknown pending login, an expired one and a foreign one must not\n        // be distinguishable.\n        const refuse = () => new BadRequestError('The login request is unknown or expired.');\n\n        const pending = await this.pendingLoginStore.consume(input.pendingLoginId);\n        if (!pending) {\n            throw refuse();\n        }\n\n        // The browser binding is the cookie the callback set, which only the\n        // browser that started this login carries and no other origin can\n        // write. So there is nothing here to prove beyond the provider the\n        // completion was addressed at.\n        //\n        // The callback request's address and agent are deliberately not\n        // compared: both are chosen by whoever makes that request (under the\n        // shipped `trustProxy: true` the address is the client-supplied\n        // left-most `X-Forwarded-For` entry), and comparing them across a\n        // top-level navigation and the page's own request is the shape issue\n        // #3439 rejected.\n        if (pending.providerId !== input.providerId) {\n            throw refuse();\n        }\n\n        const existing = await this.sessionManager.findOneById(pending.sessionId);\n        if (!existing) {\n            throw refuse();\n        }\n\n        // The pending session carries the pending login's own deadline, and\n        // the lookup is by id alone. Today the cache entry above expires with\n        // it, so this only fires on clock skew between the two stores, but the\n        // expiry must be enforced where it is written: `refresh` would extend\n        // an abandoned login into a regular session.\n        if (Date.parse(existing.expiresAt) <= Date.now()) {\n            throw refuse();\n        }\n\n        const realm = await this.realmRepository.resolve(existing.realmId, true);\n\n        // The login is complete now, so the pending session becomes a\n        // regular one.\n        const session = await this.sessionManager.refresh(existing);\n\n        const payload : Partial<OAuth2TokenPayload> = {\n            session_id: session.id,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            scope: ScopeName.GLOBAL,\n            sub: session.sub,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: session.realmId,\n            realm_name: realm.name,\n            ...deriveAmrAcr(session),\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(payload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(payload);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGIN,\n            refType: EventRefType.SESSION,\n            refId: session.id,\n            clientId: null,\n            sessionId: session.id,\n            actorType: IdentityType.USER,\n            actorId: session.sub,\n            