@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs

@@ -6,9 +6,11 @@ import { useRequestLocale } from "../../../request/helpers/locale.mjs";
 import { useRequestMfaLoginTicket } from "../../../request/helpers/mfa-login-ticket.mjs";
 import { useRequestSessionId } from "../../../request/helpers/session-id.mjs";
 import "../../../request/index.mjs";
-import { IdentityType, UserAuthenticatorKind } from "@authup/core-kit";
+import { IdentityType, SessionAuthMethod, UserAuthenticatorKind } from "@authup/core-kit";
 import { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from "@authup/errors";
+import { OAuth2AuthenticationContextClass } from "@authup/specs";
 import { getRequestHeader, getRequestIP } from "routup";
+import { useRequestQuery } from "@routup/basic/query";
 import { DBody, DContext, DController, DGet, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/authenticator-challenge/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -53,13 +55,29 @@ var AuthenticatorChallengeController = class {
 		throw new UnauthorizedError();
 	}
 	async status(event) {
-		const { identity } = this.resolveActor(event);
+		const { identity, ticket } = this.resolveActor(event);
 		if (identity.type !== IdentityType.USER) return {
 			required: false,
 			enrollmentRequired: false,
 			kinds: []
 		};
-		return this.service.challenge(identity.id);
+		const status = await this.service.challenge(identity.id);
+		const session = ticket ? null : await this.resolveSession(event);
+		if (session && session.authMethod === SessionAuthMethod.EXTERNAL) {
+			const { acrValues } = useRequestQuery(event);
+			const stepUpRequested = typeof acrValues === "string" && acrValues.split(" ").includes(OAuth2AuthenticationContextClass.MFA);
+			return {
+				...status,
+				required: stepUpRequested && status.required,
+				enrollmentRequired: false
+			};
+		}
+		return status;
+	}
+	async resolveSession(event) {
+		const sessionId = useRequestSessionId(event);
+		if (!sessionId) return null;
+		return this.sessionManager.findOneById(sessionId);
 	}
 	async send(data, event) {
 		const { identity } = this.resolveActor(event);

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","DTags","IdentityType","UserAuthenticatorKind","BadRequestError","EntityCredentialsInvalidError","UnauthorizedError","getRequestHeader","getRequestIP","useRequestIdentity","useRequestLocale","useRequestMfaLoginTicket","useRequestSessionId","AuthenticatorChallengeController","service","sessionManager","mfaLoginService","ctx","resolveActor","event","identity","ticket","status","type","USER","required","enrollmentRequired","kinds","challenge","id","send","data","Object","values","includes","kind","sendChallenge","locale","success","verify","response","sessionId","payload","session_id","session","findOneById","verified","ipAddress","userAgent","clientId","onVerified","markMfaVerified","token","complete","userName","name"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport { IdentityType, UserAuthenticatorKind } from '@authup/core-kit';\nimport { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    UserAuthenticatorChallengeResponse,\n    UserAuthenticatorChallengeSendPayload,\n    UserAuthenticatorChallengeVerifyPayload,\n    UserAuthenticatorChallengeVerifyResponse,\n} from '@authup/core-http-kit';\nimport type { IOAuth2MfaLoginService, ISessionManager, IUserAuthenticatorService } from '../../../../../core/index.ts';\nimport type { RequestIdentity, RequestMfaLoginTicket } from '../../../request/index.ts';\nimport {\n    useRequestIdentity,\n    useRequestLocale,\n    useRequestMfaLoginTicket,\n    useRequestSessionId,\n} from '../../../request/index.ts';\n\nexport type AuthenticatorChallengeControllerContext = {\n    service: IUserAuthenticatorService,\n    sessionManager: ISessionManager,\n    mfaLoginService?: IOAuth2MfaLoginService,\n};\n\ntype ChallengeActor = {\n    identity: RequestIdentity,\n    ticket: RequestMfaLoginTicket | null,\n};\n\n/**\n * Login-time challenge surface, scoped to the CURRENT bearer identity.\n * GET reports whether (and how) the caller must present a second factor;\n * POST verifies a factor and stamps mfa_at onto the backing session so\n * the /authorize backstop passes.\n *\n * Besides a regular access bearer, these routes accept the \"MFA-pending\"\n * login ticket (kind: mfa_token, issue #3242) the password grant issues\n * for factor kinds that cannot ride the single grant POST (email /\n * WebAuthn). A ticket-authenticated verify additionally completes the\n * login: the response carries the full token grant for the now-MFA'd\n * pending session.\n */\n@DTags('userAuthenticator')\n@DController('/authenticators/challenge')\nexport class AuthenticatorChallengeController {\n    protected service: IUserAuthenticatorService;\n\n    protected sessionManager: ISessionManager;\n\n    protected mfaLoginService?: IOAuth2MfaLoginService;\n\n    constructor(ctx: AuthenticatorChallengeControllerContext) {\n        this.service = ctx.service;\n        this.sessionManager = ctx.sessionManager;\n        this.mfaLoginService = ctx.mfaLoginService;\n    }\n\n    /**\n     * Resolve the acting subject: the regular request identity (access\n     * bearer — the middleware never sets it for a ticket) or the stashed\n     * MFA-pending ticket. Anything else is unauthorized — the previous\n     * ForceLoggedInMiddleware contract, widened by exactly one bearer kind.\n     */\n    protected resolveActor(event: IAppEvent) : ChallengeActor {\n        const identity = useRequestIdentity(event);\n        if (identity) {\n            return { identity, ticket: null };\n        }\n\n        const ticket = useRequestMfaLoginTicket(event);\n        if (ticket) {\n            return { identity: ticket.identity, ticket };\n        }\n\n        throw new UnauthorizedError();\n    }\n\n    @DGet('')\n    async status(\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeResponse> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            return {\n                required: false,\n                enrollmentRequired: false,\n                kinds: [],\n            };\n        }\n\n        return this.service.challenge(identity.id);\n    }\n\n    @DPost('/send')\n    async send(\n        @DBody() data: UserAuthenticatorChallengeSendPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<{ success: true }> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can request a challenge.');\n        }\n\n        if (\n            !data ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind must be provided.');\n        }\n\n        await this.service.sendChallenge(identity.id, data.kind, { locale: useRequestLocale(event) });\n\n        // uniform 200 regardless of whether a code was actually mailed —\n        // no enrollment-status oracle for the caller.