@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/adapters/http/adapters/oauth2/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2Authorization","OAuth2AuthorizationCodeRequestValidator","readFromLocations","useRequestIdentityOrFail","useRequestSessionId","HTTPOAuth2Authorizer","codeRequestVerifier","requestValidator","consentService","logger","ctx","authorizeWithRequest","event","codeRequestValidated","validateWithRequest","data","client","redirectUriVerified","verify","identity","result","authorize","raw","sessionId","builtIn","record","clientId","id","realmId","owner","sub","subKind","type","scope","e","warn","error","run"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';\nimport { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations, useRequestIdentityOrFail, useRequestSessionId } from '../../../request/index.ts';\nimport type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';\n\nexport class HTTPOAuth2Authorizer extends OAuth2Authorization {\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected requestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected consentService? : IConsentService;\n\n    protected logger? : Logger;\n\n    constructor(ctx: HTTPOAuth2AuthorizationManagerContext) {\n        super(ctx);\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n        this.consentService = ctx.consentService;\n        this.logger = ctx.logger;\n\n        this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();\n    }\n\n    async authorizeWithRequest(event: IAppEvent) : Promise<OAuth2AuthorizationResult> {\n        const codeRequestValidated = await this.validateWithRequest(event);\n\n        const {\n            data,\n            client,\n            redirectUriVerified,\n        } = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n        const identity = useRequestIdentityOrFail(event);\n\n        const result = await this.authorize(data, identity.raw, {\n            sessionId: useRequestSessionId(event),\n            client,\n            redirectUriVerified,\n        });\n\n        // Persisted per-scope consent (plan 055): recorded only after a\n        // successful approval — an access-policy denial throws inside\n        // authorize() above, so a denied identity never writes a row.\n        // built_in clients keep zero rows (locked); insert-missing makes\n        // re-recording idempotent (union/keep).\n        if (this.consentService && client && !client.builtIn) {\n            try {\n                await this.consentService.record({\n                    clientId: client.id,\n                    realmId: client.realmId,\n                    owner: {\n                        sub: identity.raw.data.id,\n                        subKind: identity.raw.type,\n                    },\n                    scope: data.scope ?? null,\n                });\n            } catch (e) {\n                // never fail an issued code over a consent-write failure\n                this.logger?.warn('Recording the OAuth2 consent grant failed.', {\n                    clientId: client.id,\n                    error: e,\n                });\n            }\n        }\n\n        return result;\n    }\n\n    /**\n     * Validate authorization request.\n     *\n     * @throws OAuth2Error\n     */\n    async validateWithRequest(\n        event: IAppEvent,\n    ) : Promise<OAuth2AuthorizationCodeRequest> {\n        const data = await readFromLocations(event, ['body', 'query']);\n        return this.requestValidator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;AAeA,IAAaK,uBAAb,cAA0CL,oBAAAA;CAC5BM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKE,iBAAiBE,IAAIF;EAC1B,KAAKC,SAASC,IAAID;EAElB,KAAKF,mBAAmB,IAAIN,wCAAAA;CAChC;CAEA,MAAMU,qBAAqBC,OAAuD;EAC9E,MAAMC,uBAAuB,MAAM,KAAKC,oBAAoBF,KAAAA;EAE5D,MAAM,EACFG,MACAC,QACAC,wBACA,MAAM,KAAKX,oBAAoBY,OAAOL,oBAAAA;EAE1C,MAAMM,WAAWhB,yBAAyBS,KAAAA;EAE1C,MAAMQ,SAAS,MAAM,KAAKC,UAAUN,MAAMI,SAASG,KAAK;GACpDC,WAAWnB,oBAAoBQ,KAAAA;GAC/BI;GACAC;EACJ,CAAA;EAOA,IAAI,KAAKT,kBAAkBQ,UAAU,CAACA,OAAOQ,SACzC,IAAI;GACA,MAAM,KAAKhB,eAAeiB,OAAO;IAC7BC,UAAUV,OAAOW;IACjBC,SAASZ,OAAOY;IAChBC,OAAO;KACHC,KAAKX,SAASG,IAAIP,KAAKY;KACvBI,SAASZ,SAASG,IAAIU;IAC1B;IACAC,OAAOlB,KAAKkB,SAAS;GACzB,CAAA;EACJ,SAASC,GAAG;GAER,KAAKzB,QAAQ0B,KAAK,8CAA8C;IAC5DT,UAAUV,OAAOW;IACjBS,OAAOF;GACX,CAAA;EACJ;EAGJ,OAAOd;CACX;;;;;IAOA,MAAMN,oBACFF,OACwC;EACxC,MAAMG,OAAO,MAAMb,kBAAkBU,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAC7D,OAAO,KAAKL,iBAAiB8B,IAAItB,IAAAA;CACrC;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2Authorization","OAuth2AuthorizationCodeRequestValidator","readFromLocations","useRequestIdentityOrFail","useRequestSessionId","HTTPOAuth2Authorizer","codeRequestVerifier","requestValidator","consentService","logger","ctx","authorizeWithRequest","event","codeRequestValidated","validateWithRequest","data","client","redirectUriVerified","verify","identity","result","authorize","raw","sessionId","builtIn","record","clientId","id","realmId","owner","sub","subKind","type","scope","e","warn","error","run"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';\nimport { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations, useRequestIdentityOrFail, useRequestSessionId } from '../../../request/index.ts';\nimport type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';\n\nexport class HTTPOAuth2Authorizer extends OAuth2Authorization {\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected requestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected consentService? : IConsentService;\n\n    protected logger? : Logger;\n\n    constructor(ctx: HTTPOAuth2AuthorizationManagerContext) {\n        super(ctx);\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n        this.consentService = ctx.consentService;\n        this.logger = ctx.logger;\n\n        this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();\n    }\n\n    async authorizeWithRequest(event: IAppEvent) : Promise<OAuth2AuthorizationResult> {\n        const codeRequestValidated = await this.validateWithRequest(event);\n\n        const {\n            data,\n            client,\n            redirectUriVerified,\n        } = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n        const identity = useRequestIdentityOrFail(event);\n\n        const result = await this.authorize(data, identity.raw, {\n            sessionId: useRequestSessionId(event),\n            client,\n            redirectUriVerified,\n        });\n\n        // Persisted per-scope consent (plan 055): recorded only after a\n        // successful approval — an access-policy denial throws inside\n        // authorize() above, so a denied identity never writes a row.