@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/adapters/http/controllers/workflows/console-login/module.mjs

@@ -0,0 +1,230 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SYSTEM_CLIENT_SCOPE_NAMES } from "../../../../../core/entities/client/system-clients.mjs";
+import { createOAuth2PKCE } from "../../../../../core/oauth2/authorization/helpers.mjs";
+import { CONSOLE_LOGIN_COOKIE, CONSOLE_LOGIN_TTL } from "../../../../../core/oauth2/console-login/constants.mjs";
+import { createSessionSecret } from "../../../../../core/oauth2/session-credential/module.mjs";
+import "../../../../../core/index.mjs";
+import { isSameOriginRequest } from "../../../request/helpers/same-origin.mjs";
+import "../../../request/index.mjs";
+import { setSessionCookie } from "../../../cookie/session.mjs";
+import "../../../cookie/index.mjs";
+import { INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY } from "../../../middleware/built-in/internal-http-client.mjs";
+import "../../../middleware/index.mjs";
+import { createNanoID, getURLBasePath } from "@authup/kit";
+import { BadRequestError, InternalError } from "@authup/errors";
+import { OAuth2ErrorCode, OAuth2SubKind, OAuth2TokenKind, serializeOAuth2Scope } from "@authup/specs";
+import { sendRedirect } from "routup";
+import { setResponseCookie, unsetResponseCookie, useRequestCookie } from "@routup/basic/cookie";
+import { useRequestQuery } from "@routup/basic/query";
+//#region src/adapters/http/controllers/workflows/console-login/module.ts
+/**
+* The OAuth2 error codes the callback echoes back to the console. Closed on
+* purpose: everything else collapses into one generic marker, so nothing a
+* redirect carries reaches a rendered page as-is.
+*
+* `access_denied` is the one the consoles render specially (an accessPolicyId
+* on the console client); the other two land on the same generic notice but
+* say something true in a log or a bug report.
+*/ const CALLBACK_ERROR_CODES = [
+	OAuth2ErrorCode.ACCESS_DENIED,
+	OAuth2ErrorCode.LOGIN_REQUIRED,
+	OAuth2ErrorCode.CONSENT_REQUIRED
+];
+/**
+* A console's server-side login (plan 088): the kick and the code redemption.
+* Both exist so no OAuth2 token ever reaches the console's JavaScript. The
+* browser holds an opaque, `HttpOnly` credential naming its `auth_sessions`
+* row instead.
+*
+* One instance per console, parameterized by the client it authenticates
+* against and the path it is served under (`console/account`,
+* `console/admin`: the two pending-login cookies stay apart by RFC 6265 path
+* matching); the account and the admin console differ in nothing else here.
+*/ var ConsoleLogin = class {
+	definition;
+	baseURL;
+	loginStore;
+	sessionRepository;
+	sessionManager;
+	tokenVerifier;
+	tokenRevoker;
+	logger;
+	constructor(definition, ctx) {
+		this.definition = definition;
+		this.baseURL = ctx.options.baseURL;
+		this.loginStore = ctx.loginStore;
+		this.sessionRepository = ctx.sessionRepository;
+		this.sessionManager = ctx.sessionManager;
+		this.tokenVerifier = ctx.tokenVerifier;
+		this.tokenRevoker = ctx.tokenRevoker;
+		this.logger = ctx.logger;
+	}
+	/**
+	* Start a console login: mint PKCE + `state`, park them in the pending
+	* login, and send the browser to `/authorize`.
+	*
+	* The verifier never reaches the browser, which is what moves the code
+	* exchange server-side: the callback is the only party that can redeem the
+	* code it comes back with.
+	*/ async login(event) {
+		const realmId = useRequestQuery(event, "realmId");
+		if (typeof realmId !== "string" || realmId.length === 0) throw new BadRequestError("A realm is required to sign in.");
+		const pkce = await createOAuth2PKCE();
+		const state = createNanoID();
+		const redirectUri = this.buildCallbackURL();
+		const id = await this.loginStore.save({
+			state,
+			codeVerifier: pkce.code_verifier,
+			redirectUri,
+			realmId
+		});
+		this.setLoginCookie(event, id);
+		const url = new URL(`${this.trimmedBaseURL()}/authorize`);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("client_id", this.definition.clientName);
+		url.searchParams.set("realm_id", realmId);
+		url.searchParams.set("scope", serializeOAuth2Scope(SYSTEM_CLIENT_SCOPE_NAMES));
+		url.searchParams.set("redirect_uri", redirectUri);
+		url.searchParams.set("state", state);
+		url.searchParams.set("code_challenge", pkce.code_challenge);
+		url.searchParams.set("code_challenge_method", pkce.code_challenge_method);
+		url.searchParams.set("prompt", "select_account");
+		event.response.headers.set("cache-control", "no-store");
+		return sendRedirect(event, url.href);
+	}
+	/**
+	* Redeem the authorization code and hand the browser its session cookie.
+	*
+	* Nothing token-shaped leaves this method: the pair is verified, used to
+	* find the session it belongs to, and revoked before the response is
+	* built. What the browser gets back is the opaque `auth_sessions.secret`.