\n        return { success: true };\n    }\n\n    @DPost('')\n    async verify(\n        @DBody() data: UserAuthenticatorChallengeVerifyPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeVerifyResponse> {\n        const { identity, ticket } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can complete a challenge.');\n        }\n\n        if (\n            !data ||\n            typeof data.response !== 'string' ||\n            !data.response ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind and response must be provided.');\n        }\n\n        // Bind the proof to the backing session — the /authorize backstop\n        // reads session.mfa_at. The session id is server-derived (stashed\n        // by the authorization middleware / carried by the verified ticket),\n        // never client input. The stamp runs INSIDE the verify unit of work\n        // (before the code consumption persists), so a stamp failure never\n        // burns a single-use code.\n        const sessionId = ticket ?\n            ticket.payload.session_id :\n            useRequestSessionId(event);\n        const session = sessionId ?\n            await this.sessionManager.findOneById(sessionId) :\n            null;\n\n        // a ticket references exactly one pending session — without it\n        // (swept / expired mid-flight) the login can not complete.\n        if (ticket && !session) {\n            throw new UnauthorizedError();\n        }\n\n        const verified = await this.service.verify(\n            identity.id,\n            {\n                kind: data.kind,\n                response: data.response,\n            },\n            {\n                ipAddress: getRequestIP(event) ?? null,\n                userAgent: getRequestHeader(event, 'user-agent') ?? null,\n                clientId: identity.clientId,\n                sessionId: sessionId ?? null,\n                ...(session ? {\n                    onVerified: async () => {\n                        await this.sessionManager.markMfaVerified(session);\n                    },\n                } : {}),\n            },\n        );\n        if (!verified) {\n            throw new EntityCredentialsInvalidError();\n        }\n\n        // Ticket flow: the factor is verified and mfa_at stamped — complete\n        // the login by minting the full grant for the pending session and\n        // consuming the ticket (single use).\n        if (ticket && session && this.mfaLoginService) {\n            const token = await this.mfaLoginService.complete({\n                session,\n                ticket: ticket.payload,\n                userName: identity.data.name,\n            });\n\n            return { verified: true, token };\n        }\n\n        return { verified: true };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,IAAaiB,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8C;EACtD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;IAQA,aAAuBG,OAAmC;EACtD,MAAMC,WAAWX,mBAAmBU,KAAAA;EACpC,IAAIC,UACA,OAAO;GAAEA;GAAUC,QAAQ;EAAK;EAGpC,MAAMA,SAASV,yBAAyBQ,KAAAA;EACxC,IAAIE,QACA,OAAO;GAAED,UAAUC,OAAOD;GAAUC;EAAO;EAG/C,MAAM,IAAIf,kBAAAA;CACd;CAEA,MACMgB,OACF,OAC2C;EAC3C,MAAM,EAAEF,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,OAAO;GACHC,UAAU;GACVC,oBAAoB;GACpBC,OAAO,CAAA;EACX;EAGJ,OAAO,KAAKb,QAAQc,UAAUR,SAASS,EAAE;CAC7C;CAEA,MACMC,KACF,MACA,OAC0B;EAC1B,MAAM,EAAEV,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,+CAAA;EAG9B,IACI,CAAC2B,QACD,CAACC,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,0BAAA;EAG9B,MAAM,KAAKU,QAAQsB,cAAchB,SAASS,IAAIE,KAAKI,MAAM,EAAEE,QAAQ3B,iBAAiBS,KAAAA,EAAO,CAAA;EAI3F,OAAO,EAAEmB,SAAS,KAAK;CAC3B;CAEA,MACMC,OACF,MACA,OACiD;EACjD,MAAM,EAAEnB,UAAUC,WAAW,KAAKH,aAAaC,KAAAA;EAC/C,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,gDAAA;EAG9B,IACI,CAAC2B,QACD,OAAOA,KAAKS,aAAa,YACzB,CAACT,KAAKS,YACN,CAACR,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,uCAAA;EAS9B,MAAMqC,YAAYpB,SACdA,OAAOqB,QAAQC,aACf/B,oBAAoBO,KAAAA;EACxB,MAAMyB,UAAUH,YACZ,MAAM,KAAK1B,eAAe8B,YAAYJ,SAAAA,IACtC;EAIJ,IAAIpB,UAAU,CAACuB,SACX,MAAM,IAAItC,kBAAAA;EAqBd,IAAI,CAACwC,MAlBkB,KAAKhC,QAAQyB,OAChCnB,SAASS,IACT;GACIM,MAAMJ,KAAKI;GACXK,UAAUT,KAAKS;EACnB,GACA;GACIO,WAAWvC,aAAaW,KAAAA,KAAU;GAClC6B,WAAWzC,iBAAiBY,OAAO,YAAA,KAAiB;GACpD8B,UAAU7B,SAAS6B;GACnBR,WAAWA,aAAa;GACxB,GAAIG,UAAU,EACVM,YAAY,YAAA;IACR,MAAM,KAAKnC,eAAeoC,gBAAgBP,OAAAA;GAC9C,EACJ,IAAI,CAAC;EACT,CAAA,GAGA,MAAM,IAAIvC,8BAAAA;EAMd,IAAIgB,UAAUuB,WAAW,KAAK5B,iBAO1B,OAAO;GAAE8B,UAAU;GAAMM,OAAAA,MANL,KAAKpC,gBAAgBqC,SAAS;IAC9CT;IACAvB,QAAQA,OAAOqB;IACfY,UAAUlC,SAASW,KAAKwB;GAC5B,CAAA;EAE+B;EAGnC,OAAO,EAAET,UAAU,KAAK;CAC5B;AACJ"}
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","DTags","IdentityType","SessionAuthMethod","UserAuthenticatorKind","OAuth2AuthenticationContextClass","useRequestQuery","BadRequestError","EntityCredentialsInvalidError","UnauthorizedError","getRequestHeader","getRequestIP","useRequestIdentity","useRequestLocale","useRequestMfaLoginTicket","useRequestSessionId","AuthenticatorChallengeController","service","sessionManager","mfaLoginService","ctx","resolveActor","event","identity","ticket","status","type","USER","required","enrollmentRequired","kinds","challenge","id","session","resolveSession","authMethod","EXTERNAL","acrValues","stepUpRequested","split","includes","MFA","sessionId","findOneById","send","data","Object","values","kind","sendChallenge","locale","success","verify","response","payload","session_id","verified","ipAddress","userAgent","clientId","onVerified","markMfaVerified","token","complete","userName","name"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType, SessionAuthMethod, UserAuthenticatorKind } from '@authup/core-kit';\nimport { OAuth2AuthenticationContextClass } from '@authup/specs';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    UserAuthenticatorChallengeResponse,\n    UserAuthenticatorChallengeSendPayload,\n    UserAuthenticatorChallengeVerifyPayload,\n    UserAuthenticatorChallengeVerifyResponse,\n} from '@authup/core-http-kit';\nimport type { IOAuth2MfaLoginService, ISessionManager, IUserAuthenticatorService } from '../../../../../core/index.ts';\nimport type { RequestIdentity, RequestMfaLoginTicket } from '../../../request/index.ts';\nimport {\n    useRequestIdentity,\n    useRequestLocale,\n    useRequestMfaLoginTicket,\n    useRequestSessionId,\n} from '../../../request/index.ts';\n\nexport type AuthenticatorChallengeControllerContext = {\n    service: IUserAuthenticatorService,\n    sessionManager: ISessionManager,\n    mfaLoginService?: IOAuth2MfaLoginService,\n};\n\ntype ChallengeActor = {\n    identity: RequestIdentity,\n    ticket: RequestMfaLoginTicket | null,\n};\n\n/**\n * Login-time challenge surface, scoped to the CURRENT bearer identity.\n * GET reports whether (and how) the caller must present a second factor;\n * POST verifies a factor and stamps mfa_at onto the backing session so\n * the /authorize backstop passes.