\n        // built_in clients keep zero rows (locked); insert-missing makes\n        // re-recording idempotent (union/keep).\n        if (client && this.consentService && !client.builtIn) {\n            try {\n                await this.consentService.record({\n                    clientId: client.id,\n                    realmId: client.realmId,\n                    owner: {\n                        sub: identity.raw.data.id,\n                        subKind: identity.raw.type,\n                    },\n                    scope: data.scope ?? null,\n                });\n            } catch (e) {\n                // never fail an issued code over a consent-write failure\n                this.logger?.warn('Recording the OAuth2 consent grant failed.', {\n                    clientId: client.id,\n                    error: e,\n                });\n            }\n        }\n\n        return result;\n    }\n\n    /**\n     * Validate authorization request.\n     *\n     * @throws OAuth2Error\n     */\n    async validateWithRequest(\n        event: IAppEvent,\n    ) : Promise<OAuth2AuthorizationCodeRequest> {\n        const data = await readFromLocations(event, ['body', 'query']);\n        return this.requestValidator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;AAeA,IAAaK,uBAAb,cAA0CL,oBAAAA;CAC5BM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKE,iBAAiBE,IAAIF;EAC1B,KAAKC,SAASC,IAAID;EAElB,KAAKF,mBAAmB,IAAIN,wCAAAA;CAChC;CAEA,MAAMU,qBAAqBC,OAAuD;EAC9E,MAAMC,uBAAuB,MAAM,KAAKC,oBAAoBF,KAAAA;EAE5D,MAAM,EACFG,MACAC,QACAC,wBACA,MAAM,KAAKX,oBAAoBY,OAAOL,oBAAAA;EAE1C,MAAMM,WAAWhB,yBAAyBS,KAAAA;EAE1C,MAAMQ,SAAS,MAAM,KAAKC,UAAUN,MAAMI,SAASG,KAAK;GACpDC,WAAWnB,oBAAoBQ,KAAAA;GAC/BI;GACAC;EACJ,CAAA;EAOA,IAAID,UAAU,KAAKR,kBAAkB,CAACQ,OAAOQ,SACzC,IAAI;GACA,MAAM,KAAKhB,eAAeiB,OAAO;IAC7BC,UAAUV,OAAOW;IACjBC,SAASZ,OAAOY;IAChBC,OAAO;KACHC,KAAKX,SAASG,IAAIP,KAAKY;KACvBI,SAASZ,SAASG,IAAIU;IAC1B;IACAC,OAAOlB,KAAKkB,SAAS;GACzB,CAAA;EACJ,SAASC,GAAG;GAER,KAAKzB,QAAQ0B,KAAK,8CAA8C;IAC5DT,UAAUV,OAAOW;IACjBS,OAAOF;GACX,CAAA;EACJ;EAGJ,OAAOd;CACX;;;;;IAOA,MAAMN,oBACFF,OACwC;EACxC,MAAMG,OAAO,MAAMb,kBAAkBU,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAC7D,OAAO,KAAKL,iBAAiB8B,IAAItB,IAAAA;CACrC;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh_token.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAA2B,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAGvF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAA4B,MAAM,8BAA8B,CAAC;AACjG,OAAO,KAAK,EACR,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAOnE,qBAAa,2BAA4B,SAAQ,uBAAwB,YAAW,gBAAgB;IAChG,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,oBAAoB,EAAG,oBAAoB,CAAC;IAEtD,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,kCAAkC;IAS7C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAqG5E"}
+{"version":3,"file":"refresh_token.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAA2B,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAQvF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAA4B,MAAM,8BAA8B,CAAC;AACjG,OAAO,KAAK,EACR,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAOnE,qBAAa,2BAA4B,SAAQ,uBAAwB,YAAW,gBAAgB;IAChG,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,oBAAoB,EAAG,oBAAoB,CAAC;IAEtD,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,kCAAkC;IAS7C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAqH5E"}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs

@@ -9,7 +9,7 @@ import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
 import { readRealmHint } from "./utils/realm.mjs";
 import "./utils/index.mjs";
 import { isClientPublic } from "@authup/core-kit";
-import { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from "@authup/specs";
+import { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant, isJWTError } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
 import { readRequestBody } from "@routup/basic/body";
 //#region src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts
@@ -31,7 +31,13 @@ var HTTPOAuth2RefreshTokenGrant = class extends OAuth2RefreshTokenGrant {
 		if (typeof refreshToken !== "string" || refreshToken.length === 0) throw OAuth2RequestError.malformed();
 		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
 		const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);
-		const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });
+		let payload;
+		try {
+			payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });
+		} catch (e) {
+			if (isJWTError(e)) throw OAuth2GrantError.invalid();
+			throw e;
+		}
 		let client;
 		if (clientId) {
 			const realm = await this.realmRepository.resolve(readRealmHint(body), true);