+	*/ async callback(event) {
+		if (!isSameOriginRequest(event, this.baseURL, { logger: this.logger })) throw new BadRequestError("The login request did not originate from this origin.");
+		const pendingId = useRequestCookie(event, CONSOLE_LOGIN_COOKIE);
+		this.unsetLoginCookie(event);
+		if (typeof pendingId !== "string" || pendingId.length === 0) return this.refuse(event, OAuth2ErrorCode.INVALID_REQUEST);
+		const query = useRequestQuery(event);
+		const pending = await this.loginStore.find(pendingId);
+		if (!pending) return this.refuse(event, OAuth2ErrorCode.INVALID_REQUEST);
+		if (typeof query.state !== "string" || query.state !== pending.state) return this.refuse(event, OAuth2ErrorCode.INVALID_REQUEST);
+		const consumed = await this.loginStore.consume(pendingId);
+		if (!consumed) return this.refuse(event, OAuth2ErrorCode.INVALID_REQUEST);
+		if (typeof query.error === "string" && query.error.length > 0) return this.refuse(event, this.mapCallbackError(query.error));
+		if (typeof query.code !== "string" || query.code.length === 0) return this.refuse(event, OAuth2ErrorCode.INVALID_REQUEST);
+		let payload;
+		let session;
+		try {
+			const grant = await this.resolveHttpClient(event).token.createWithAuthorizationCode({
+				code: query.code,
+				redirect_uri: consumed.redirectUri,
+				client_id: this.definition.clientName,
+				realm_id: consumed.realmId,
+				code_verifier: consumed.codeVerifier
+			});
+			payload = await this.tokenVerifier.verify(grant.access_token);
+			await this.revokeGrant(grant.access_token, grant.refresh_token);
+		} catch (e) {
+			this.logger?.warn(`The console login could not be completed: ${e}`);
+			return this.refuse(event, OAuth2ErrorCode.INVALID_GRANT);
+		}
+		if (payload.kind !== OAuth2TokenKind.ACCESS || payload.sub_kind !== OAuth2SubKind.USER || !payload.sub || !payload.session_id || !payload.client_id || !payload.scope) return this.refuse(event, OAuth2ErrorCode.INVALID_GRANT);
+		try {
+			session = await this.sessionManager.findOneById(payload.session_id);
+		} catch {
+			session = null;
+		}
+		if (!session) return this.refuse(event, OAuth2ErrorCode.INVALID_GRANT);
+		const ttl = new Date(session.expiresAt).getTime() - Date.now();
+		if (ttl <= 0) return this.refuse(event, OAuth2ErrorCode.INVALID_GRANT);
+		const secret = createSessionSecret();
+		await this.sessionRepository.updateSecret(session.id, secret);
+		setSessionCookie(event, this.baseURL, secret, ttl);
+		event.response.headers.set("cache-control", "no-store");
+		return sendRedirect(event, this.buildConsoleURL());
+	}
+	resolveHttpClient(event) {
+		const factory = event.store[INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY];
+		if (!factory) throw new InternalError("No http client is available to redeem the authorization code.");
+		return factory();
+	}
+	/**
+	* Revoke what the exchange returned. Best effort per token: a revoke that
+	* fails must not leave the visitor without a session, and both tokens are
+	* unreachable to anyone but this process either way.
+	*/ async revokeGrant(accessToken, refreshToken) {
+		const tokens = refreshToken ? [accessToken, refreshToken] : [accessToken];
+		for (const token of tokens) try {
+			const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });
+			await this.tokenRevoker.revoke(payload);
+		} catch (e) {
+			this.logger?.warn(`A console login token could not be revoked: ${e}`);
+		}
+	}
+	mapCallbackError(input) {
+		if (CALLBACK_ERROR_CODES.includes(input)) return input;
+		return OAuth2ErrorCode.INVALID_REQUEST;
+	}
+	/**
+	* Land a refusal on the console rather than in a JSON body: this is a
+	* top-level navigation at the end of a login, and the person behind it has
+	* to be told something. The marker set is closed, so nothing
+	* attacker-shaped is echoed.
+	*/ refuse(event, error) {
+		const params = new URLSearchParams({ error });
+		event.response.headers.set("cache-control", "no-store");
+		const target = this.definition.refusalPath ? `${this.buildConsoleURL()}/${this.definition.refusalPath}` : this.buildConsoleURL();
+		return sendRedirect(event, `${target}?${params.toString()}`);
+	}
+	trimmedBaseURL() {
+		return this.baseURL.replace(/\/+$/, "");
+	}
+	basePath() {
+		return getURLBasePath(this.baseURL);
+	}
+	buildConsoleURL() {
+		return getURLBasePath(this.definition.consoleUrl);
+	}
+	buildCallbackURL() {
+		return `${this.trimmedBaseURL()}/${this.definition.segment}/callback`;
+	}
+	/**
+	* Whether the cookies may carry the `Secure` flag. Read from the parsed
+	* URL rather than the raw string: `publicUrl` is validated but never
+	* canonicalized, so a configured `HTTPS://...` would leave a prefix test
+	* false and silently drop the flag.
+	*/ isSecureBaseURL() {
+		try {
+			return new URL(this.baseURL).protocol === "https:";
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* Scoped to the routes that read it, so it never rides an ordinary API
+	* request and two consoles keep separate logins in flight, and
+	* `SameSite=Lax` because the return leg is a top-level navigation that
+	* may come back through an external identity provider, which a `Strict`
+	* cookie would not accompany. It holds nothing but the id of a single-use
+	* cache entry.
+	*/ buildLoginCookiePath() {
+		return `${this.basePath()}/${this.definition.segment}`;
+	}
+	setLoginCookie(event, value) {
+		setResponseCookie(event, CONSOLE_LOGIN_COOKIE, value, {
+			httpOnly: true,
+			sameSite: "lax",
+			secure: this.isSecureBaseURL(),
+			path: this.buildLoginCookiePath(),
+			maxAge: CONSOLE_LOGIN_TTL / 1e3
+		});
+	}
+	unsetLoginCookie(event) {