\n *\n * Besides a regular access bearer, these routes accept the \"MFA-pending\"\n * login ticket (kind: mfa_token, issue #3242) the password grant issues\n * for factor kinds that cannot ride the single grant POST (email /\n * WebAuthn). A ticket-authenticated verify additionally completes the\n * login: the response carries the full token grant for the now-MFA'd\n * pending session.\n */\n@DTags('userAuthenticator')\n@DController('/authenticators/challenge')\nexport class AuthenticatorChallengeController {\n    protected service: IUserAuthenticatorService;\n\n    protected sessionManager: ISessionManager;\n\n    protected mfaLoginService?: IOAuth2MfaLoginService;\n\n    constructor(ctx: AuthenticatorChallengeControllerContext) {\n        this.service = ctx.service;\n        this.sessionManager = ctx.sessionManager;\n        this.mfaLoginService = ctx.mfaLoginService;\n    }\n\n    /**\n     * Resolve the acting subject: the regular request identity (access\n     * bearer — the middleware never sets it for a ticket) or the stashed\n     * MFA-pending ticket. Anything else is unauthorized — the previous\n     * ForceLoggedInMiddleware contract, widened by exactly one bearer kind.\n     */\n    protected resolveActor(event: IAppEvent) : ChallengeActor {\n        const identity = useRequestIdentity(event);\n        if (identity) {\n            return { identity, ticket: null };\n        }\n\n        const ticket = useRequestMfaLoginTicket(event);\n        if (ticket) {\n            return { identity: ticket.identity, ticket };\n        }\n\n        throw new UnauthorizedError();\n    }\n\n    @DGet('')\n    async status(\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeResponse> {\n        const { identity, ticket } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            return {\n                required: false,\n                enrollmentRequired: false,\n                kinds: [],\n            };\n        }\n\n        const status = await this.service.challenge(identity.id);\n\n        // What this SESSION still owes, not merely what the user holds. A\n        // session an external identity provider established was authenticated\n        // there, which is where MFA is enforced for it, so authup asks for no\n        // local factor on top and `mfaRequired` forces no local enrollment.\n        //\n        // The rule lives here rather than in the page, so the hosted ladder\n        // and any other consumer read one answer; `authorizeInner` keeps its\n        // own copy as the backstop, which is the point of a backstop.\n        //\n        // The exception is an application that requested MFA explicitly. The\n        // caller passes the `acr_values` it is being asked to satisfy, since\n        // only it knows the authorization request.\n        const session = ticket ? null : await this.resolveSession(event);\n        if (session && session.authMethod === SessionAuthMethod.EXTERNAL) {\n            const { acrValues } = useRequestQuery(event);\n            const stepUpRequested = typeof acrValues === 'string' &&\n                acrValues.split(' ').includes(OAuth2AuthenticationContextClass.MFA);\n\n            // Enrollment stays suppressed either way: `authorizeInner` never\n            // forces it on an external session, so offering it here would\n            // route the person into a step the server does not ask for. A\n            // step-up can only ADD the challenge, and only for a factor the\n            // person already holds.\n            return {\n                ...status,\n                required: stepUpRequested && status.required,\n                enrollmentRequired: false,\n            };\n        }\n\n        return status;\n    }\n\n    protected async resolveSession(event: IAppEvent) : Promise<Session | null> {\n        const sessionId = useRequestSessionId(event);\n        if (!sessionId) {\n            return null;\n        }\n\n        return this.sessionManager.findOneById(sessionId);\n    }\n\n    @DPost('/send')\n    async send(\n        @DBody() data: UserAuthenticatorChallengeSendPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<{ success: true }> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can request a challenge.');\n        }\n\n        if (\n            !data ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind must be provided.');\n        }\n\n        await this.service.sendChallenge(identity.id, data.kind, { locale: useRequestLocale(event) });\n\n        // uniform 200 regardless of whether a code was actually mailed —\n        // no enrollment-status oracle for the caller.\n        return { success: true };\n    }\n\n    @DPost('')\n    async verify(\n        @DBody() data: UserAuthenticatorChallengeVerifyPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeVerifyResponse> {\n        const { identity, ticket } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can complete a challenge.');\n        }\n\n        if (\n            !data ||\n            typeof data.response !== 'string' ||\n            !data.response ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind and response must be provided.');\n        }\n\n        // Bind the proof to the backing session — the /authorize backstop\n        // reads session.mfa_at. The session id is server-derived (stashed\n        // by the authorization middleware / carried by the verified ticket),\n        // never client input. The stamp runs INSIDE the verify unit of work\n        // (before the code consumption persists), so a stamp failure never\n        // burns a single-use code.\n        const sessionId = ticket ?\n            ticket.payload.session_id :\n            useRequestSessionId(event);\n        const session = sessionId ?\n            await this.sessionManager.findOneById(sessionId) :\n            null;\n\n        // a ticket references exactly one pending session — without it\n        // (swept / expired mid-flight) the login can not complete.\n        if (ticket && !session) {\n            throw new UnauthorizedError();\n        }\n\n        const verified = await this.service.verify(\n            identity.id,\n            {\n                kind: data.kind,\n                response: data.response,\n            },\n            {\n                ipAddress: getRequestIP(event) ?? null,\n                userAgent: getRequestHeader(event, 'user-agent') ?? null,\n                clientId: identity.clientId,\n                sessionId: sessionId ?? null,\n                ...(session ? {\n                    onVerified: async () => {\n                        await this.sessionManager.markMfaVerified(session);\n                    },\n                } : {}),\n            },\n        );\n        if (!verified) {\n            throw new EntityCredentialsInvalidError();\n        }\n\n        // Ticket flow: the factor is verified and mfa_at stamped — complete\n        // the login by minting the full grant for the pending session and\n        // consuming the ticket (single use).