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh_token.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","realmRepository","certificateSource","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","certificateEvidence","payload","verify","skipActiveCheck","client","realm","resolve","authenticate","id","client_id","invalid","undefined","REFRESH_TOKEN","confirmation","cnf","expectedThumbprint","validateCertificateEvidenceForBinding","resolveTokenBinding","realm_id","realmId","runWith","ipAddress","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type Client, isClientPublic } from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    protected realmRepository : IRealmRepository;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n        this.realmRepository = ctx.realmRepository;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const refreshToken = body?.refresh_token;\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        //\n        // skipActiveCheck: the durable auth_session_tokens row (not the cache\n        // blocklist) is the refresh-token authority, so a replayed/consumed\n        // token must reach runWith() to trigger family revocation instead of\n        // being rejected here with JWT_INACTIVE.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });\n\n        let client: Client | undefined;\n\n        if (clientId) {\n            // A client authenticated itself. Resolve by the presented\n            // id/secret (name resolution scoped by the realm hint — resolved\n            // lazily so a bare refresh skips the SELECT) and enforce the\n            // token↔client binding.\n            const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n\n            client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n                certificateEvidence,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (payload.client_id) {\n            // No client credentials were presented, but the token is bound to\n            // a client. RFC 6749 §10.4: a public client cannot authenticate\n            // (no secret) and is not required to — the bound identity is read\n            // from the signed token (client_id is server-minted, so trusted)\n            // and refresh-token rotation/replay detection is the abuse control.\n            // A client with an authentication method MUST still authenticate.\n            // Supplying the server-minted client id lets TLS clients prove\n            // themselves with the request certificate, while a secret client\n            // still fails because its secret is absent.\n            client = await this.clientAuthenticator.authenticate(\n                payload.client_id,\n                undefined,\n                undefined,\n                certificateEvidence,\n            );\n        }\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);\n        }\n\n        let confirmation: OAuth2TokenConfirmation | undefined;\n        if (payload.cnf) {\n            const expectedThumbprint = payload.cnf['x5t#S256'];\n            if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n                throw OAuth2GrantError.invalid();\n            }\n\n            confirmation = this.clientAuthenticator.validateCertificateEvidenceForBinding(\n                certificateEvidence,\n            );\n            if (confirmation['x5t#S256'] !== expectedThumbprint) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (client) {\n            confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n        }\n\n        // Realm parity for PUBLIC clients only: a public client may not refresh\n        // a token whose realm differs from the (bound) client's own realm.\n        // Kills cross-realm refresh tokens minted for a public `web` client\n        // before the authorize-side realm gate existed. Authenticated clients\n        // are exempt — the configured secret/certificate proves identity, and the\n        // documented cross-realm password grant (UUID-identified user against a\n        // master-realm client) depends on that exemption.\n        if (\n            client &&\n            isClientPublic(client) &&\n            payload.realm_id &&\n            payload.realm_id !== client.realmId\n        ) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        return this.runWith(payload, {\n            confirmation,\n            ipAddress: getRequestIP(event) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2BA,IAAaY,8BAAb,cAAiDL,wBAAAA;CACnCM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuBG,IAAIC;EAChC,KAAKH,kBAAkBE,IAAIF;EAC3B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAMG,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMjB,gBAAgBgB,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMtB,mBAAmBuB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMlB,oCAAoCW,KAAAA;EAC7E,MAAMQ,sBAAsB,MAAMlB,uCAAuCU,OAAO,KAAKJ,iBAAiB;EAWtG,MAAMa,UAAU,MAAM,KAAKf,qBAAqBgB,OAAOR,cAAc,EAAES,iBAAiB,KAAK,CAAA;EAE7F,IAAIC;EAEJ,IAAIN,UAAU;GAKV,MAAMO,QAAQ,MAAM,KAAKlB,gBAAgBmB,QAAQvB,cAAcU,IAAAA,GAAO,IAAA;GAEtEW,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCT,UACAC,cACAM,MAAMG,IACNR,mBAAAA;GAGJ,IAAIC,QAAQQ,aAAaR,QAAQQ,cAAcL,OAAOI,IAClD,MAAMnC,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIT,QAAQQ,WAUfL,SAAS,MAAM,KAAKnB,oBAAoBsB,aACpCN,QAAQQ,WACRE,KAAAA,GACAA,KAAAA,GACAX,mBAAAA;EAIR,IAAII,QACAxB,yBAAyBwB,QAAQ7B,iBAAiBqC,aAAa;EAGnE,IAAIC;EACJ,IAAIZ,QAAQa,KAAK;GACb,MAAMC,qBAAqBd,QAAQa,IAAI;GACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBnB,WAAW,GACxE,MAAMvB,iBAAiBqC,QAAO;GAGlCG,eAAe,KAAK5B,oBAAoB+B,sCACpChB,mBAAAA;GAEJ,IAAIa,aAAa,gBAAgBE,oBAC7B,MAAM1C,iBAAiBqC,QAAO;EAEtC,OAAO,IAAIN,QACPS,eAAe,KAAK5B,oBAAoBgC,oBAAoBb,QAAQJ,mBAAAA;EAUxE,IACII,UACAhC,eAAegC,MAAAA,KACfH,QAAQiB,YACRjB,QAAQiB,aAAad,OAAOe,SAE5B,MAAM9C,iBAAiBqC,QAAO;EAGlC,OAAO,KAAKU,QAAQnB,SAAS;GACzBY;GACAQ,WAAW3C,aAAac,KAAAA,KAAUmB,KAAAA;GAClCW,WAAW7C,iBAAiBe,OAAO,YAAA,KAAiBmB,KAAAA;EACxD,CAAA;CACJ;AACJ"}