actorName: pending.userName ?? null,\n            realmId: session.realmId,\n            requestIpAddress: session.ipAddress ?? null,\n            requestUserAgent: session.userAgent ?? null,\n            data: { reason: 'federated', providerId: pending.providerId },\n        });\n        this.metrics?.recordLogin('success');\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAyDA,IAAaqB,8BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,KAAKb,UAAUa,IAAIb;EACnB,KAAKC,iBAAiBY,IAAIZ;EAC1B,KAAKC,kBAAkBW,IAAIX;EAC3B,KAAKC,sBAAsBU,IAAIV;EAC/B,KAAKC,iBAAiBS,IAAIT;EAC1B,KAAKC,oBAAoBQ,IAAIR;EAC7B,KAAKC,oBAAoBO,IAAIP;EAC7B,KAAKC,qBAAqBM,IAAIN;EAC9B,KAAKC,wBAAwBK,IAAIL;EACjC,KAAKC,eAAeI,IAAIJ;EACxB,KAAKC,UAAUG,IAAIH;EACnB,KAAKC,SAASE,IAAIF;EAClB,KAAKC,uBAAuBC,IAAID,0BAC1BE,UAAUd,YAAYR,0CAA0C;GAC9DS,gBAAgB,KAAKA;GACrBa;GACAH,QAAQX,QAAQW;GAChBX,SAAS;IACLe,SAASf,QAAQe;IACjBC,UAAUhB,QAAQgB;GACtB;EACJ,CAAA;CACR;CAEA,MAAMC,SAASC,OAAuF;EAClG,MAAM,EACFC,MACAC,aACAN,aACAI;EAUJ,IAAIG;EACJ,IAAI;GACAA,WAAW,MAAM,KAAKlB,oBAAoBmB,OAAOF,WAAAA;EACrD,SAASG,GAAG;GACR,IAAI,CAACjC,cAAciC,CAAAA,GACf,MAAMA;GAGV,OAAO;IACHC,MAAM;IACNC,SAAS3B,4BAA4B4B;IACrCN;GACJ;EACJ;EASA,IAAIN,SAASa,WAAWN,SAASO,OAAOD,YAAYb,SAASa,SACzD,MAAMvC,mBAAmByC,UAAU,6CAAA;EAQvC,MAAMC,cAAcT,SAASU,KAAKC;EAClC,IAAI,CAACF,eAAe,CAACT,SAASY,qBAC1B,MAAM7C,mBAAmByC,UAAU,oCAAA;EAUvC,IAAI,CAACnD,wBAAwBoD,WAAAA,GACzB,MAAM,IAAI5C,cAAc,yCAAA;EAO5B,IAAI,CAAC4B,SAASoB,SACV,OAAO;GACHV,MAAM;GACNC,SAAS3B,4BAA4BqC;GACrCC,OAAOjD,gBAAgBkD;GACvBjB,aAAaC,SAASU;EAC1B;EAGJ,MAAMO,gBAAgB,KAAK1B,qBAAqBE,UAAU;GACtDC,SAAS,KAAKf,QAAQe;GACtBC,UAAUK,SAASU,KAAKQ;GACxB5B,QAAQ,KAAKA;EACjB,CAAA;EAEA,IAAI6B;EACJ,IAAI;GACAA,OAAO,MAAMF,cAAcG,aAAa,EAAEtB,KAAK,CAAA;EACnD,SAASI,GAAG;GAQR,IAAI,CAAC9B,iCAAiC8B,CAAAA,GAClC,MAAMA;GAGV,KAAKZ,QAAQ+B,KAAKnD,cACdgC,GACA,0BAA0BT,SAAS6B,GAAG,qBAAqB,CAAA;GAG/D,OAAO;IACHnB,MAAM;IACNC,SAAS3B,4BAA4B8C;IACrCR,OAAOjD,gBAAgB0D;IACvBzB,aAAaC,SAASU;GAC1B;EACJ;EAMA,IAAI,CAACS,KAAKM,QACN,OAAO;GACHtB,MAAM;GACNC,SAAS3B,4BAA4BiD;GACrCX,OAAOjD,gBAAgB0D;GACvBzB,aAAaC,SAASU;EAC1B;EAKJ,IAAIV,SAASO,OAAOoB,gBAAgB;GAChC,MAAMC,QAAQ,MAAM,KAAK/C,gBAAgBgD,QAAQpC,SAASa,SAAS,IAAA;GACnE,IAAIwB,UAAU;GAEd,MAAMC,UAAU1D,qBAAqB;IACjC2D,MAAMvE,aAAawE;IACnBvB,MAAM;KACF,GAAGS;KACHS;IACJ;GACJ,CAAA;GACA,IAAIG,WAAW,KAAK5C,uBAChB2C,UAAU,MAAM,KAAK3C,sBAAsB+C,SACvClC,SAASO,OAAOoB,gBAChBI,OAAAA;GAIR,IAAI,CAACD,SACD,OAAO;IACH3B,MAAM;IACNC,SAAS3B,4BAA4B+C;IACrCT,OAAOjD,gBAAgB0D;IACvBzB,aAAaC,SAASU;GAC1B;EAER;EAWA,MAAMyB,UAAU,MAAM,KAAKpD,eAAeqD,OAAO;GAC7CC,WAAWxC,MAAMyC,SAASD,aAAaE,KAAAA;GACvCC,WAAW3C,MAAMyC,SAASE,aAAaD,KAAAA;GACvCjC,SAASa,KAAKb;GAIdmC,KAAKtB,KAAKG;GACVoB,SAASjF,aAAawE;GACtBU,OAAO;GACPC,YAAYjF,kBAAkBkF;GAC9BC,WAAW,IAAIC,KAAKA,KAAKC,IAAG,IAAKxE,0BAAAA,CAAAA,CAA4ByE,YAAW;EAC5E,CAAA;EAQA,OAAO;GACH9C,MAAM;GACN+C,gBAAAA,MARyB,KAAKlE,kBAAkBmE,KAAK;IACrDC,WAAWjB,QAAQb;IACnB+B,YAAY5D,SAAS6B;IACrBgC,UAAUnC,KAAKoC;GACnB,CAAA;GAKIxD,aAAaC,SAASU;EAC1B;CACJ;CAEA,MAAM8C,gBAAgB3D,OAAoF;EAItG,MAAM4D,eAAe,IAAI7F,gBAAgB,0CAAA;EAEzC,MAAM8F,UAAU,MAAM,KAAK1E,kBAAkB2E,QAAQ9D,MAAMqD,cAAc;EACzE,IAAI,CAACQ,SACD,MAAMD,OAAAA;EAcV,IAAIC,QAAQL,eAAexD,MAAMwD,YAC7B,MAAMI,OAAAA;EAGV,MAAMG,WAAW,MAAM,KAAK7E,eAAe8E,YAAYH,QAAQN,SAAS;EACxE,IAAI,CAACQ,UACD,MAAMH,OAAAA;EAQV,IAAIV,KAAKe,MAAMF,SAASd,SAAS,KAAKC,KAAKC,IAAG,GAC1C,MAAMS,OAAAA;EAGV,MAAM7B,QAAQ,MAAM,KAAK/C,gBAAgBgD,QAAQ+B,SAAStD,SAAS,IAAA;EAInE,MAAM6B,UAAU,MAAM,KAAKpD,eAAegF,QAAQH,QAAAA;EAElD,MAAMI,UAAwC;GAC1CC,YAAY9B,QAAQb;GACpB4C,YAAY/B,QAAQE;GACpB8B,gBAAgBhC,QAAQK;GACxB4B,OAAO1G,UAAU2G;GACjB5B,KAAKN,QAAQM;GACb6B,UAAUtG,cAAciE;GACxBsC,UAAUpC,QAAQ7B;GAClBkE,YAAY5C,MAAM2B;GAClB,GAAGjF,aAAa6D,OAAAA;EACpB;EAEA,MAAM,CAACsC,aAAaC,sBAAsB,MAAM,KAAKzF,kBAAkB0F,MAAMX,OAAAA;EAC7E,MAAM,CAACY,cAAcC,uBAAuB,MAAM,KAAK3F,mBAAmByF,MAAMX,OAAAA;EAEhF,MAAM,KAAK5E,cAAc0F,OAAO;GAC5BV,OAAO5G,WAAWuH;GAClBxB,MAAMjG,UAAU0H;GAChBC,SAAS1H,aAAa2H;GACtBC,OAAOhD,QAAQb;GACf3B,UAAU;GACVyD,WAAWjB,QAAQb;GACnB8D,WAAW3H,aAAawE;GACxBoD,SAASlD,QAAQM;GACjB6C,WAAW5B,QAAQJ,YAAY;GAC/BhD,SAAS6B,QAAQ7B;GACjBiF,kBAAkBpD,QAAQK,aAAa;GACvCgD,kBAAkBrD,QAAQE,aAAa;GACvC3B,MAAM;IAAE+E,QAAQ;IAAapC,YAAYK,QAAQL;GAAW;EAChE,CAAA;EACA,KAAKhE,SAASqG,YAAY,SAAA;EAE1B,OAAOnH,+BAA+B;GAClCkG;GACAC;GACAE;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/federated-login/types.d.ts

@@ -1,11 +1,14 @@
 import type { OAuth2AuthorizationCodeRequest, OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';
-import type { OAuth2ErrorCode } from '@authup/specs';
+import type { OAuth2ErrorCode, OAuth2TokenGrantResponse } from '@authup/specs';
 import type { Logger } from '@authup/server-kit';
 import type { IIdentityProviderAccountManager } from '../../identity/provider/account/types.ts';
 import type { IOAuth2Authenticator } from '../../identity/provider/authentication/protocols/index.ts';
 import type { IEventService, IRealmRepository } from '../../entities/index.ts';
+import type { ISessionManager } from '../../authentication/index.ts';
+import type { IAuthFlowMetrics } from '../../metrics/index.ts';
+import type { IOAuth2TokenIssuer } from '../token/index.ts';
 import type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';
-import type { IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier } from '../authorization/index.ts';
+import type { IOAuth2AuthorizationCodeRequestVerifier } from '../authorization/index.ts';
 export type OAuth2FederatedLoginCompleteInput = {
     /**
      * The provider the callback belongs to, already resolved and
@@ -51,7 +54,13 @@ export declare enum OAuth2FederatedLoginRefusal {
     /**
      * The client's access policy denied the identity (plan 052).