\n        if (ticket && session && this.mfaLoginService) {\n            const token = await this.mfaLoginService.complete({\n                session,\n                ticket: ticket.payload,\n                userName: identity.data.name,\n            });\n\n            return { verified: true, token };\n        }\n\n        return { verified: true };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DA,IAAaoB,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8C;EACtD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;IAQA,aAAuBG,OAAmC;EACtD,MAAMC,WAAWX,mBAAmBU,KAAAA;EACpC,IAAIC,UACA,OAAO;GAAEA;GAAUC,QAAQ;EAAK;EAGpC,MAAMA,SAASV,yBAAyBQ,KAAAA;EACxC,IAAIE,QACA,OAAO;GAAED,UAAUC,OAAOD;GAAUC;EAAO;EAG/C,MAAM,IAAIf,kBAAAA;CACd;CAEA,MACMgB,OACF,OAC2C;EAC3C,MAAM,EAAEF,UAAUC,WAAW,KAAKH,aAAaC,KAAAA;EAC/C,IAAIC,SAASG,SAASxB,aAAayB,MAC/B,OAAO;GACHC,UAAU;GACVC,oBAAoB;GACpBC,OAAO,CAAA;EACX;EAGJ,MAAML,SAAS,MAAM,KAAKR,QAAQc,UAAUR,SAASS,EAAE;EAcvD,MAAMC,UAAUT,SAAS,OAAO,MAAM,KAAKU,eAAeZ,KAAAA;EAC1D,IAAIW,WAAWA,QAAQE,eAAehC,kBAAkBiC,UAAU;GAC9D,MAAM,EAAEC,cAAc/B,gBAAgBgB,KAAAA;GACtC,MAAMgB,kBAAkB,OAAOD,cAAc,YACzCA,UAAUE,MAAM,GAAA,CAAA,CAAKC,SAASnC,iCAAiCoC,GAAG;GAOtE,OAAO;IACH,GAAGhB;IACHG,UAAUU,mBAAmBb,OAAOG;IACpCC,oBAAoB;GACxB;EACJ;EAEA,OAAOJ;CACX;CAEA,MAAgBS,eAAeZ,OAA4C;EACvE,MAAMoB,YAAY3B,oBAAoBO,KAAAA;EACtC,IAAI,CAACoB,WACD,OAAO;EAGX,OAAO,KAAKxB,eAAeyB,YAAYD,SAAAA;CAC3C;CAEA,MACME,KACF,MACA,OAC0B;EAC1B,MAAM,EAAErB,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASxB,aAAayB,MAC/B,MAAM,IAAIpB,gBAAgB,+CAAA;EAG9B,IACI,CAACsC,QACD,CAACC,OAAOC,OAAO3C,qBAAAA,CAAAA,CAAuBoC,SAASK,KAAKG,IAAI,GAExD,MAAM,IAAIzC,gBAAgB,0BAAA;EAG9B,MAAM,KAAKU,QAAQgC,cAAc1B,SAASS,IAAIa,KAAKG,MAAM,EAAEE,QAAQrC,iBAAiBS,KAAAA,EAAO,CAAA;EAI3F,OAAO,EAAE6B,SAAS,KAAK;CAC3B;CAEA,MACMC,OACF,MACA,OACiD;EACjD,MAAM,EAAE7B,UAAUC,WAAW,KAAKH,aAAaC,KAAAA;EAC/C,IAAIC,SAASG,SAASxB,aAAayB,MAC/B,MAAM,IAAIpB,gBAAgB,gDAAA;EAG9B,IACI,CAACsC,QACD,OAAOA,KAAKQ,aAAa,YACzB,CAACR,KAAKQ,YACN,CAACP,OAAOC,OAAO3C,qBAAAA,CAAAA,CAAuBoC,SAASK,KAAKG,IAAI,GAExD,MAAM,IAAIzC,gBAAgB,uCAAA;EAS9B,MAAMmC,YAAYlB,SACdA,OAAO8B,QAAQC,aACfxC,oBAAoBO,KAAAA;EACxB,MAAMW,UAAUS,YACZ,MAAM,KAAKxB,eAAeyB,YAAYD,SAAAA,IACtC;EAIJ,IAAIlB,UAAU,CAACS,SACX,MAAM,IAAIxB,kBAAAA;EAqBd,IAAI,CAAC+C,MAlBkB,KAAKvC,QAAQmC,OAChC7B,SAASS,IACT;GACIgB,MAAMH,KAAKG;GACXK,UAAUR,KAAKQ;EACnB,GACA;GACII,WAAW9C,aAAaW,KAAAA,KAAU;GAClCoC,WAAWhD,iBAAiBY,OAAO,YAAA,KAAiB;GACpDqC,UAAUpC,SAASoC;GACnBjB,WAAWA,aAAa;GACxB,GAAIT,UAAU,EACV2B,YAAY,YAAA;IACR,MAAM,KAAK1C,eAAe2C,gBAAgB5B,OAAAA;GAC9C,EACJ,IAAI,CAAC;EACT,CAAA,GAGA,MAAM,IAAIzB,8BAAAA;EAMd,IAAIgB,UAAUS,WAAW,KAAKd,iBAO1B,OAAO;GAAEqC,UAAU;GAAMM,OAAAA,MANL,KAAK3C,gBAAgB4C,SAAS;IAC9C9B;IACAT,QAAQA,OAAO8B;IACfU,UAAUzC,SAASsB,KAAKoB;GAC5B,CAAA;EAE+B;EAGnC,OAAO,EAAET,UAAU,KAAK;CAC5B;AACJ"}

package/dist/adapters/http/controllers/workflows/authorize/module.d.ts

@@ -1,4 +1,5 @@
 import type { IAppEvent } from 'routup';
+import type { AuthorizeInfo } from '@authup/core-http-kit';
 import { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';
 import type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';
 import { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';
@@ -12,6 +13,20 @@ export declare class AuthorizeController {
     confirm(event: IAppEvent): Promise<{
         url: string;
     }>;
-    serve(event: IAppEvent): Promise<string>;
+    /**
+     * The page's render input as JSON, for a renderer that is not this
+     * process (plan 101 D2). Anonymous like the page GET, and answering
+     * the same query: a refused request is a 200 carrying the refusal,
+     * never an error status, so the caller renders what the page renders.
+     */
+    info(event: IAppEvent): Promise<AuthorizeInfo>;
+    /**
+     * The page renders in the auth console service, which reads its
+     * whole input back from `/info` above. server-core keeps the
+     * protocol: this GET is a stateless hop, and the POST that issues
+     * the code stays here.
+     */
+    serve(event: IAppEvent): Promise<Response>;
+    protected buildAuthorizeInfo(event: IAppEvent): Promise<AuthorizeInfo>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/authorize/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAexC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAMzF,qBACa,mBAAmB;IAI5B,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC;gBAI/B,GAAG,EAAE,0BAA0B;IAyBrC,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAmC/D,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CAsG7D"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAOxC,OAAO,KAAK,EACR,aAAa,EAIhB,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAGzF,qBACa,mBAAmB;IAI5B,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC;gBAI/B,GAAG,EAAE,0BAA0B;IAyBrC,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAkCrE;;;;;OAKG;IAEG,IAAI,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC;IAQhE;;;;;OAKG;IAEG,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;cAM5C,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC;CAoH/E"}

package/dist/adapters/http/controllers/workflows/authorize/module.mjs

@@ -7,12 +7,12 @@ import "../../../../../utils/index.mjs";
 import "../../../../../core/index.mjs";
 import { readFromLocations } from "../../../request/helpers/locations.mjs";
 import "../../../request/index.mjs";
-import { ForceUserLoggedInMiddleware } from "../../../middleware/built-in/loggedin/user.mjs";
-import { renderAuthConsolePage } from "../../../ui/auth-console/module.mjs";
-import "../../../middleware/index.mjs";
-import "../../../ui/index.mjs";
 import { HTTPOAuth2Authorizer } from "../../../adapters/oauth2/authorization/module.mjs";
 import "../../../adapters/index.mjs";
+import { ForceUserLoggedInMiddleware } from "../../../middleware/built-in/loggedin/user.mjs";
+import "../../../middleware/index.mjs";
+import { redirectToAuthConsole } from "../auth-console.mjs";
+import { isUUID } from "@authup/kit";
 import { OAuth2AccessDeniedError, OAuth2ErrorCode, OAuth2LoginRequiredError, isOAuth2AccessDeniedError } from "@authup/specs";
 import { URL } from "node:url";
 import { useRequestQuery } from "@routup/basic/query";
@@ -72,7 +72,24 @@ var AuthorizeController = class {
 			throw e;
 		}
 	}
-	async serve(event) {
+	/**
+	* The page's render input as JSON, for a renderer that is not this
+	* process (plan 101 D2). Anonymous like the page GET, and answering
+	* the same query: a refused request is a 200 carrying the refusal,
+	* never an error status, so the caller renders what the page renders.
+	*/ async info(event) {
+		event.response.headers.set("cache-control", "no-store");
+		return this.buildAuthorizeInfo(event);
+	}
+	/**
+	* The page renders in the auth console service, which reads its
+	* whole input back from `/info` above. server-core keeps the
+	* protocol: this GET is a stateless hop, and the POST that issues
+	* the code stays here.