+		unsetResponseCookie(event, CONSOLE_LOGIN_COOKIE, { path: this.buildLoginCookiePath() });
+	}
+};
+//#endregion
+export { ConsoleLogin };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/workflows/console-login/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["BadRequestError","InternalError","createNanoID","getURLBasePath","OAuth2ErrorCode","OAuth2SubKind","OAuth2TokenKind","serializeOAuth2Scope","setResponseCookie","unsetResponseCookie","useRequestCookie","useRequestQuery","sendRedirect","CONSOLE_LOGIN_COOKIE","CONSOLE_LOGIN_TTL","SYSTEM_CLIENT_SCOPE_NAMES","createOAuth2PKCE","createSessionSecret","setSessionCookie","INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY","isSameOriginRequest","CALLBACK_ERROR_CODES","ACCESS_DENIED","LOGIN_REQUIRED","CONSENT_REQUIRED","ConsoleLogin","definition","baseURL","loginStore","sessionRepository","sessionManager","tokenVerifier","tokenRevoker","logger","ctx","options","login","event","realmId","length","pkce","state","redirectUri","buildCallbackURL","id","save","codeVerifier","code_verifier","setLoginCookie","url","URL","trimmedBaseURL","searchParams","set","clientName","code_challenge","code_challenge_method","response","headers","href","callback","pendingId","unsetLoginCookie","refuse","INVALID_REQUEST","query","pending","find","consumed","consume","error","mapCallbackError","code","payload","session","client","resolveHttpClient","grant","token","createWithAuthorizationCode","redirect_uri","client_id","realm_id","verify","access_token","revokeGrant","refresh_token","e","warn","INVALID_GRANT","kind","ACCESS","sub_kind","USER","sub","session_id","scope","findOneById","ttl","Date","expiresAt","getTime","now","secret","updateSecret","buildConsoleURL","factory","store","accessToken","refreshToken","tokens","skipActiveCheck","revoke","input","includes","params","URLSearchParams","target","refusalPath","toString","replace","basePath","consoleUrl","segment","isSecureBaseURL","protocol","buildLoginCookiePath","value","httpOnly","sameSite","secure","path","maxAge"],"sources":["../../../../../../src/adapters/http/controllers/workflows/console-login/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { IClient } from '@authup/core-http-kit';\nimport { BadRequestError, InternalError } from '@authup/errors';\nimport { createNanoID, getURLBasePath } from '@authup/kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    OAuth2ErrorCode,\n    OAuth2SubKind,\n    OAuth2TokenKind,\n    serializeOAuth2Scope,\n} from '@authup/specs';\nimport { setResponseCookie, unsetResponseCookie, useRequestCookie } from '@routup/basic/cookie';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\nimport {\n    CONSOLE_LOGIN_COOKIE,\n    CONSOLE_LOGIN_TTL,\n    SYSTEM_CLIENT_SCOPE_NAMES,\n    createOAuth2PKCE,\n    createSessionSecret,\n} from '../../../../../core/index.ts';\nimport type {\n    IConsoleLoginStore,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n    ISessionManager,\n    ISessionRepository,\n} from '../../../../../core/index.ts';\nimport { setSessionCookie } from '../../../cookie/index.ts';\nimport { INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY } from '../../../middleware/index.ts';\nimport { isSameOriginRequest } from '../../../request/index.ts';\nimport type { ConsoleLoginContext, ConsoleLoginDefinition } from './types.ts';\n\n/**\n * The OAuth2 error codes the callback echoes back to the console. Closed on\n * purpose: everything else collapses into one generic marker, so nothing a\n * redirect carries reaches a rendered page as-is.\n *\n * `access_denied` is the one the consoles render specially (an accessPolicyId\n * on the console client); the other two land on the same generic notice but\n * say something true in a log or a bug report.\n */\nconst CALLBACK_ERROR_CODES : string[] = [\n    OAuth2ErrorCode.ACCESS_DENIED,\n    OAuth2ErrorCode.LOGIN_REQUIRED,\n    OAuth2ErrorCode.CONSENT_REQUIRED,\n];\n\n/**\n * A console's server-side login (plan 088): the kick and the code redemption.\n * Both exist so no OAuth2 token ever reaches the console's JavaScript. The\n * browser holds an opaque, `HttpOnly` credential naming its `auth_sessions`\n * row instead.\n *\n * One instance per console, parameterized by the client it authenticates\n * against and the path it is served under (`console/account`,\n * `console/admin`: the two pending-login cookies stay apart by RFC 6265 path\n * matching); the account and the admin console differ in nothing else here.\n */\nexport class ConsoleLogin {\n    protected definition : ConsoleLoginDefinition;\n\n    protected baseURL : string;\n\n    protected loginStore : IConsoleLoginStore;\n\n    protected sessionRepository : ISessionRepository;\n\n    protected sessionManager : ISessionManager;\n\n    protected tokenVerifier : IOAuth2TokenVerifier;\n\n    protected tokenRevoker : IOAuth2TokenRevoker;\n\n    protected logger? : Logger;\n\n    constructor(definition: ConsoleLoginDefinition, ctx: ConsoleLoginContext) {\n        this.definition = definition;\n        this.baseURL = ctx.options.baseURL;\n        this.loginStore = ctx.loginStore;\n        this.sessionRepository = ctx.sessionRepository;\n        this.sessionManager = ctx.sessionManager;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.logger = ctx.logger;\n    }\n\n    /**\n     * Start a console login: mint PKCE + `state`, park them in the pending\n     * login, and send the browser to `/authorize`.\n     *\n     * The verifier never reaches the browser, which is what moves the code\n     * exchange server-side: the callback is the only party that can redeem the\n     * code it comes back with.