      */
-    ACCESS_DENIED = "accessDenied"
+    ACCESS_DENIED = "accessDenied",
+    /**
+     * The upstream did not meet the provider's `requiredAmr` / `requiredAcr`
+     * allow-list (issue #3477). Opt-in: a provider declaring neither cannot
+     * reach this.
+     */
+    ASSURANCE_INSUFFICIENT = "assuranceInsufficient"
 }
 export type OAuth2FederatedLoginRefusedResult = {
     kind: 'refused';
@@ -71,40 +80,85 @@ export type OAuth2FederatedLoginRefusedResult = {
 export type OAuth2FederatedLoginIssuedResult = {
     kind: 'issued';
     /**
-     * The verified redirect target of the RP. Its scheme passed
-     * `isSafeRedirectURLScheme`, so a caller may navigate it.
+     * Identifies the pending login the hosted authorize page completes. The
+     * caller puts it in a cookie; it is never a URL parameter. No token and no
+     * authorization code: the application's code is issued at the end of the
+     * hosted ladder, once the prompt gates and consent have run.
      */
-    redirectUri: string;
+    pendingLoginId: string;
     /**
-     * The authorization code id the RP redeems at `/token`.
+     * The verified request, which the caller re-renders on the hosted
+     * page alongside it.
      */
-    code: string;
-    state?: string;
+    codeRequest: OAuth2AuthorizationCodeRequest;
+};
+/**
+ * What a pending login holds. Three scalars, never the identity object (which
+ * carries the provider entity incl. its EA-loaded clientSecret and the raw
+ * external token payload) and never a token.
+ */
+export type OAuth2FederatedLoginPending = {
+    sessionId: string;
     /**
-     * The verified request, for a caller that has to re-render the hosted
-     * page alongside the redirect (the custom-scheme interstitial).
+     * The provider the login was started at. The completion endpoint is
+     * provider-scoped, so a pending login cannot be completed at another.
      */
-    codeRequest: OAuth2AuthorizationCodeRequest;
-    client: {
-        id: string;
-        name: string;
-        displayName: string | null;
-    };
+    providerId: string;
+    /**
+     * Actor name for the LOGIN security event.
+     */
+    userName?: string | null;
+};
+export interface IOAuth2FederatedLoginStore {
+    /**
+     * @returns the id of the pending login
+     */
+    save(data: OAuth2FederatedLoginPending): Promise<string>;
+    /**
+     * Reads and DROPS it. Single use: one pending login completes once.
+     */
+    consume(id: string): Promise<OAuth2FederatedLoginPending | null>;
+}
+export type OAuth2FederatedLoginCompleteHandoffInput = {
+    /**
+     * From the cookie the callback set on this browser.
+     */
+    pendingLoginId: string;
+    /**
+     * The provider the completion endpoint was addressed at.
+     */
+    providerId: string;
 };
 export type OAuth2FederatedLoginCompleteResult = OAuth2FederatedLoginRefusedResult | OAuth2FederatedLoginIssuedResult;
 /**
- * Completes the RP's original authorization request after an external
- * provider sent the browser back (issue #3446). It owns the refusal ladder
- * — realm match, code-request re-verification, redirect-scheme gate,
- * provider and user state, access policy — and mints the authup code.