+	*/ async serve(event) {
+		return redirectToAuthConsole(event, this.options.authConsoleUrl, "/authorize");
+	}
+	async buildAuthorizeInfo(event) {
 		let codeRequest;
 		let client;
 		let scopes;
@@ -118,23 +135,22 @@ var AuthorizeController = class {
 				};
 			}
 		}
+		const query = useRequestQuery(event);
+		const federatedLogin = typeof query.provider === "string" && isUUID(query.provider) ? { providerId: query.provider } : void 0;
 		const requestURL = new URL(event.request.url);
-		return renderAuthConsolePage(event, {
-			url: "/authorize",
-			payload: {
-				config: { baseURL: this.options.baseURL },
-				data: {
-					codeRequest,
-					error,
-					client,
-					scopes,
-					realm,
-					redirectUriVerified,
-					features: this.options.features,
-					requestPath: `${requestURL.pathname}${requestURL.search}`
-				}
-			}
-		});
+		requestURL.searchParams.delete("provider");
+		requestURL.pathname = "/authorize";
+		return {
+			codeRequest,
+			error,
+			client,
+			scopes,
+			realm,
+			redirectUriVerified,
+			federatedLogin,
+			features: this.options.features,
+			requestPath: `${requestURL.pathname}${requestURL.search}`
+		};
 	}
 };
 _ts_decorate([
@@ -144,6 +160,13 @@ _ts_decorate([
 	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
 	_ts_metadata("design:returntype", Promise)
 ], AuthorizeController.prototype, "confirm", null);
+_ts_decorate([
+	DGet("/info", []),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AuthorizeController.prototype, "info", null);
 _ts_decorate([
 	DGet("", []),
 	_ts_param(0, DContext()),

package/dist/adapters/http/controllers/workflows/authorize/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","useRequestQuery","OAuth2AccessDeniedError","OAuth2ErrorCode","OAuth2LoginRequiredError","isOAuth2AccessDeniedError","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderAuthConsolePage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","consentService","logger","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","e","ACCESS_DENIED","serve","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","displayName","builtIn","createdAt","normalized","message","query","mapped","forClient","LOGIN_REQUIRED","providerUnavailable","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    Client,\n    OAuth2AuthorizationCodeRequest,\n    Realm,\n    Scope,\n} from '@authup/core-kit';\nimport {\n    OAuth2AccessDeniedError,\n    OAuth2ErrorCode,\n    OAuth2LoginRequiredError,\n    isOAuth2AccessDeniedError,\n} from '@authup/specs';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderAuthConsolePage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\ntype RealmSummary = Pick<Realm, 'id' | 'name' | 'displayName'>;\ntype ClientSummary = Pick<Client, 'id' | 'name' | 'displayName' | 'builtIn' | 'createdAt'>;\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            codeIssuer: ctx.codeIssuer,\n            sessionManager: ctx.sessionManager,\n            eventService: ctx.eventService,\n            metrics: ctx.metrics,\n            promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n            mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,\n            mfaChallengeProvider: ctx.mfaChallengeProvider,\n            accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n            consentService: ctx.consentService,\n            logger: ctx.logger,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        try {\n            const result = await this.authorizer.authorizeWithRequest(event);\n\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            if (result.authorizationCode) {\n                url.searchParams.set('code', result.authorizationCode);\n            }\n\n            return { url: url.href };\n        } catch (e) {\n            // Access-policy denial (plan 052): with a pattern-verified\n            // redirect_uri the denial is answered as an error redirect\n            // (RFC 6749 §4.1.2.1) — the kit navigates the returned url like\n            // any success. Unverified → rethrow → 400 body → interactive\n            // denial card.\n            if (isOAuth2AccessDeniedError(e) && e.redirectUri) {\n                const url = new URL(e.redirectUri);\n                url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n                if (e.state) {\n                    url.searchParams.set('state', e.state);\n                }\n\n                return { url: url.href };\n            }\n\n            throw e;\n        }\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : ClientSummary | undefined;\n        let scopes : Scope[] | undefined;\n\n        // Target realm summary (the client's realm) — the UI names it in the\n        // realm-mismatch notice. codeRequest.realm_id is only the id.\n        let realm : RealmSummary | undefined;\n\n        // Whether the request redirect_uri matched a registered client pattern —\n        // the UI must not offer an automatic \"return to application\" redirect to\n        // an unverified (pattern-less-client) redirect_uri.\n        let redirectUriVerified = false;\n\n        let error : Error | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n\n            // Trim the client to a deliberate DTO before it reaches the\n            // anonymous SSR hydration payload — never disclose redirect_uri\n            // patterns (the trusted-origin set), grant_types, internal\n            // base/root URLs, auth methods, or the secret storage flags to an\n            // unauthenticated visitor. (ClientEntity.secret is additionally\n            // select:false, so the secret is never loaded — but the DTO must not\n            // rely on that alone: a future entity/query change could unset it.)\n            client = {\n                id: result.client.id,\n                name: result.client.name,\n                displayName: result.client.displayName,\n                builtIn: result.client.builtIn,\n                createdAt: result.client.createdAt,\n            };\n            scopes = result.scopes;\n            redirectUriVerified = result.redirectUriVerified;\n\n            if (result.client.realm) {\n                realm = {\n                    id: result.client.realm.id,\n                    name: result.client.realm.name,\n                    displayName: result.client.realm.displayName,\n                };\n            }\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // A recognized `error` query param (the federated-IdP callback\n        // redirects back here with one when it refuses a completion) is\n        // mapped onto the hydration payload's error. The set stays closed and\n        // the text is server-side and neutral, never attacker-controlled;\n        // any other value is ignored.