+{"version":3,"file":"refresh_token.mjs","names":["isClientPublic","OAuth2GrantError","OAuth2RequestError","OAuth2TokenGrant","isJWTError","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","assertClientGrantAllowed","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","readRealmHint","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","realmRepository","certificateSource","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","certificateEvidence","payload","verify","skipActiveCheck","e","invalid","client","realm","resolve","authenticate","id","client_id","undefined","REFRESH_TOKEN","confirmation","cnf","expectedThumbprint","validateCertificateEvidenceForBinding","resolveTokenBinding","realm_id","realmId","runWith","ipAddress","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type Client, isClientPublic } from '@authup/core-kit';\nimport type { OAuth2TokenConfirmation, OAuth2TokenGrantResponse } from '@authup/specs';\nimport {\n    OAuth2GrantError,\n    OAuth2RequestError,\n    OAuth2TokenGrant,\n    isJWTError,\n} from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant, assertClientGrantAllowed } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    IRealmRepository,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    readRealmHint,\n} from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    protected realmRepository : IRealmRepository;\n\n    protected certificateSource: CertificateSource;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n        this.realmRepository = ctx.realmRepository;\n        this.certificateSource = ctx.certificateSource ?? 'disabled';\n    }\n\n    async runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const refreshToken = body?.refresh_token;\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        //\n        // skipActiveCheck: the durable auth_session_tokens row (not the cache\n        // blocklist) is the refresh-token authority, so a replayed/consumed\n        // token must reach runWith() to trigger family revocation instead of\n        // being rejected here with JWT_INACTIVE.\n        let payload : Awaited<ReturnType<typeof this.refreshTokenVerifier.verify>>;\n        try {\n            payload = await this.refreshTokenVerifier.verify(refreshToken, { skipActiveCheck: true });\n        } catch (e) {\n            // RFC 6749 §5.2: a refresh token the endpoint cannot accept is\n            // `invalid_grant` (400). A verification failure raises a JWT\n            // error, which answers 401 on a resource route (RFC 6750 §3.1),\n            // and letting that status escape here would report a bad GRANT\n            // as if the CLIENT had failed to authenticate. The branches\n            // below already answer `invalid_grant` for a token bound to\n            // another client, so this keeps one shape for the parameter.\n            if (isJWTError(e)) {\n                throw OAuth2GrantError.invalid();\n            }\n\n            throw e;\n        }\n\n        let client: Client | undefined;\n\n        if (clientId) {\n            // A client authenticated itself. Resolve by the presented\n            // id/secret (name resolution scoped by the realm hint — resolved\n            // lazily so a bare refresh skips the SELECT) and enforce the\n            // token↔client binding.\n            const realm = await this.realmRepository.resolve(readRealmHint(body), true);\n\n            client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                realm.id,\n                certificateEvidence,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (payload.client_id) {\n            // No client credentials were presented, but the token is bound to\n            // a client. RFC 6749 §10.4: a public client cannot authenticate\n            // (no secret) and is not required to — the bound identity is read\n            // from the signed token (client_id is server-minted, so trusted)\n            // and refresh-token rotation/replay detection is the abuse control.\n            // A client with an authentication method MUST still authenticate.\n            // Supplying the server-minted client id lets TLS clients prove\n            // themselves with the request certificate, while a secret client\n            // still fails because its secret is absent.\n            client = await this.clientAuthenticator.authenticate(\n                payload.client_id,\n                undefined,\n                undefined,\n                certificateEvidence,\n            );\n        }\n\n        if (client) {\n            assertClientGrantAllowed(client, OAuth2TokenGrant.REFRESH_TOKEN);\n        }\n\n        let confirmation: OAuth2TokenConfirmation | undefined;\n        if (payload.cnf) {\n            const expectedThumbprint = payload.cnf['x5t#S256'];\n            if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n                throw OAuth2GrantError.invalid();\n            }\n\n            confirmation = this.clientAuthenticator.validateCertificateEvidenceForBinding(\n                certificateEvidence,\n            );\n            if (confirmation['x5t#S256'] !== expectedThumbprint) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (client) {\n            confirmation = this.clientAuthenticator.resolveTokenBinding(client, certificateEvidence);\n        }\n\n        // Realm parity for PUBLIC clients only: a public client may not refresh\n        // a token whose realm differs from the (bound) client's own realm.\n        // Kills cross-realm refresh tokens minted for a public `web` client\n        // before the authorize-side realm gate existed. Authenticated clients\n        // are exempt — the configured secret/certificate proves identity, and the\n        // documented cross-realm password grant (UUID-identified user against a\n        // master-realm client) depends on that exemption.\n        if (\n            client &&\n            isClientPublic(client) &&\n            payload.realm_id &&\n            payload.realm_id !