+ * Completes the external leg of a federated login after a provider sent
+ * the browser back (issue #3446). It owns the refusal ladder: realm match,
+ * code-request re-verification, redirect-scheme gate, provider and user
+ * state, access policy.
+ *
+ * It does NOT mint the RP's authorization code. It establishes the authup
+ * session and hands the browser a cookie naming it; the hosted authorize
+ * page completes it and runs the same ladder a password login runs before
+ * any code is issued (plan 094).
  *
  * Deliberately transport-free: it decides WHAT the answer is, and returns
  * it as a discriminated result. The adapter decides how that answer
- * reaches the browser (a redirect, or the interstitial page a custom
- * scheme needs), because only the adapter knows the difference.
+ * reaches the browser.
  */
 export interface IOAuth2FederatedLoginService {
     complete(input: OAuth2FederatedLoginCompleteInput): Promise<OAuth2FederatedLoginCompleteResult>;
+    /**
+     * Exchange the pending login for the grant of the session the callback
+     * established. Refuses without detail: the caller is anonymous.
+     *
+     * The local second factor is deliberately NOT gated here: an external
+     * provider authenticated this login and is where MFA is enforced for it.
+     * An application that asks for one explicitly (`acr_values`) still steps
+     * up at `POST /authorize`.
+     *
+     * @throws BadRequestError
+     */
+    completeHandoff(input: OAuth2FederatedLoginCompleteHandoffInput): Promise<OAuth2TokenGrantResponse>;
 }
 export type OAuth2FederatedLoginServiceOptions = {
     /**
@@ -129,9 +183,13 @@ export type OAuth2FederatedLoginServiceContext = {
     accountManager: IIdentityProviderAccountManager;
     realmRepository: IRealmRepository;
     codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
-    codeIssuer: IOAuth2AuthorizationCodeIssuer;
+    sessionManager: ISessionManager;
+    pendingLoginStore: IOAuth2FederatedLoginStore;
+    accessTokenIssuer: IOAuth2TokenIssuer;
+    refreshTokenIssuer: IOAuth2TokenIssuer;
     accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
     eventService?: IEventService;
+    metrics?: IAuthFlowMetrics;
     logger?: Logger;
     authenticatorFactory?: OAuth2FederatedLoginAuthenticatorFactory;
 };

package/dist/core/oauth2/federated-login/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,IAAI,EACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAChG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EACR,8BAA8B,EAC9B,uCAAuC,EAC1C,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,iCAAiC,GAAG;IAC5C;;;OAGG;IACH,QAAQ,EAAE,sBAAsB,GAAG,sBAAsB,CAAC;IAC1D;;;OAGG;IACH,WAAW,EAAE,8BAA8B,CAAC;IAC5C;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,CAAC;CACL,CAAC;AAEF;;;;GAIG;AACH,oBAAY,2BAA2B;IACnC;;;;;OAKG;IACH,YAAY,gBAAgB;IAC5B;;OAEG;IACH,iBAAiB,qBAAqB;IACtC;;;OAGG;IACH,aAAa,iBAAiB;IAC9B;;OAEG;IACH,aAAa,iBAAiB;CACjC;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC5C,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,2BAA2B,CAAC;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,GAAG,eAAe,EAAE,CAAC;IAC7B;;;OAGG;IACH,WAAW,EAAE,8BAA8B,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC3C,IAAI,EAAE,QAAQ,CAAC;IACf;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,WAAW,EAAE,8BAA8B,CAAC;IAC5C,MAAM,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAM,iCAAiC,GACjF,gCAAgC,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