\n     */\n    async login(event: IAppEvent) : Promise<Response> {\n        const realmId = useRequestQuery(event, 'realmId');\n        if (typeof realmId !== 'string' || realmId.length === 0) {\n            // The console client is identified by NAME, and a name needs a\n            // realm hint at `/authorize` and at `/token` alike. The console\n            // asks the visitor for a realm before it links here, so a missing\n            // one is a broken caller rather than a user mistake.\n            throw new BadRequestError('A realm is required to sign in.');\n        }\n\n        const pkce = await createOAuth2PKCE();\n        const state = createNanoID();\n        const redirectUri = this.buildCallbackURL();\n\n        const id = await this.loginStore.save({\n            state,\n            codeVerifier: pkce.code_verifier,\n            redirectUri,\n            realmId,\n        });\n\n        this.setLoginCookie(event, id);\n\n        const url = new URL(`${this.trimmedBaseURL()}/authorize`);\n        url.searchParams.set('response_type', 'code');\n        url.searchParams.set('client_id', this.definition.clientName);\n        url.searchParams.set('realm_id', realmId);\n        url.searchParams.set('scope', serializeOAuth2Scope(SYSTEM_CLIENT_SCOPE_NAMES));\n        url.searchParams.set('redirect_uri', redirectUri);\n        url.searchParams.set('state', state);\n        url.searchParams.set('code_challenge', pkce.code_challenge);\n        url.searchParams.set('code_challenge_method', pkce.code_challenge_method);\n        // The default the consoles' client-side kick sends, so a lingering\n        // session still offers \"continue as / use another account\".\n        url.searchParams.set('prompt', 'select_account');\n\n        event.response.headers.set('cache-control', 'no-store');\n\n        return sendRedirect(event, url.href);\n    }\n\n    /**\n     * Redeem the authorization code and hand the browser its session cookie.\n     *\n     * Nothing token-shaped leaves this method: the pair is verified, used to\n     * find the session it belongs to, and revoked before the response is\n     * built. What the browser gets back is the opaque `auth_sessions.secret`.\n     */\n    async callback(event: IAppEvent) : Promise<Response> {\n        // Finding 4 of plan 088. Without this, an attacker who plants their\n        // own login cookie in the victim's browser from a sibling subdomain\n        // and then navigates them here logs the VICTIM into the ATTACKER's\n        // account. Every real flow arrives from the same-origin `/authorize`\n        // document, so nothing legitimate is refused.\n        if (!isSameOriginRequest(event, this.baseURL, { logger: this.logger })) {\n            throw new BadRequestError('The login request did not originate from this origin.');\n        }\n\n        const pendingId = useRequestCookie(event, CONSOLE_LOGIN_COOKIE);\n\n        // Cleared whichever way this goes: it is single use, and a cookie\n        // outliving its pending login only produces a confusing refusal on\n        // some later page load.\n        this.unsetLoginCookie(event);\n\n        if (typeof pendingId !== 'string' || pendingId.length === 0) {\n            return this.refuse(event, OAuth2ErrorCode.INVALID_REQUEST);\n        }\n\n        const query = useRequestQuery(event);\n\n        // Read before consuming: one browser holds one login cookie per\n        // console, so a second tab's kick replaces the first tab's id. A stale\n        // callback that consumed first would burn the live login of the tab\n        // that is still waiting.\n        const pending = await this.loginStore.find(pendingId);\n        if (!pending) {\n            return this.refuse(event, OAuth2ErrorCode.INVALID_REQUEST);\n        }\n\n        if (typeof query.state !== 'string' || query.state !== pending.state) {\n            return this.refuse(event, OAuth2ErrorCode.INVALID_REQUEST);\n        }\n\n        const consumed = await this.loginStore.consume(pendingId);\n        if (!consumed) {\n            // Lost a race with another callback carrying the same state.\n            return this.refuse(event, OAuth2ErrorCode.INVALID_REQUEST);\n        }\n\n        if (typeof query.error === 'string' && query.error.length > 0) {\n            return this.refuse(event, this.mapCallbackError(query.error));\n        }\n\n        if (typeof query.code !== 'string' || query.code.length === 0) {\n            return this.refuse(event, OAuth2ErrorCode.INVALID_REQUEST);\n        }\n\n        let payload : OAuth2TokenPayload;\n        let session : Session | null;\n\n        try {\n            const client = this.resolveHttpClient(event);\n\n            // RFC 6749 §4.1.3: the token request repeats the `redirect_uri`\n            // the authorization request carried, and the verifier compares the\n            // raw stored string, so it is replayed from the pending login,\n            // never rebuilt from this URL.\n            const grant = await client.token.createWithAuthorizationCode({\n                code: query.code,\n                redirect_uri: consumed.redirectUri,\n                client_id: this.definition.clientName,\n                realm_id: consumed.realmId,\n                code_verifier: consumed.codeVerifier,\n            });\n\n            payload = await this.tokenVerifier.verify(grant.access_token);\n\n            // Both tokens die here, not just the refresh token: an access\n            // token stays a live bearer for its whole lifetime, and the point\n            // of this flow is that no token outlives the redemption. The\n            // session the pair belongs to is what the browser keeps.