== client.realmId\n        ) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        return this.runWith(payload, {\n            confirmation,\n            ipAddress: getRequestIP(event) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgCA,IAAaa,8BAAb,cAAiDL,wBAAAA;CACnCM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuBG,IAAIC;EAChC,KAAKH,kBAAkBE,IAAIF;EAC3B,KAAKC,oBAAoBC,IAAID,qBAAqB;CACtD;CAEA,MAAMG,eAAeC,OAAqD;EACtE,MAAMC,OAAO,MAAMjB,gBAAgBgB,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMvB,mBAAmBwB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMlB,oCAAoCW,KAAAA;EAC7E,MAAMQ,sBAAsB,MAAMlB,uCAAuCU,OAAO,KAAKJ,iBAAiB;EAWtG,IAAIa;EACJ,IAAI;GACAA,UAAU,MAAM,KAAKf,qBAAqBgB,OAAOR,cAAc,EAAES,iBAAiB,KAAK,CAAA;EAC3F,SAASC,GAAG;GAQR,IAAI7B,WAAW6B,CAAAA,GACX,MAAMhC,iBAAiBiC,QAAO;GAGlC,MAAMD;EACV;EAEA,IAAIE;EAEJ,IAAIR,UAAU;GAKV,MAAMS,QAAQ,MAAM,KAAKpB,gBAAgBqB,QAAQzB,cAAcU,IAAAA,GAAO,IAAA;GAEtEa,SAAS,MAAM,KAAKrB,oBAAoBwB,aACpCX,UACAC,cACAQ,MAAMG,IACNV,mBAAAA;GAGJ,IAAIC,QAAQU,aAAaV,QAAQU,cAAcL,OAAOI,IAClD,MAAMtC,iBAAiBiC,QAAO;EAEtC,OAAO,IAAIJ,QAAQU,WAUfL,SAAS,MAAM,KAAKrB,oBAAoBwB,aACpCR,QAAQU,WACRC,KAAAA,GACAA,KAAAA,GACAZ,mBAAAA;EAIR,IAAIM,QACA1B,yBAAyB0B,QAAQhC,iBAAiBuC,aAAa;EAGnE,IAAIC;EACJ,IAAIb,QAAQc,KAAK;GACb,MAAMC,qBAAqBf,QAAQc,IAAI;GACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBpB,WAAW,GACxE,MAAMxB,iBAAiBiC,QAAO;GAGlCS,eAAe,KAAK7B,oBAAoBgC,sCACpCjB,mBAAAA;GAEJ,IAAIc,aAAa,gBAAgBE,oBAC7B,MAAM5C,iBAAiBiC,QAAO;EAEtC,OAAO,IAAIC,QACPQ,eAAe,KAAK7B,oBAAoBiC,oBAAoBZ,QAAQN,mBAAAA;EAUxE,IACIM,UACAnC,eAAemC,MAAAA,KACfL,QAAQkB,YACRlB,QAAQkB,aAAab,OAAOc,SAE5B,MAAMhD,iBAAiBiC,QAAO;EAGlC,OAAO,KAAKgB,QAAQpB,SAAS;GACzBa;GACAQ,WAAW5C,aAAac,KAAAA,KAAUoB,KAAAA;GAClCW,WAAW9C,iBAAiBe,OAAO,YAAA,KAAiBoB,KAAAA;EACxD,CAAA;CACJ;AACJ"}

package/dist/adapters/http/constants.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The path segments the served consoles live under. Each is spelled ONCE:
+ * the controller mount, the login cookie scope, the callback URL, the asset
+ * mount and the shell's rebased vite base all derive from it, so a move
+ * cannot drift the login flow away from the page. The vite `base` in each
+ * console workspace is a hand-synced literal (a vite config cannot import a
+ * server constant); the page specs catch a bundle built against another.
+ */
+export declare const ADMIN_CONSOLE_SEGMENT = "console/admin";
+export declare const ACCOUNT_CONSOLE_SEGMENT = "console/account";
+/**
+ * The auth console's namespace, under which ONLY its assets are mounted
+ * (`<segment>/assets`, the same shape as the two static consoles). Its
+ * PAGES stay on their protocol routes (`/authorize`, `/logout`, the
+ * workflow paths), so `/console/auth` itself serves nothing.
+ */
+export declare const AUTH_CONSOLE_SEGMENT = "console/auth";
+//# sourceMappingURL=constants.d.ts.map

package/dist/adapters/http/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/adapters/http/constants.ts"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,iBAAiB,CAAC"}

package/dist/adapters/http/constants.mjs

@@ -0,0 +1,23 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/constants.ts
+/**
+* The path segments the served consoles live under. Each is spelled ONCE:
+* the controller mount, the login cookie scope, the callback URL, the asset
+* mount and the shell's rebased vite base all derive from it, so a move
+* cannot drift the login flow away from the page. The vite `base` in each
+* console workspace is a hand-synced literal (a vite config cannot import a
+* server constant); the page specs catch a bundle built against another.
+*/ const ADMIN_CONSOLE_SEGMENT = "console/admin";
+const ACCOUNT_CONSOLE_SEGMENT = "console/account";
+/**
+* The auth console's namespace, under which ONLY its assets are mounted
+* (`<segment>/assets`, the same shape as the two static consoles). Its
+* PAGES stay on their protocol routes (`/authorize`, `/logout`, the
+* workflow paths), so `/console/auth` itself serves nothing.
+*/ const AUTH_CONSOLE_SEGMENT = "console/auth";
+//#endregion
+export { ACCOUNT_CONSOLE_SEGMENT, ADMIN_CONSOLE_SEGMENT, AUTH_CONSOLE_SEGMENT };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/adapters/http/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["ADMIN_CONSOLE_SEGMENT","ACCOUNT_CONSOLE_SEGMENT","AUTH_CONSOLE_SEGMENT"],"sources":["../../../src/adapters/http/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * The path segments the served consoles live under. Each is spelled ONCE:\n * the controller mount, the login cookie scope, the callback URL, the asset\n * mount and the shell's rebased vite base all derive from it, so a move\n * cannot drift the login flow away from the page. The vite `base` in each\n * console workspace is a hand-synced literal (a vite config cannot import a\n * server constant); the page specs catch a bundle built against another.\n */\nexport const ADMIN_CONSOLE_SEGMENT = 'console/admin';\n\nexport const ACCOUNT_CONSOLE_SEGMENT = 'console/account';\n\n/**\n * The auth console's namespace, under which ONLY its assets are mounted\n * (`<segment>/assets`, the same shape as the two static consoles). Its\n * PAGES stay on their protocol routes (`/authorize`, `/logout`, the\n * workflow paths), so `/console/auth` itself serves nothing.\n */\nexport const AUTH_CONSOLE_SEGMENT = 'console/auth';\n"],"mappings":";;;;;;;;;;;GAeA,MAAaA,wBAAwB;AAErC,MAAaC,0BAA0B;;;;;;GAQvC,MAAaC,uBAAuB"}

package/dist/adapters/http/controllers/entities/client/module.mjs

@@ -3,9 +3,9 @@ import "node:url";
 import.meta.url;
 import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "../../../../../core/query/describe.mjs";
 import { clientSchema } from "../../../../../core/entities/client/schema.mjs";
-import { OAuth2ScopeAttributesResolver } from "../../../../../core/oauth2/scope/resolver.mjs";