\n        if (!error) {\n            const query = useRequestQuery(event);\n            let mapped : Error | undefined;\n            if (query.error === OAuth2ErrorCode.ACCESS_DENIED) {\n                mapped = OAuth2AccessDeniedError.forClient();\n            } else if (query.error === OAuth2ErrorCode.LOGIN_REQUIRED) {\n                mapped = OAuth2LoginRequiredError.providerUnavailable();\n            }\n\n            if (mapped) {\n                const normalized = sanitizeError(mapped);\n                error = {\n                    ...normalized,\n                    message: normalized.message,\n                };\n            }\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        const requestURL = new URL(event.request.url);\n\n        return renderAuthConsolePage(event, {\n            url: '/authorize',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    codeRequest,\n                    error,\n                    client,\n                    scopes,\n                    realm,\n                    redirectUriVerified,\n                    features: this.options.features,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,IAAagB,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,cAAcH,IAAIG;GAClBC,SAASJ,IAAII;GACbC,mBAAmBL,IAAIJ,QAAQS;GAC/BC,oBAAoBN,IAAIJ,QAAQU;GAChCC,sBAAsBP,IAAIO;GAC1BC,uBAAuBR,IAAIQ;GAC3BC,gBAAgBT,IAAIS;GACpBC,QAAQV,IAAIU;EAChB,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,IAAI;GACA,MAAME,SAAS,MAAM,KAAKd,WAAWe,qBAAqBF,KAAAA;GAE1D,MAAMG,MAAM,IAAIhC,IAAI8B,OAAOG,WAAW;GACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;GAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;GAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;EAC3B,SAASC,GAAG;GAMR,IAAIlC,0BAA0BkC,CAAAA,KAAMA,EAAEN,aAAa;IAC/C,MAAMD,MAAM,IAAIhC,IAAIuC,EAAEN,WAAW;IACjCD,IAAIG,aAAaC,IAAI,SAASjC,gBAAgBqC,aAAa;IAC3D,IAAID,EAAEL,OACFF,IAAIG,aAAaC,IAAI,SAASG,EAAEL,KAAK;IAGzC,OAAO,EAAEF,KAAKA,IAAIM,KAAK;GAC3B;GAEA,MAAMC;EACV;CACJ;CAEA,MACME,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAE1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAMvC,kBAAkBoB,OAAO,CAAC,QAAQ,OAAQ,CAAA;GAC/D,MAAMoB,OAAO,MAAM,KAAKlC,qBAAqBmC,IAAIF,MAAAA;GAEjD,MAAMlB,SAAS,MAAM,KAAKhB,oBAAoBqC,OAAOF,IAAAA;GASrDN,SAAS;IACLS,IAAItB,OAAOa,OAAOS;IAClBC,MAAMvB,OAAOa,OAAOU;IACpBC,aAAaxB,OAAOa,OAAOW;IAC3BC,SAASzB,OAAOa,OAAOY;IACvBC,WAAW1B,OAAOa,OAAOa;GAC7B;GACAZ,SAASd,OAAOc;GAChBE,sBAAsBhB,OAAOgB;GAE7B,IAAIhB,OAAOa,OAAOE,OACdA,QAAQ;IACJO,IAAItB,OAAOa,OAAOE,MAAMO;IACxBC,MAAMvB,OAAOa,OAAOE,MAAMQ;IAC1BC,aAAaxB,OAAOa,OAAOE,MAAMS;GACrC;GAGJZ,cAAcZ,OAAOmB;EACzB,SAASV,GAAG;GACR,MAAMkB,aAAa9C,cAAc4B,CAAAA;GACjCQ,QAAQ;IACJ,GAAGU;IACHC,SAASD,WAAWC;GACxB;EACJ;EAOA,IAAI,CAACX,OAAO;GACR,MAAMY,QAAQ1D,gBAAgB4B,KAAAA;GAC9B,IAAI+B;GACJ,IAAID,MAAMZ,UAAU5C,gBAAgBqC,eAChCoB,SAAS1D,wBAAwB2D,UAAS;QACvC,IAAIF,MAAMZ,UAAU5C,gBAAgB2D,gBACvCF,SAASxD,yBAAyB2D,oBAAmB;GAGzD,IAAIH,QAAQ;IACR,MAAMH,aAAa9C,cAAciD,MAAAA;IACjCb,QAAQ;KACJ,GAAGU;KACHC,SAASD,WAAWC;IACxB;GACJ;EACJ;EAKA,MAAMM,aAAa,IAAIhE,IAAI6B,MAAMoC,QAAQjC,GAAG;EAE5C,OAAOxB,sBAAsBqB,OAAO;GAChCG,KAAK;GACLkC,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAKvD,QAAQuD,QAAQ;IACxCnB,MAAM;KACFP;KACAK;KACAJ;KACAC;KACAC;KACAC;KACAuB,UAAU,KAAKxD,QAAQwD;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;CA1IgBlE,MAAAA,IAAAA,CAAAA,2BAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","isUUID","useRequestQuery","OAuth2AccessDeniedError","OAuth2ErrorCode","OAuth2LoginRequiredError","isOAuth2AccessDeniedError","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","redirectToAuthConsole","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","consentService","logger","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","e","ACCESS_DENIED","info","response","headers","buildAuthorizeInfo","serve","authConsoleUrl","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","displayName","builtIn","createdAt","normalized","message","query","mapped","forClient","LOGIN_REQUIRED","providerUnavailable","federatedLogin","provider","providerId","undefined","requestURL","request","delete","pathname","features","requestPath","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport { isUUID } from '@authup/kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    OAuth2AuthorizationCodeRequest,\n    Scope,\n} from '@authup/core-kit';\nimport type {\n    AuthorizeInfo,\n    AuthorizeInfoError,\n    ClientSummary,\n    RealmSummary,\n} from '@authup/core-http-kit';\nimport {\n    OAuth2AccessDeniedError,\n    OAuth2ErrorCode,\n    OAuth2LoginRequiredError,\n    isOAuth2AccessDeniedError,\n} from '@authup/specs';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { redirectToAuthConsole } from '../auth-console.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            codeIssuer: ctx.codeIssuer,\n            sessionManager: ctx.sessionManager,\n            eventService: ctx.eventService,\n            metrics: ctx.metrics,\n            promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n            mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,\n            mfaChallengeProvider: ctx.mfaChallengeProvider,\n            accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n            consentService: ctx.consentService,\n            logger: ctx.logger,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        try {\n            const result = await this.authorizer.authorizeWithRequest(event);\n\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            if (result.authorizationCode) {\n                url.searchParams.set('code', result.authorizationCode);\n            }\n\n            return { url: url.href };\n        } catch (e) {\n            // Access-policy denial (plan 052): with a pattern-verified\n            // redirect_uri the denial is answered as an error redirect\n            // (RFC 6749 §4.1.2.1) — the kit navigates the returned url like\n            // any success. Unverified → rethrow → 400 body → interactive\n            // denial card.\n            if (isOAuth2AccessDeniedError(e) && e.redirectUri) {\n                const url = new URL(e.redirectUri);\n                url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n                if (e.state) {\n                    url.searchParams.set('state', e.state);\n                }\n\n                return { url: url.href };\n            }\n\n            throw e;\n        }\n    }\n\n    /**\n     * The page's render input as JSON, for a renderer that is not this\n     * process (plan 101 D2). Anonymous like the page GET, and answering\n     * the same query: a refused request is a 200 carrying the refusal,\n     * never an error status, so the caller renders what the page renders.\n     */\n    @DGet('/info', [])\n    async info(@DContext() event: IAppEvent): Promise<AuthorizeInfo> {\n        // The page inherits this from applyUIPageHeaders. A login context\n        // is per-request and must never be served from a cache.\n        event.response.headers.set('cache-control', 'no-store');\n\n        return this.buildAuthorizeInfo(event);\n    }\n\n    /**\n     * The page renders in the auth console service, which reads its\n     * whole input back from `/info` above. server-core keeps the\n     * protocol: this GET is a stateless hop, and the POST that issues\n     * the code stays here.\n     */\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<Response> {\n        return redirectToAuthConsole(event, this.options.authConsoleUrl, '/authorize');\n    }\n\n    // ---------------------------------------------------------\n\n    protected async buildAuthorizeInfo(event: IAppEvent): Promise<AuthorizeInfo> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : ClientSummary | undefined;\n        let scopes : Scope[] | undefined;\n\n        // Target realm summary (the client's realm) — the UI names it in the\n        // realm-mismatch notice. codeRequest.realm_id is only the id.