\n            await this.revokeGrant(grant.access_token, grant.refresh_token);\n        } catch (e) {\n            this.logger?.warn(`The console login could not be completed: ${e}`);\n\n            return this.refuse(event, OAuth2ErrorCode.INVALID_GRANT);\n        }\n\n        if (\n            payload.kind !== OAuth2TokenKind.ACCESS ||\n            payload.sub_kind !== OAuth2SubKind.USER ||\n            !payload.sub ||\n            !payload.session_id ||\n            !payload.client_id ||\n            !payload.scope\n        ) {\n            return this.refuse(event, OAuth2ErrorCode.INVALID_GRANT);\n        }\n\n        try {\n            session = await this.sessionManager.findOneById(payload.session_id);\n        } catch {\n            session = null;\n        }\n\n        if (!session) {\n            return this.refuse(event, OAuth2ErrorCode.INVALID_GRANT);\n        }\n\n        const ttl = new Date(session.expiresAt).getTime() - Date.now();\n        if (ttl <= 0) {\n            return this.refuse(event, OAuth2ErrorCode.INVALID_GRANT);\n        }\n\n        const secret = createSessionSecret();\n        await this.sessionRepository.updateSecret(session.id, secret);\n\n        setSessionCookie(event, this.baseURL, secret, ttl);\n\n        event.response.headers.set('cache-control', 'no-store');\n\n        return sendRedirect(event, this.buildConsoleURL());\n    }\n\n    // ---------------------------------------------------------\n\n    protected resolveHttpClient(event: IAppEvent) : IClient {\n        const factory = event.store[INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY] as (() => IClient) | undefined;\n        if (!factory) {\n            throw new InternalError('No http client is available to redeem the authorization code.');\n        }\n\n        return factory();\n    }\n\n    /**\n     * Revoke what the exchange returned. Best effort per token: a revoke that\n     * fails must not leave the visitor without a session, and both tokens are\n     * unreachable to anyone but this process either way.\n     */\n    protected async revokeGrant(accessToken: string, refreshToken?: string) : Promise<void> {\n        const tokens = refreshToken ? [accessToken, refreshToken] : [accessToken];\n\n        for (const token of tokens) {\n            try {\n                const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n\n                await this.tokenRevoker.revoke(payload);\n            } catch (e) {\n                this.logger?.warn(`A console login token could not be revoked: ${e}`);\n            }\n        }\n    }\n\n    protected mapCallbackError(input: string) : `${OAuth2ErrorCode}` {\n        if (CALLBACK_ERROR_CODES.includes(input)) {\n            return input as `${OAuth2ErrorCode}`;\n        }\n\n        return OAuth2ErrorCode.INVALID_REQUEST;\n    }\n\n    /**\n     * Land a refusal on the console rather than in a JSON body: this is a\n     * top-level navigation at the end of a login, and the person behind it has\n     * to be told something. The marker set is closed, so nothing\n     * attacker-shaped is echoed.\n     */\n    protected refuse(event: IAppEvent, error: `${OAuth2ErrorCode}`) : Response {\n        const params = new URLSearchParams({ error });\n\n        event.response.headers.set('cache-control', 'no-store');\n\n        const target = this.definition.refusalPath ?\n            `${this.buildConsoleURL()}/${this.definition.refusalPath}` :\n            this.buildConsoleURL();\n\n        return sendRedirect(event, `${target}?${params.toString()}`);\n    }\n\n    // ---------------------------------------------------------\n\n    protected trimmedBaseURL() : string {\n        return this.baseURL.replace(/\\/+$/, '');\n    }\n\n    protected basePath() : string {\n        return getURLBasePath(this.baseURL);\n    }\n\n    protected buildConsoleURL() : string {\n        return getURLBasePath(this.definition.consoleUrl);\n    }\n\n    protected buildCallbackURL() : string {\n        return `${this.trimmedBaseURL()}/${this.definition.segment}/callback`;\n    }\n\n    /**\n     * Whether the cookies may carry the `Secure` flag. Read from the parsed\n     * URL rather than the raw string: `publicUrl` is validated but never\n     * canonicalized, so a configured `HTTPS://...` would leave a prefix test\n     * false and silently drop the flag.\n     */\n    protected isSecureBaseURL() : boolean {\n        try {\n            return new URL(this.baseURL).protocol === 'https:';\n        } catch {\n            return false;\n        }\n    }\n\n    /**\n     * Scoped to the routes that read it, so it never rides an ordinary API\n     * request and two consoles keep separate logins in flight, and\n     * `SameSite=Lax` because the return leg is a top-level navigation that\n     * may come back through an external identity provider, which a `Strict`\n     * cookie would not accompany. It holds nothing but the id of a single-use\n     * cache entry.\n     */\n    protected buildLoginCookiePath() : string {\n        // The API's own path, not the console's: this cookie is set and read\n        // by the two routes below, which stay on this origin.