,4BAA4B;IACzC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,GAAI,OAAO,CAAC,kCAAkC,CAAC,CAAC;CACpG;AAED,MAAM,MAAM,kCAAkC,GAAG;IAC7C;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,wCAAwC,GAAG,CACnD,QAAQ,EAAE,sBAAsB,GAAG,sBAAsB,EACzD,OAAO,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,KACA,oBAAoB,CAAC,IAAI,CAAC,CAAC;AAEhC,MAAM,MAAM,kCAAkC,GAAG;IAC7C,OAAO,EAAE,kCAAkC,CAAC;IAE5C,cAAc,EAAE,+BAA+B,CAAC;IAChD,eAAe,EAAE,gBAAgB,CAAC;IAClC,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D,UAAU,EAAE,8BAA8B,CAAC;IAE3C,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IACrD,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,wCAAwC,CAAC;CACnE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,IAAI,EACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAChG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,2BAA2B,CAAC;AAEzF,MAAM,MAAM,iCAAiC,GAAG;IAC5C;;;OAGG;IACH,QAAQ,EAAE,sBAAsB,GAAG,sBAAsB,CAAC;IAC1D;;;OAGG;IACH,WAAW,EAAE,8BAA8B,CAAC;IAC5C;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,CAAC;CACL,CAAC;AAEF;;;;GAIG;AACH,oBAAY,2BAA2B;IACnC;;;;;OAKG;IACH,YAAY,gBAAgB;IAC5B;;OAEG;IACH,iBAAiB,qBAAqB;IACtC;;;OAGG;IACH,aAAa,iBAAiB;IAC9B;;OAEG;IACH,aAAa,iBAAiB;IAC9B;;;;OAIG;IACH,sBAAsB,0BAA0B;CACnD;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC5C,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,2BAA2B,CAAC;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,GAAG,eAAe,EAAE,CAAC;IAC7B;;;OAGG;IACH,WAAW,EAAE,8BAA8B,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC3C,IAAI,EAAE,QAAQ,CAAC;IACf;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,WAAW,EAAE,8BAA8B,CAAC;CAC/C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACvC;;OAEG;IACH,IAAI,CAAC,IAAI,EAAE,2BAA2B,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D;;OAEG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,2BAA2B,GAAG,IAAI,CAAC,CAAC;CACrE;AAED,MAAM,MAAM,wCAAwC,GAAG;IACnD;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAM,iCAAiC,GACjF,gCAAgC,CAAC;AAErC;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,4BAA4B;IACzC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,GAAI,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAEjG;;;;;;;;;;OAUG;IACH,eAAe,CAAC,KAAK,EAAE,wCAAwC,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACxG;AAED,MAAM,MAAM,kCAAkC,GAAG;IAC7C;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,wCAAwC,GAAG,CACnD,QAAQ,EAAE,sBAAsB,GAAG,sBAAsB,EACzD,OAAO,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,KACA,oBAAoB,CAAC,IAAI,CAAC,CAAC;AAEhC,MAAM,MAAM,kCAAkC,GAAG;IAC7C,OAAO,EAAE,kCAAkC,CAAC;IAE5C,cAAc,EAAE,+BAA+B,CAAC;IAChD,eAAe,EAAE,gBAAgB,CAAC;IAClC,mBAAmB,EAAE,uCAAuC,CAAC;IAE7D,cAAc,EAAE,eAAe,CAAC;IAChC,iBAAiB,EAAE,0BAA0B,CAAC;IAC9C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;IAEvC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IACrD,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,wCAAwC,CAAC;CACnE,CAAC"}

package/dist/core/oauth2/federated-login/types.mjs

@@ -23,6 +23,11 @@ import.meta.url;
 	/**
 	* The client's access policy denied the identity (plan 052).
 	*/ OAuth2FederatedLoginRefusal["ACCESS_DENIED"] = "accessDenied";
+	/**
+	* The upstream did not meet the provider's `requiredAmr` / `requiredAcr`
+	* allow-list (issue #3477). Opt-in: a provider declaring neither cannot
+	* reach this.
+	*/ OAuth2FederatedLoginRefusal["ASSURANCE_INSUFFICIENT"] = "assuranceInsufficient";
 	return OAuth2FederatedLoginRefusal;
 }({});
 //#endregion