\n        let realm : RealmSummary | undefined;\n\n        // Whether the request redirect_uri matched a registered client pattern —\n        // the UI must not offer an automatic \"return to application\" redirect to\n        // an unverified (pattern-less-client) redirect_uri.\n        let redirectUriVerified = false;\n\n        // A plain object, not an Error: it is spread onto the wire, where\n        // only data survives.\n        let error : AuthorizeInfoError | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n\n            // Trim the client to a deliberate DTO before it reaches the\n            // anonymous SSR hydration payload — never disclose redirect_uri\n            // patterns (the trusted-origin set), grant_types, the home URL,\n            // the back-channel logout endpoint, auth methods, or the secret\n            // storage flags to an unauthenticated visitor. (ClientEntity.secret\n            // is additionally\n            // select:false, so the secret is never loaded — but the DTO must not\n            // rely on that alone: a future entity/query change could unset it.)\n            client = {\n                id: result.client.id,\n                name: result.client.name,\n                displayName: result.client.displayName,\n                builtIn: result.client.builtIn,\n                createdAt: result.client.createdAt,\n            };\n            scopes = result.scopes;\n            redirectUriVerified = result.redirectUriVerified;\n\n            if (result.client.realm) {\n                realm = {\n                    id: result.client.realm.id,\n                    name: result.client.realm.name,\n                    displayName: result.client.realm.displayName,\n                };\n            }\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // A recognized `error` query param (the federated-IdP callback\n        // redirects back here with one when it refuses a completion) is\n        // mapped onto the hydration payload's error. The set stays closed and\n        // the text is server-side and neutral, never attacker-controlled;\n        // any other value is ignored.\n        if (!error) {\n            const query = useRequestQuery(event);\n            let mapped : Error | undefined;\n            if (query.error === OAuth2ErrorCode.ACCESS_DENIED) {\n                mapped = OAuth2AccessDeniedError.forClient();\n            } else if (query.error === OAuth2ErrorCode.LOGIN_REQUIRED) {\n                mapped = OAuth2LoginRequiredError.providerUnavailable();\n            }\n\n            if (mapped) {\n                const normalized = sanitizeError(mapped);\n                error = {\n                    ...normalized,\n                    message: normalized.message,\n                };\n            }\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        // A federated callback sends the browser back here to complete the\n        // login it established (plan 094). Only the provider is named: the\n        // pending login itself rides a cookie, so nothing here is a secret.\n        // It is interpolated into the completion request path by the page, so\n        // it is accepted as an id and nothing else, and dropped from\n        // `requestPath` so the register / password links do not carry it.\n        const query = useRequestQuery(event);\n        const federatedLogin = typeof query.provider === 'string' && isUUID(query.provider) ?\n            { providerId: query.provider } :\n            undefined;\n\n        const requestURL = new URL(event.request.url);\n        requestURL.searchParams.delete('provider');\n        // Anchored on the page, never on the route that was called:\n        // `GET /authorize/info` answers the context of the same authorize\n        // request, and the value is rendered as a link back to the page.\n        requestURL.pathname = '/authorize';\n\n        return {\n            codeRequest,\n            error,\n            client,\n            scopes,\n            realm,\n            redirectUriVerified,\n            federatedLogin,\n            features: this.options.features,\n            requestPath: `${requestURL.pathname}${requestURL.search}`,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,IAAaiB,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,cAAcH,IAAIG;GAClBC,SAASJ,IAAII;GACbC,mBAAmBL,IAAIJ,QAAQS;GAC/BC,oBAAoBN,IAAIJ,QAAQU;GAChCC,sBAAsBP,IAAIO;GAC1BC,uBAAuBR,IAAIQ;GAC3BC,gBAAgBT,IAAIS;GACpBC,QAAQV,IAAIU;EAChB,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,IAAI;GACA,MAAME,SAAS,MAAM,KAAKd,WAAWe,qBAAqBF,KAAAA;GAE1D,MAAMG,MAAM,IAAIjC,IAAI+B,OAAOG,WAAW;GACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;GAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;GAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;EAC3B,SAASC,GAAG;GAMR,IAAIlC,0BAA0BkC,CAAAA,KAAMA,EAAEN,aAAa;IAC/C,MAAMD,MAAM,IAAIjC,IAAIwC,EAAEN,WAAW;IACjCD,IAAIG,aAAaC,IAAI,SAASjC,gBAAgBqC,aAAa;IAC3D,IAAID,EAAEL,OACFF,IAAIG,aAAaC,IAAI,SAASG,EAAEL,KAAK;IAGzC,OAAO,EAAEF,KAAKA,IAAIM,KAAK;GAC3B;GAEA,MAAMC;EACV;CACJ;;;;;;IAQA,MACME,KAAK,OAAsD;EAG7DZ,MAAMa,SAASC,QAAQP,IAAI,iBAAiB,UAAA;EAE5C,OAAO,KAAKQ,mBAAmBf,KAAAA;CACnC;;;;;;IAQA,MACMgB,MAAM,OAAiD;EACzD,OAAOrC,sBAAsBqB,OAAO,KAAKhB,QAAQiC,gBAAgB,YAAA;CACrE;CAIA,MAAgBF,mBAAmBf,OAA0C;EACzE,IAAIkB;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAI1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAM5C,kBAAkBoB,OAAO,CAAC,QAAQ,OAAQ,CAAA;GAC/D,MAAMyB,OAAO,MAAM,KAAKvC,qBAAqBwC,IAAIF,MAAAA;GAEjD,MAAMvB,SAAS,MAAM,KAAKhB,oBAAoB0C,OAAOF,IAAAA;GAUrDN,SAAS;IACLS,IAAI3B,OAAOkB,OAAOS;IAClBC,MAAM5B,OAAOkB,OAAOU;IACpBC,aAAa7B,OAAOkB,OAAOW;IAC3BC,SAAS9B,OAAOkB,OAAOY;IACvBC,WAAW/B,OAAOkB,OAAOa;GAC7B;GACAZ,SAASnB,OAAOmB;GAChBE,sBAAsBrB,OAAOqB;GAE7B,IAAIrB,OAAOkB,OAAOE,OACdA,QAAQ;IACJO,IAAI3B,OAAOkB,OAAOE,MAAMO;IACxBC,MAAM5B,OAAOkB,OAAOE,MAAMQ;IAC1BC,aAAa7B,OAAOkB,OAAOE,MAAMS;GACrC;GAGJZ,cAAcjB,OAAOwB;EACzB,SAASf,GAAG;GACR,MAAMuB,aAAanD,cAAc4B,CAAAA;GACjCa,QAAQ;IACJ,GAAGU;IACHC,SAASD,WAAWC;GACxB;EACJ;EAOA,IAAI,CAACX,OAAO;GACR,MAAMY,QAAQ/D,gBAAgB4B,KAAAA;GAC9B,IAAIoC;GACJ,IAAID,MAAMZ,UAAUjD,gBAAgBqC,eAChCyB,SAAS/D,wBAAwBgE,UAAS;QACvC,IAAIF,MAAMZ,UAAUjD,gBAAgBgE,gBACvCF,SAAS7D,yBAAyBgE,oBAAmB;GAGzD,IAAIH,QAAQ;IACR,MAAMH,aAAanD,cAAcsD,MAAAA;IACjCb,QAAQ;KACJ,GAAGU;KACHC,SAASD,WAAWC;IACxB;GACJ;EACJ;EAWA,MAAMC,QAAQ/D,gBAAgB4B,KAAAA;EAC9B,MAAMwC,iBAAiB,OAAOL,MAAMM,aAAa,YAAYtE,OAAOgE,MAAMM,QAAQ,IAC9E,EAAEC,YAAYP,MAAMM,SAAS,IAC7BE,KAAAA;EAEJ,MAAMC,aAAa,IAAI1E,IAAI8B,MAAM6C,QAAQ1C,GAAG;EAC5CyC,WAAWtC,aAAawC,OAAO,UAAA;EAI/BF,WAAWG,WAAW;EAEtB,OAAO;GACH7B;GACAK;GACAJ;GACAC;GACAC;GACAC;GACAkB;GACAQ,UAAU,KAAKhE,QAAQgE;GACvBC,aAAa,GAAGL,WAAWG,WAAWH,WAAWM;EACrD;CACJ;AACJ;;CAnLgBzE,MAAAA,IAAAA,CAAAA,2BAAAA,CAAAA"}

package/dist/adapters/http/controllers/workflows/authorize/types.d.ts

@@ -3,6 +3,11 @@ import type { Logger } from '@authup/server-kit';
 import type { IAuthFlowMetrics, IConsentService, IEventService, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, ISessionManager, IUserAuthenticatorChallengeProvider } from '../../../../../core/index.ts';
 export type AuthorizeControllerOptions = {
     baseURL: string;
+    /**
+     * Where the auth console service renders the page this controller
+     * hands over to (plan 101 D2).