\n        return `${this.basePath()}/${this.definition.segment}`;\n    }\n\n    protected setLoginCookie(event: IAppEvent, value: string) : void {\n        setResponseCookie(event, CONSOLE_LOGIN_COOKIE, value, {\n            httpOnly: true,\n            sameSite: 'lax',\n            secure: this.isSecureBaseURL(),\n            path: this.buildLoginCookiePath(),\n            maxAge: CONSOLE_LOGIN_TTL / 1000,\n        });\n    }\n\n    protected unsetLoginCookie(event: IAppEvent) : void {\n        unsetResponseCookie(event, CONSOLE_LOGIN_COOKIE, { path: this.buildLoginCookiePath() });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDA,MAAMqB,uBAAkC;CACpCjB,gBAAgBkB;CAChBlB,gBAAgBmB;CAChBnB,gBAAgBoB;AACnB;;;;;;;;;;;GAaD,IAAaC,eAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYP,YAAoCQ,KAA0B;EACtE,KAAKR,aAAaA;EAClB,KAAKC,UAAUO,IAAIC,QAAQR;EAC3B,KAAKC,aAAaM,IAAIN;EACtB,KAAKC,oBAAoBK,IAAIL;EAC7B,KAAKC,iBAAiBI,IAAIJ;EAC1B,KAAKC,gBAAgBG,IAAIH;EACzB,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,SAASC,IAAID;CACtB;;;;;;;;IAUA,MAAMG,MAAMC,OAAsC;EAC9C,MAAMC,UAAU3B,gBAAgB0B,OAAO,SAAA;EACvC,IAAI,OAAOC,YAAY,YAAYA,QAAQC,WAAW,GAKlD,MAAM,IAAIvC,gBAAgB,iCAAA;EAG9B,MAAMwC,OAAO,MAAMxB,iBAAAA;EACnB,MAAMyB,QAAQvC,aAAAA;EACd,MAAMwC,cAAc,KAAKC,iBAAgB;EAEzC,MAAMC,KAAK,MAAM,KAAKhB,WAAWiB,KAAK;GAClCJ;GACAK,cAAcN,KAAKO;GACnBL;GACAJ;EACJ,CAAA;EAEA,KAAKU,eAAeX,OAAOO,EAAAA;EAE3B,MAAMK,MAAM,IAAIC,IAAI,GAAG,KAAKC,eAAc,EAAG,WAAW;EACxDF,IAAIG,aAAaC,IAAI,iBAAiB,MAAA;EACtCJ,IAAIG,aAAaC,IAAI,aAAa,KAAK3B,WAAW4B,UAAU;EAC5DL,IAAIG,aAAaC,IAAI,YAAYf,OAAAA;EACjCW,IAAIG,aAAaC,IAAI,SAAS9C,qBAAqBQ,yBAAAA,CAAAA;EACnDkC,IAAIG,aAAaC,IAAI,gBAAgBX,WAAAA;EACrCO,IAAIG,aAAaC,IAAI,SAASZ,KAAAA;EAC9BQ,IAAIG,aAAaC,IAAI,kBAAkBb,KAAKe,cAAc;EAC1DN,IAAIG,aAAaC,IAAI,yBAAyBb,KAAKgB,qBAAqB;EAGxEP,IAAIG,aAAaC,IAAI,UAAU,gBAAA;EAE/BhB,MAAMoB,SAASC,QAAQL,IAAI,iBAAiB,UAAA;EAE5C,OAAOzC,aAAayB,OAAOY,IAAIU,IAAI;CACvC;;;;;;;IASA,MAAMC,SAASvB,OAAsC;EAMjD,IAAI,CAACjB,oBAAoBiB,OAAO,KAAKV,SAAS,EAAEM,QAAQ,KAAKA,OAAO,CAAA,GAChE,MAAM,IAAIjC,gBAAgB,uDAAA;EAG9B,MAAM6D,YAAYnD,iBAAiB2B,OAAOxB,oBAAAA;EAK1C,KAAKiD,iBAAiBzB,KAAAA;EAEtB,IAAI,OAAOwB,cAAc,YAAYA,UAAUtB,WAAW,GACtD,OAAO,KAAKwB,OAAO1B,OAAOjC,gBAAgB4D,eAAe;EAG7D,MAAMC,QAAQtD,gBAAgB0B,KAAAA;EAM9B,MAAM6B,UAAU,MAAM,KAAKtC,WAAWuC,KAAKN,SAAAA;EAC3C,IAAI,CAACK,SACD,OAAO,KAAKH,OAAO1B,OAAOjC,gBAAgB4D,eAAe;EAG7D,IAAI,OAAOC,MAAMxB,UAAU,YAAYwB,MAAMxB,UAAUyB,QAAQzB,OAC3D,OAAO,KAAKsB,OAAO1B,OAAOjC,gBAAgB4D,eAAe;EAG7D,MAAMI,WAAW,MAAM,KAAKxC,WAAWyC,QAAQR,SAAAA;EAC/C,IAAI,CAACO,UAED,OAAO,KAAKL,OAAO1B,OAAOjC,gBAAgB4D,eAAe;EAG7D,IAAI,OAAOC,MAAMK,UAAU,YAAYL,MAAMK,MAAM/B,SAAS,GACxD,OAAO,KAAKwB,OAAO1B,OAAO,KAAKkC,iBAAiBN,MAAMK,KAAK,CAAA;EAG/D,IAAI,OAAOL,MAAMO,SAAS,YAAYP,MAAMO,KAAKjC,WAAW,GACxD,OAAO,KAAKwB,OAAO1B,OAAOjC,gBAAgB4D,eAAe;EAG7D,IAAIS;EACJ,IAAIC;EAEJ,IAAI;GAOA,MAAMG,QAAQ,MANC,KAAKD,kBAAkBvC,KAMlBsC,CAAAA,CAAOG,MAAMC,4BAA4B;IACzDP,MAAMP,MAAMO;IACZQ,cAAcZ,SAAS1B;IACvBuC,WAAW,KAAKvD,WAAW4B;IAC3B4B,UAAUd,SAAS9B;IACnBS,eAAeqB,SAAStB;GAC5B,CAAA;GAEA2B,UAAU,MAAM,KAAK1C,cAAcoD,OAAON,MAAMO,YAAY;GAM5D,MAAM,KAAKC,YAAYR,MAAMO,cAAcP,MAAMS,aAAa;EAClE,SAASC,GAAG;GACR,KAAKtD,QAAQuD,KAAK,6CAA6CD,GAAG;GAElE,OAAO,KAAKxB,OAAO1B,OAAOjC,gBAAgBqF,aAAa;EAC3D;EAEA,IACIhB,QAAQiB,SAASpF,gBAAgBqF,UACjClB,QAAQmB,aAAavF,cAAcwF,QACnC,CAACpB,QAAQqB,OACT,CAACrB,QAAQsB,cACT,CAACtB,QAAQQ,aACT,CAACR,QAAQuB,OAET,OAAO,KAAKjC,OAAO1B,OAAOjC,gBAAgBqF,aAAa;EAG3D,IAAI;GACAf,UAAU,MAAM,KAAK5C,eAAemE,YAAYxB,QAAQsB,UAAU;EACtE,QAAQ;GACJrB,UAAU;EACd;EAEA,IAAI,CAACA,SACD,OAAO,KAAKX,OAAO1B,OAAOjC,gBAAgBqF,aAAa;EAG3D,MAAMS,MAAM,IAAIC,KAAKzB,QAAQ0B,SAAS,CAAA,CAAEC,QAAO,IAAKF,KAAKG,IAAG;EAC5D,IAAIJ,OAAO,GACP,OAAO,KAAKnC,OAAO1B,OAAOjC,gBAAgBqF,aAAa;EAG3D,MAAMc,SAAStF,oBAAAA;EACf,MAAM,KAAKY,kBAAkB2E,aAAa9B,QAAQ9B,IAAI2D,MAAAA;EAEtDrF,iBAAiBmB,OAAO,KAAKV,SAAS4E,QAAQL,GAAAA;EAE9C7D,MAAMoB,SAASC,QAAQL,IAAI,iBAAiB,UAAA;EAE5C,OAAOzC,aAAayB,OAAO,KAAKoE,gBAAe,CAAA;CACnD;CAIU7B,kBAAkBvC,OAA4B;EACpD,MAAMqE,UAAUrE,MAAMsE,MAAMxF;EAC5B,IAAI,CAACuF,SACD,MAAM,IAAIzG,cAAc,+DAAA;EAG5B,OAAOyG,QAAAA;CACX;;;;;IAOA,MAAgBrB,YAAYuB,aAAqBC,cAAuC;EACpF,MAAMC,SAASD,eAAe,CAACD,aAAaC,YAAa,IAAG,CAACD,WAAY;EAEzE,KAAK,MAAM9B,SAASgC,QAChB,IAAI;GACA,MAAMrC,UAAU,MAAM,KAAK1C,cAAcoD,OAAOL,OAAO,EAAEiC,iBAAiB,KAAK,CAAA;GAE/E,MAAM,KAAK/E,aAAagF,OAAOvC,OAAAA;EACnC,SAASc,GAAG;GACR,KAAKtD,QAAQuD,KAAK,+CAA+CD,GAAG;EACxE;CAER;CAEUhB,iBAAiB0C,OAAsC;EAC7D,IAAI5F,qBAAqB6F,SAASD,KAAAA,GAC9B,OAAOA;EAGX,OAAO7G,gBAAgB4D;CAC3B;;;;;;IAQA,OAAiB3B,OAAkBiC,OAAwC;EACvE,MAAM6C,SAAS,IAAIC,gBAAgB,EAAE9C,MAAM,CAAA;EAE3CjC,MAAMoB,SAASC,QAAQL,IAAI,iBAAiB,UAAA;EAE5C,MAAMgE,SAAS,KAAK3F,WAAW4F,cAC3B,GAAG,KAAKb,gBAAe,EAAG,GAAG,KAAK/E,WAAW4F,gBAC7C,KAAKb,gBAAe;EAExB,OAAO7F,aAAayB,OAAO,GAAGgF,OAAO,GAAGF,OAAOI,SAAQ,GAAI;CAC/D;CAIUpE,iBAA0B;EAChC,OAAO,KAAKxB,QAAQ6F,QAAQ,QAAQ,EAAA;CACxC;CAEUC,WAAoB;EAC1B,OAAOtH,eAAe,KAAKwB,OAAO;CACtC;CAEU8E,kBAA2B;EACjC,OAAOtG,eAAe,KAAKuB,WAAWgG,UAAU;CACpD;CAEU/E,mBAA4B;EAClC,OAAO,GAAG,KAAKQ,eAAc,EAAG,GAAG,KAAKzB,WAAWiG,QAAQ;CAC/D;;;;;;IAQA,kBAAsC;EAClC,IAAI;GACA,OAAO,IAAIzE,IAAI,KAAKvB,OAAO,CAAA,CAAEkG,aAAa;EAC9C,QAAQ;GACJ,OAAO;EACX;CACJ;;;;;;;;IAUA,uBAA0C;EAGtC,OAAO,GAAG,KAAKJ,SAAQ,EAAG,GAAG,KAAK/F,WAAWiG;CACjD;CAEU3E,eAAeX,OAAkB0F,OAAsB;EAC7DvH,kBAAkB6B,OAAOxB,sBAAsBkH,OAAO;GAClDC,UAAU;GACVC,UAAU;GACVC,QAAQ,KAAKN,gBAAe;GAC5BO,MAAM,KAAKL,qBAAoB;GAC/BM,QAAQtH,oBAAoB;EAChC,CAAA;CACJ;CAEUgD,iBAAiBzB,OAAyB;EAChD5B,oBAAoB4B,OAAOxB,sBAAsB,EAAEsH,MAAM,KAAKL,qBAAoB,EAAG,CAAA;CACzF;AACJ"}

package/dist/adapters/http/controllers/workflows/console-login/types.d.ts

@@ -0,0 +1,58 @@
+import type { Logger } from '@authup/server-kit';
+import type { IConsoleLoginStore, IOAuth2TokenRevoker, IOAuth2TokenVerifier, ISessionManager, ISessionRepository } from '../../../../../core/index.ts';
+export type ConsoleLoginDefinition = {
+    /**
+     * The per-realm OAuth2 client the console authenticates against, by
+     * NAME (`account-console`, `admin-console`). A name needs a realm hint at
+     * `/authorize` and at `/token` alike, which is why the kick requires one.