 import { isSelfToken } from "../../../../../utils/self-id.mjs";
 import "../../../../../utils/index.mjs";
+import { OAuth2ScopeAttributesResolver } from "../../../../../core/oauth2/scope/resolver.mjs";
 import "../../../../../core/index.mjs";
 import { useRequestIdentity } from "../../../request/helpers/identity.mjs";
 import { buildActorContext } from "../../../request/helpers/actor.mjs";

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts

@@ -1,6 +1,7 @@
 import type { IAppEvent } from 'routup';
 import type { IdentityProvider, IdentityProviderAccount } from '@authup/core-kit';
 import type { Logger } from '@authup/server-kit';
+import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { EntityCollectionResponse, EntityRecordResponse, IdentityProviderCreatePayload, IdentityProviderLinkConfirmPayload, IdentityProviderLinkRequestResponse, IdentityProviderSavePayload, IdentityProviderUpdatePayload } from '@authup/core-http-kit';
 import type { IEventService, IIdentityProviderAccountLinkStore, IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IOAuth2FederatedLoginService } from '../../../../../core/index.ts';
 import { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';
@@ -25,7 +26,8 @@ export declare class IdentityProviderController {
     addProvider(user: IdentityProviderCreatePayload, event: IAppEvent): Promise<EntityRecordResponse<IdentityProvider>>;
     authorizeOut(_id: string, event: IAppEvent): Promise<Response>;
     linkRequest(_id: string, event: IAppEvent): Promise<IdentityProviderLinkRequestResponse>;
-    authorizeIn(_id: string, event: IAppEvent): Promise<string | Response>;
+    authorizeIn(_id: string, event: IAppEvent): Promise<Response>;
+    completeLogin(_id: string, event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
     private write;
     /**
      * Callback half of the account-linking round-trip (plan 091): the
@@ -43,6 +45,26 @@ export declare class IdentityProviderController {
     private buildHostedAuthorizeURL;
     private resolve;
     private buildProviderAuthenticator;
+    /**
+     * Scoped to the routes that read it, so the cookie never rides an
+     * ordinary API request, and to publicUrl's base path, since a sub-path
+     * deployment mounts every route under it.
+     */
+    private buildFederatedLoginCookiePath;
+    private setFederatedLoginCookie;
+    /**
+     * The completion answers with a token pair and authenticates on a cookie
+     * alone, so it must be reachable only from the hosted page's own origin.
+     *
+     * CORS cannot carry that here: the default reflects every origin WITH
+     * credentials, and `SameSite` is scoped to the registrable domain rather
+     * than the origin, so a sibling subdomain's script is same-site and would
+     * both send the cookie and be allowed to read the response. A browser
+     * sends `Origin` on every POST, so requiring it to be publicUrl's own is
+     * what closes that. A request without the header is not a browser and
+     * carries no cookie of ours to begin with.
+     */
+    private assertSameOrigin;
     private saveAuthorizationState;
     private verifyAuthorizationState;
 }

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EACR,gBAAgB,EAChB,uBAAuB,EAI1B,MAAM,kBAAkB,CAAC;AAc1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAKjD,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,aAAa,EACb,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,uCAAuC,EACvC,gCAAgC,EAChC,4BAA4B,EAI/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAM1C,MAAM,8BAA8B,CAAC;AAetC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,SAAS,EAAE,iCAAiC,CAAC;IAEvD,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,YAAY,EAAG,4BAA4B,CAAC;IAEtD,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAIf,GAAG,EAAE,iCAAiC;IAgB5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IAuChD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA0B5C,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA6B7C,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAO7C,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAoD1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,mCAAmC,CAAC;IA6B1C,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;YA4GlB,KAAK;IA+FnB;;;;;OAKG;YACW,YAAY;IAyE1B;;;OAGG;IAEG,WAAW,CACA,GAAG,EAAE,MAAM,EACf,KAAK,EAAE,kCAAkC,EACtC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;IA2E1D,OAAO,CAAC,qBAAqB;IAgB7B,OAAO,CAAC,uBAAuB;YAmBjB,OAAO;IAYrB,OAAO,CAAC,0BAA0B;YAepB,sBAAsB;YAWtB,wBAAwB;CAWzC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EACR,gBAAgB,EAChB,uBAAuB,EAI1B,MAAM,kBAAkB,CAAC;AAa1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAKjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EACR,aAAa,EACb,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,uCAAuC,EACvC,gCAAgC,EAChC,4BAA4B,EAI/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGH,uCAAuC,EAM1C,MAAM,8BAA8B,CAAC;AAatC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,SAAS,EAAE,iCAAiC,CAAC;IAEvD,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,YAAY,EAAG,4BAA4B,CAAC;IAEtD,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAIf,GAAG,EAAE,iCAAiC;IAqB5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IAqBhD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAyB5C,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA6B7C,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAO7C,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAgE1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,mCAAmC,CAAC;IA6B1C,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAwG1B,aAAa,CACF,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,wBAAwB,CAAC;YA8BvB,KAAK;IA2GnB;;;;;OAKG;YACW,YAAY;IAyE1B;;;OAGG;IAEG,WAAW,CACA,GAAG,EAAE,MAAM,EACf,KAAK,EAAE,kCAAkC,EACtC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;IA2E1D,OAAO,CAAC,qBAAqB;IAgB7B,OAAO,CAAC,uBAAuB;YAmBjB,OAAO;IAYrB,OAAO,CAAC,0BAA0B;IAelC;;;;OAIG;IACH,OAAO,CAAC,6BAA6B;IAIrC,OAAO,CAAC,uBAAuB;IAc/B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,gBAAgB;YAWV,sBAAsB;YAWtB,wBAAwB;CAWzC"}