+     */
+    authConsoleUrl: string;
     features: StatusResponseFeatures;
     /**
      * Max age (seconds) a `prompt=login` request accepts before forcing re-auth

package/dist/adapters/http/controllers/workflows/authorize/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,eAAe,EACf,mCAAmC,EACtC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IAEpC,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAE7D,cAAc,EAAE,eAAe,CAAC;IAEhC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAE3B,oBAAoB,CAAC,EAAE,mCAAmC,CAAC;IAC3D,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD;;;OAGG;IACH,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,eAAe,EACf,mCAAmC,EACtC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IAEpC,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAE7D,cAAc,EAAE,eAAe,CAAC;IAEhC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAE3B,oBAAoB,CAAC,EAAE,mCAAmC,CAAC;IAC3D,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD;;;OAGG;IACH,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/controllers/workflows/console-login/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/workflows/console-login/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/console-login/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/controllers/workflows/console-login/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ConsoleLogin } from "./module.mjs";
+export { ConsoleLogin };

package/dist/adapters/http/controllers/workflows/console-login/module.d.ts

@@ -0,0 +1,83 @@
+import type { IClient } from '@authup/core-http-kit';
+import type { Logger } from '@authup/server-kit';
+import { OAuth2ErrorCode } from '@authup/specs';
+import type { IAppEvent } from 'routup';
+import type { IConsoleLoginStore, IOAuth2TokenRevoker, IOAuth2TokenVerifier, ISessionManager, ISessionRepository } from '../../../../../core/index.ts';
+import type { ConsoleLoginContext, ConsoleLoginDefinition } from './types.ts';
+/**
+ * A console's server-side login (plan 088): the kick and the code redemption.
+ * Both exist so no OAuth2 token ever reaches the console's JavaScript. The
+ * browser holds an opaque, `HttpOnly` credential naming its `auth_sessions`
+ * row instead.
+ *
+ * One instance per console, parameterized by the client it authenticates
+ * against and the path it is served under (`console/account`,
+ * `console/admin`: the two pending-login cookies stay apart by RFC 6265 path
+ * matching); the account and the admin console differ in nothing else here.
+ */
+export declare class ConsoleLogin {
+    protected definition: ConsoleLoginDefinition;
+    protected baseURL: string;
+    protected loginStore: IConsoleLoginStore;
+    protected sessionRepository: ISessionRepository;
+    protected sessionManager: ISessionManager;
+    protected tokenVerifier: IOAuth2TokenVerifier;
+    protected tokenRevoker: IOAuth2TokenRevoker;
+    protected logger?: Logger;
+    constructor(definition: ConsoleLoginDefinition, ctx: ConsoleLoginContext);
+    /**
+     * Start a console login: mint PKCE + `state`, park them in the pending
+     * login, and send the browser to `/authorize`.
+     *
+     * The verifier never reaches the browser, which is what moves the code
+     * exchange server-side: the callback is the only party that can redeem the
+     * code it comes back with.
+     */
+    login(event: IAppEvent): Promise<Response>;
+    /**
+     * Redeem the authorization code and hand the browser its session cookie.
+     *
+     * Nothing token-shaped leaves this method: the pair is verified, used to
+     * find the session it belongs to, and revoked before the response is
+     * built. What the browser gets back is the opaque `auth_sessions.secret`.
+     */
+    callback(event: IAppEvent): Promise<Response>;
+    protected resolveHttpClient(event: IAppEvent): IClient;
+    /**
+     * Revoke what the exchange returned. Best effort per token: a revoke that
+     * fails must not leave the visitor without a session, and both tokens are
+     * unreachable to anyone but this process either way.
+     */
+    protected revokeGrant(accessToken: string, refreshToken?: string): Promise<void>;
+    protected mapCallbackError(input: string): `${OAuth2ErrorCode}`;
+    /**
+     * Land a refusal on the console rather than in a JSON body: this is a
+     * top-level navigation at the end of a login, and the person behind it has
+     * to be told something. The marker set is closed, so nothing
+     * attacker-shaped is echoed.
+     */
+    protected refuse(event: IAppEvent, error: `${OAuth2ErrorCode}`): Response;
+    protected trimmedBaseURL(): string;
+    protected basePath(): string;
+    protected buildConsoleURL(): string;
+    protected buildCallbackURL(): string;
+    /**
+     * Whether the cookies may carry the `Secure` flag. Read from the parsed
+     * URL rather than the raw string: `publicUrl` is validated but never
+     * canonicalized, so a configured `HTTPS://...` would leave a prefix test
+     * false and silently drop the flag.
+     */
+    protected isSecureBaseURL(): boolean;
+    /**
+     * Scoped to the routes that read it, so it never rides an ordinary API
+     * request and two consoles keep separate logins in flight, and
+     * `SameSite=Lax` because the return leg is a top-level navigation that
+     * may come back through an external identity provider, which a `Strict`
+     * cookie would not accompany. It holds nothing but the id of a single-use
+     * cache entry.
+     */
+    protected buildLoginCookiePath(): string;
+    protected setLoginCookie(event: IAppEvent, value: string): void;
+    protected unsetLoginCookie(event: IAppEvent): void;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/console-login/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/console-login/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAGrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EACH,eAAe,EAIlB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AASxC,OAAO,KAAK,EACR,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EACrB,MAAM,8BAA8B,CAAC;AAItC,OAAO,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAiB9E;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACrB,SAAS,CAAC,UAAU,EAAG,sBAAsB,CAAC;IAE9C,SAAS,CAAC,OAAO,EAAG,MAAM,CAAC;IAE3B,SAAS,CAAC,UAAU,EAAG,kBAAkB,CAAC;IAE1C,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;IAE/C,SAAS,CAAC,YAAY,EAAG,mBAAmB,CAAC;IAE7C,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAEf,UAAU,EAAE,sBAAsB,EAAE,GAAG,EAAE,mBAAmB;IAWxE;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,QAAQ,CAAC;IAyCjD;;;;;;OAMG;IACG,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,QAAQ,CAAC;IAuHpD,SAAS,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO;IASvD;;;;OAIG;cACa,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IAcvF,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAI,GAAG,eAAe,EAAE;IAQhE;;;;;OAKG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,eAAe,EAAE,GAAI,QAAQ;IAc1E,SAAS,CAAC,cAAc,IAAK,MAAM;IAInC,SAAS,CAAC,QAAQ,IAAK,MAAM;IAI7B,SAAS,CAAC,eAAe,IAAK,MAAM;IAIpC,SAAS,CAAC,gBAAgB,IAAK,MAAM;IAIrC;;;;;OAKG;IACH,SAAS,CAAC,eAAe,IAAK,OAAO;IAQrC;;;;;;;OAOG;IACH,SAAS,CAAC,oBAAoB,IAAK,MAAM;IAMzC,SAAS,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAI,IAAI;IAUhE,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAI,IAAI;CAGtD"}