+     */
+    clientName: string;
+    /**
+     * The path the console is served under, relative to the deployment base
+     * path (`console/account`, `console/admin`; it may carry a slash). It
+     * scopes the login cookie and builds the callback URL, both of which live
+     * on the API's own origin whatever the console url says.
+     */
+    segment: string;
+    /**
+     * Where the console itself is served (`<name>Console.url`). The
+     * browser lands there once the credential is issued, so a console under a
+     * path of its own is landed on correctly.
+     *
+     * Only its PATH is read, which is exact rather than a shortcut: a console
+     * on a foreign origin could never present the `SameSite=Strict`
+     * credential this flow issues, and normalizeConfig refuses that shape at
+     * boot for exactly that reason.
+     */
+    consoleUrl: string;
+    /**
+     * Where a refused callback lands, relative to the console root
+     * (`login` -> `<base>/<segment>/login?error=...`). Defaults to the root:
+     * the page that renders the error marker differs per console.
+     */
+    refusalPath?: string;
+};
+export type ConsoleLoginContext = {
+    options: {
+        baseURL: string;
+    };
+    /**
+     * Holds the PKCE verifier and `state` while the browser is away at
+     * `/authorize` (plan 088).
+     */
+    loginStore: IConsoleLoginStore;
+    /**
+     * Writes and clears the opaque credential on the session row. The session
+     * MANAGER cannot: the column is `select: false` and has a dedicated write.
+     */
+    sessionRepository: ISessionRepository;
+    sessionManager: ISessionManager;
+    /**
+     * Reads the exchanged access token (session, subject) and the refresh
+     * token, so both can be revoked before either leaves the process.
+     */
+    tokenVerifier: IOAuth2TokenVerifier;
+    tokenRevoker: IOAuth2TokenRevoker;
+    logger?: Logger;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/workflows/console-login/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/console-login/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EACrB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;OASG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,OAAO,EAAE;QACL,OAAO,EAAE,MAAM,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,UAAU,EAAE,kBAAkB,CAAC;IAC/B;;;OAGG;IACH,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,cAAc,EAAE,eAAe,CAAC;IAChC;;;OAGG;IACH,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/controllers/workflows/index.d.ts

@@ -1,7 +1,9 @@
 export * from './account/index.ts';
 export * from './activate/index.ts';
+export * from './admin/index.ts';
 export * from './authenticator-challenge/index.ts';
 export * from './authorize/index.ts';
+export * from './console-login/index.ts';
 export * from './jwks/index.ts';
 export * from './logout/index.ts';
 export * from './openid/index.ts';

package/dist/adapters/http/controllers/workflows/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oCAAoC,CAAC;AACnD,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oCAAoC,CAAC;AACnD,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC"}

package/dist/adapters/http/controllers/workflows/index.mjs

@@ -1,10 +1,14 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { ConsoleLogin } from "./console-login/module.mjs";
+import "./console-login/index.mjs";
 import { AccountController } from "./account/module.mjs";
 import "./account/index.mjs";
 import { ActivateController } from "./activate/module.mjs";
 import "./activate/index.mjs";
+import { AdminController } from "./admin/module.mjs";
+import "./admin/index.mjs";
 import { AuthenticatorChallengeController } from "./authenticator-challenge/module.mjs";
 import "./authenticator-challenge/index.mjs";
 import { AuthorizeController } from "./authorize/module.mjs";
@@ -28,4 +32,4 @@ import { TokenController } from "./token/module.mjs";
 import "./token/index.mjs";
 import { UserInfoController } from "./userinfo/module.mjs";
 import "./userinfo/index.mjs";
-export { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, UserInfoController, getJwkRouteHandler, getJwksRouteHandler };
+export { AccountController, ActivateController, AdminController, AuthenticatorChallengeController, AuthorizeController, ConsoleLogin, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, UserInfoController, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/logout/module.d.ts

@@ -1,3 +1,4 @@
+import type { EndSessionResponse } from '@authup/core-http-kit';
 import type { IAppEvent } from 'routup';
 import type { IOAuth2EndSessionService } from '../../../../../core/index.ts';
 import { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';
@@ -7,8 +8,36 @@ export declare class LogoutController {
     protected endSessionService: IOAuth2EndSessionService;
     protected validator: OAuth2EndSessionRequestValidator;
     constructor(ctx: LogoutControllerContext);
-    serve(event: IAppEvent): Promise<string | Response>;
-    execute(event: IAppEvent): Promise<string | Response>;
-    protected handle(event: IAppEvent): Promise<string | Response>;
+    /**
+     * `end_session_endpoint` keeps both of its OIDC bindings, and both are
+     * BROWSER NAVIGATIONS: the RP either redirects the user here (GET) or
+     * auto-submits a form at it (form_post). Neither can consume a JSON
+     * answer, so both hand over to the console service, carrying the
+     * request's own parameters.
+     *
+     * The revoke moved to the JSON call the rendered page makes (plan 101
+     * D2). It could not stay here: the page needs `serverRevoked`,
+     * `hintSub` and `hintSubKind` to decide whether to tear its own local
+     * session down, and those must reach it as the answer to its OWN
+     * request. Putting them in the redirect URL would let anyone craft
+     * them, which is exactly the forced-logout CSRF the client-side gate
+     * exists to refuse.
+     *
+     * The consequence to know: a browser with JavaScript disabled no
+     * longer revokes. It also never returns to the RP, so both sides stay
+     * consistent rather than the RP believing a logout it did not get.
+     */
+    serve(event: IAppEvent): Promise<Response>;
+    execute(event: IAppEvent): Promise<Response | EndSessionResponse>;
+    protected isJSONRequest(event: IAppEvent): boolean;
+    protected forward(event: IAppEvent): Promise<Response>;
+    /**
+     * The end-session work itself, unchanged from when it ran on the page
+     * GET: validate, verify the hint, revoke the session it references, and
+     * validate the post-logout redirect. Only the reply is different, and
+     * only because the caller is now the page rather than the browser's
+     * address bar.