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs

@@ -5,10 +5,11 @@ import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "../../../../../cor
 import { identityProviderSchema } from "../../../../../core/entities/identity-provider/schema.mjs";
 import { decodeQuery } from "../../../../../core/query/module.mjs";
 import { OAuth2AuthorizationCodeRequestValidator } from "../../../../../core/oauth2/authorization/code-request/validator.mjs";
-import { createIdentityProviderOAuth2Authenticator } from "../../../../../core/identity/provider/authentication/factory.mjs";
 import { describeError } from "../../../../../utils/error.mjs";
 import { resolveURL } from "../../../../../utils/url.mjs";
 import "../../../../../utils/index.mjs";
+import { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL } from "../../../../../core/oauth2/federated-login/constants.mjs";
+import { createIdentityProviderOAuth2Authenticator } from "../../../../../core/identity/provider/authentication/factory.mjs";
 import "../../../../../core/index.mjs";
 import { useRequestPermissionEvaluator } from "../../../request/permission/helper.mjs";
 import { useRequestIdentityOrFail } from "../../../request/helpers/identity.mjs";
@@ -19,18 +20,18 @@ import { applyRouteRealmIDToBody, getRequestRealmID } from "../../../request/hel
 import { useRequestEventContext } from "../../../request/event-context.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
-import { renderAuthConsolePage } from "../../../ui/auth-console/module.mjs";
 import "../../../middleware/index.mjs";
-import "../../../ui/index.mjs";
-import { ValidatorGroup, base64URLDecode, isObject, isUUID } from "@authup/kit";
-import { EventName, EventRefType, EventScope, IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, buildIdentityProviderAuthorizeCallbackPath, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from "@authup/core-kit";
+import { ValidatorGroup, base64URLDecode, createNanoID, getURLBasePath, isObject, isUUID } from "@authup/kit";
+import { EventName, EventRefType, EventScope, IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from "@authup/core-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 import { OAuth2RequestError } from "@authup/specs";
 import { URL } from "node:url";
 import { getRequestHeader, getRequestIP, sendRedirect } from "routup";
+import { setResponseCookie, unsetResponseCookie, useRequestCookie } from "@routup/basic/cookie";
 import { readRequestBody } from "@routup/basic/body";
 import { useRequestQuery } from "@routup/basic/query";
+import { IDENTITY_PROVIDER_LOGIN_NOT_PENDING } from "@authup/core-http-kit";
 import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/identity-provider/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -75,19 +76,6 @@ var IdentityProviderController = class {
 			schema: identityProviderSchema,
 			actor: buildActorContext(event)
 		}));
-		try {
-			const permissionEvaluator = useRequestPermissionEvaluator(event);
-			await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });
-			for (const datum of data) try {
-				await permissionEvaluator.evaluate({
-					name: PermissionName.IDENTITY_PROVIDER_READ,
-					data: definePolicyData({
-						[BuiltInPolicyType.ATTRIBUTES]: datum,
-						[BuiltInPolicyType.REALM_MATCH]: datum.realmId ?? null
-					})
-				});
-			} catch {}
-		} catch {}
 		return {
 			data,
 			meta: {
@@ -100,15 +88,17 @@ var IdentityProviderController = class {
 		const paramId = useRequestParamID(event, { isUUID: false });
 		const entity = await this.repository.findOneByIdOrName(paramId, getRequestRealmID(event));
 		if (!entity) throw new EntityNotFoundError();
-		try {
-			await useRequestPermissionEvaluator(event).evaluate({
-				name: PermissionName.IDENTITY_PROVIDER_READ,
-				data: definePolicyData({
-					[BuiltInPolicyType.ATTRIBUTES]: entity,
-					[BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null
-				})
-			});
-		} catch {}
+		await useRequestPermissionEvaluator(event).evaluateOneOf({
+			name: [
+				PermissionName.IDENTITY_PROVIDER_READ,
+				PermissionName.IDENTITY_PROVIDER_UPDATE,
+				PermissionName.IDENTITY_PROVIDER_DELETE
+			],
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				[BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null
+			})
+		});
 		return {
 			data: entity,
 			meta: { schema: describeQuerySchema(identityProviderSchema, RECORD_QUERY_PARAMETERS) }
@@ -162,7 +152,12 @@ var IdentityProviderController = class {
 		const data = await this.codeRequestVerifier.verify(codeRequestValidated);
 		if (data.client.realmId && entity.realmId && entity.realmId !== data.client.realmId) throw OAuth2RequestError.malformed("The provider and client realm do not match.");
 		const authenticator = this.buildProviderAuthenticator(entity);
-		const state = await this.saveAuthorizationState(event, { codeRequest: data.data });
+		const browserNonce = createNanoID();
+		this.setFederatedLoginCookie(event, browserNonce);
+		const state = await this.saveAuthorizationState(event, {
+			codeRequest: data.data,
+			browserNonce
+		});
 		return sendRedirect(event, authenticator.buildRedirectURL({ state }));
 	}
 	async linkRequest(_id, event) {
@@ -188,6 +183,8 @@ var IdentityProviderController = class {
 		const { link } = data;
 		if (link) return this.completeLink(event, entity, data, link);
 		if (!data.codeRequest) throw OAuth2RequestError.malformed("The state carries no authorization code request.");
+		const browserNonce = useRequestCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE);
+		if (typeof browserNonce !== "string" || !data.browserNonce || browserNonce !== data.browserNonce) return sendRedirect(event, this.buildHostedAuthorizeURL(data.codeRequest).href);
 		const { code, error } = useRequestQuery(event);
 		if (typeof error === "string" && error.length > 0) {
 			this.logger?.info(`The identity provider ${entity.id} answered the authorization with ${JSON.stringify(error.slice(0, 64))}.`);
@@ -203,26 +200,27 @@ var IdentityProviderController = class {
 				userAgent: getRequestHeader(event, "user-agent")
 			}
 		});
+		const url = this.buildHostedAuthorizeURL(result.codeRequest);
 		if (result.kind === "refused") {
-			const url = this.buildHostedAuthorizeURL(result.codeRequest);
 			if (result.error) url.searchParams.set("error", result.error);
 			return sendRedirect(event, url.href);
 		}
-		const url = new URL(result.redirectUri);
-		url.searchParams.set("code", result.code);
-		if (result.state) url.searchParams.set("state", result.state);
-		if (url.protocol === "http:" || url.protocol === "https:") return sendRedirect(event, url.href);
-		const payload = {
-			redirect: url.href,
-			authorizeUrl: this.buildHostedAuthorizeURL(result.codeRequest).href,
-			client: result.client
-		};
-		return renderAuthConsolePage(event, {
-			url: buildIdentityProviderAuthorizeCallbackPath(entity.id),
-			payload: {
-				config: { baseURL: this.options.baseURL },
-				data: payload
-			}
+		this.setFederatedLoginCookie(event, result.pendingLoginId);
+		url.searchParams.set("provider", entity.id);
+		return sendRedirect(event, url.href);
+	}
+	async completeLogin(_id, event) {
+		const id = useRequestParamID(event);
+		this.assertSameOrigin(event);
+		const pendingLoginId = useRequestCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE);
+		if (typeof pendingLoginId !== "string" || pendingLoginId.length === 0) throw new BadRequestError({
+			message: "The login request is unknown or expired.",
+			data: { reason: IDENTITY_PROVIDER_LOGIN_NOT_PENDING }
+		});
+		unsetResponseCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE, { path: this.buildFederatedLoginCookiePath() });
+		return this.loginService.completeHandoff({
+			pendingLoginId,
+			providerId: id
 		});
 	}
 	async write(event, options = {}) {
@@ -273,8 +271,9 @@ var IdentityProviderController = class {
 		}
 		await this.repository.checkUniqueness(data, entity || void 0);
 		if (entity) {
+			const keepAll = entity.protocol === data.protocol;
 			entity = this.repository.merge(entity, data);
-			await this.repository.saveWithEA(entity, attributes);
+			await this.repository.saveWithEA(entity, attributes, { keepAll });
 			event.response.status = 202;
 			return {
 				data: entity,
@@ -295,7 +294,7 @@ var IdentityProviderController = class {
 	* running the login path. No auth code and no session is minted; the
 	* browser lands back on the account console with a marker param.
 	*/ async completeLink(event, provider, state, link) {
-		const url = new URL(resolveURL(this.options.baseURL, "account/connected-accounts"));
+		const url = new URL(resolveURL(this.options.accountConsoleUrl, "connected-accounts"));
 		const { code } = useRequestQuery(event);
 		try {
 			if (link.providerId !== provider.id || !provider.enabled) throw new BadRequestError("The identity provider is not available for account linking.");
@@ -398,6 +397,38 @@ var IdentityProviderController = class {
 			}
 		});
 	}
+	/**
+	* Scoped to the routes that read it, so the cookie never rides an
+	* ordinary API request, and to publicUrl's base path, since a sub-path
+	* deployment mounts every route under it.
+	*/ buildFederatedLoginCookiePath() {
+		return `${getURLBasePath(this.options.baseURL)}/identity-providers`;
+	}
+	setFederatedLoginCookie(event, value) {
+		setResponseCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE, value, {
+			httpOnly: true,
+			sameSite: "lax",
+			secure: new URL(this.options.baseURL).protocol === "https:",
+			path: this.buildFederatedLoginCookiePath(),
+			maxAge: OAUTH2_FEDERATED_LOGIN_TTL / 1e3
+		});
+	}
+	/**
+	* The completion answers with a token pair and authenticates on a cookie
+	* alone, so it must be reachable only from the hosted page's own origin.
+	*
+	* CORS cannot carry that here: the default reflects every origin WITH
+	* credentials, and `SameSite` is scoped to the registrable domain rather
+	* than the origin, so a sibling subdomain's script is same-site and would
+	* both send the cookie and be allowed to read the response. A browser
+	* sends `Origin` on every POST, so requiring it to be publicUrl's own is
+	* what closes that. A request without the header is not a browser and
+	* carries no cookie of ours to begin with.
+	*/ assertSameOrigin(event) {
+		const origin = getRequestHeader(event, "origin");
+		if (typeof origin !== "string" || origin.length === 0) return;
+		if (origin !== new URL(this.options.baseURL).origin) throw new BadRequestError("The login request is unknown or expired.");
+	}
 	async saveAuthorizationState(event, data = {}) {
 		return this.stateManager.save({
 			...data,
@@ -422,7 +453,7 @@ _ts_decorate([
 	_ts_metadata("design:returntype", Promise)
 ], IdentityProviderController.prototype, "getProviders", null);
 _ts_decorate([
-	DGet("/:id", []),
+	DGet("/:id", [ForceLoggedInMiddleware]),
 	_ts_param(0, DPath("id")),
 	_ts_param(1, DContext()),
 	_ts_metadata("design:type", Function),
@@ -495,6 +526,14 @@ _ts_decorate([
 	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
 	_ts_metadata("design:returntype", Promise)
 ], IdentityProviderController.prototype, "authorizeIn", null);
+_ts_decorate([
+	DPost("/:id/login-complete", []),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], IdentityProviderController.prototype, "completeLogin", null);
 _ts_decorate([
 	DPost("/:id/link-confirm", [ForceLoggedInMiddleware]),
 	_ts_param(0, DPath("id")),