+     */
+    protected endSession(event: IAppEvent): Promise<EndSessionResponse>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/logout/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAA2B,MAAM,8BAA8B,CAAC;AACtG,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAGhF,OAAO,KAAK,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEnF,qBACa,gBAAgB;IACzB,SAAS,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE3C,SAAS,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;IAEtD,SAAS,CAAC,SAAS,EAAE,gCAAgC,CAAC;gBAE1C,GAAG,EAAE,uBAAuB;IAOlC,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;IAM/D,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;cAIvD,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;CAsFvE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAQhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAA2B,MAAM,8BAA8B,CAAC;AACtG,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAGhF,OAAO,KAAK,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEnF,qBACa,gBAAgB;IACzB,SAAS,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE3C,SAAS,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;IAEtD,SAAS,CAAC,SAAS,EAAE,gCAAgC,CAAC;gBAE1C,GAAG,EAAE,uBAAuB;IAMxC;;;;;;;;;;;;;;;;;;OAkBG;IAEG,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAKtD,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,GAAG,kBAAkB,CAAC;IAWnF,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO;cAWnC,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAQ5D;;;;;;OAMG;cACa,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAyE5E"}

package/dist/adapters/http/controllers/workflows/logout/module.mjs

@@ -5,10 +5,9 @@ import { OAuth2EndSessionRequestValidator } from "../../../../../core/oauth2/end
 import "../../../../../core/index.mjs";
 import { readFromLocations } from "../../../request/helpers/locations.mjs";
 import "../../../request/index.mjs";
-import { renderAuthConsolePage } from "../../../ui/auth-console/module.mjs";
-import "../../../ui/index.mjs";
+import { redirectToAuthConsole } from "../auth-console.mjs";
 import { URL } from "node:url";
-import { sendRedirect } from "routup";
+import { getRequestHeader } from "routup";
 import { DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/logout/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -34,13 +33,46 @@ var LogoutController = class {
 		this.endSessionService = ctx.endSessionService;
 		this.validator = new OAuth2EndSessionRequestValidator();
 	}
-	async serve(event) {
-		return this.handle(event);
+	/**
+	* `end_session_endpoint` keeps both of its OIDC bindings, and both are
+	* BROWSER NAVIGATIONS: the RP either redirects the user here (GET) or
+	* auto-submits a form at it (form_post). Neither can consume a JSON
+	* answer, so both hand over to the console service, carrying the
+	* request's own parameters.
+	*
+	* The revoke moved to the JSON call the rendered page makes (plan 101
+	* D2). It could not stay here: the page needs `serverRevoked`,
+	* `hintSub` and `hintSubKind` to decide whether to tear its own local
+	* session down, and those must reach it as the answer to its OWN
+	* request. Putting them in the redirect URL would let anyone craft
+	* them, which is exactly the forced-logout CSRF the client-side gate
+	* exists to refuse.
+	*
+	* The consequence to know: a browser with JavaScript disabled no
+	* longer revokes. It also never returns to the RP, so both sides stay
+	* consistent rather than the RP believing a logout it did not get.
+	*/ async serve(event) {
+		return this.forward(event);
 	}
 	async execute(event) {
-		return this.handle(event);
+		if (this.isJSONRequest(event)) return this.endSession(event);
+		return this.forward(event);
 	}
-	async handle(event) {
+	isJSONRequest(event) {
+		const contentType = getRequestHeader(event, "content-type");
+		return typeof contentType === "string" && contentType.toLowerCase().includes("application/json");
+	}
+	async forward(event) {
+		const merged = await readFromLocations(event, ["body", "query"]);
+		return redirectToAuthConsole(event, this.options.authConsoleUrl, "/logout", merged);
+	}
+	/**
+	* The end-session work itself, unchanged from when it ran on the page
+	* GET: validate, verify the hint, revoke the session it references, and
+	* validate the post-logout redirect. Only the reply is different, and
+	* only because the caller is now the page rather than the browser's
+	* address bar.
+	*/ async endSession(event) {
 		const merged = await readFromLocations(event, ["body", "query"]);
 		let data;
 		try {
@@ -61,23 +93,15 @@ var LogoutController = class {
 			if (result.state) url.searchParams.set("state", result.state);
 			redirect = url.href;
 		}
-		if (serverRevoked && redirect) return sendRedirect(event, redirect);
-		const requestURL = new URL(event.request.url);
-		return renderAuthConsolePage(event, {
-			url: "/logout",
-			payload: {
-				config: { baseURL: this.options.baseURL },
-				data: {
-					client: result.clientName ? { name: result.clientName } : void 0,
-					hintVerified: result.hintVerified,
-					hintSub: result.hintVerified ? result.sub : void 0,
-					hintSubKind: result.hintVerified ? result.subKind : void 0,
-					serverRevoked,
-					redirect,
-					requestPath: `${requestURL.pathname}${requestURL.search}`
-				}
-			}
-		});
+		event.response.headers.set("cache-control", "no-store");
+		return {
+			clientName: result.clientName,
+			hintVerified: result.hintVerified,
+			hintSub: result.hintVerified ? result.sub : void 0,
+			hintSubKind: result.hintVerified ? result.subKind : void 0,
+			serverRevoked,
+			redirect
+		};
 	}
 };
 _ts_decorate([

package/dist/adapters/http/controllers/workflows/logout/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","sendRedirect","OAuth2EndSessionRequestValidator","readFromLocations","renderAuthConsolePage","LogoutController","options","endSessionService","validator","ctx","serve","event","handle","execute","merged","data","run","id_token_hint","result","verify","serverRevoked","hintVerified","sessionId","sub","subKind","revoke","redirect","redirectUri","url","state","searchParams","set","href","requestURL","request","payload","config","baseURL","client","clientName","name","undefined","hintSub","hintSubKind","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\nimport type { IOAuth2EndSessionService, OAuth2EndSessionRequest } from '../../../../../core/index.ts';\nimport { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport { renderAuthConsolePage } from '../../../ui/index.ts';\nimport type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';\n\n@DController('/logout')\nexport class LogoutController {\n    protected options: LogoutControllerOptions;\n\n    protected endSessionService: IOAuth2EndSessionService;\n\n    protected validator: OAuth2EndSessionRequestValidator;\n\n    constructor(ctx: LogoutControllerContext) {\n        this.options = ctx.options;\n        this.endSessionService = ctx.endSessionService;\n        this.validator = new OAuth2EndSessionRequestValidator();\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    // OIDC RP-Initiated Logout allows form_post on the same endpoint.\n    @DPost('', [])\n    async execute(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    protected async handle(event: IAppEvent): Promise<string | Response> {\n        const merged = await readFromLocations(event, ['body', 'query']);\n\n        // Malformed input (oversized / duplicated params) must never dead-end\n        // the human behind the browser on a JSON error, nor discard a valid\n        // id_token_hint: a bad *cosmetic* param (post_logout_redirect_uri /\n        // state / client_id / realm hint) must NOT cancel the\n        // security-critical revoke the hint authorizes. So on a full-request\n        // validation failure, retry with the hint ALONE — the revoke needs\n        // nothing else: its subject/session come from the verified hint's\n        // claims, and client resolution degrades gracefully (the service\n        // falls back to the hint's sole `aud`, scoped by the hint's own realm\n        // claim — the dropped request params only affected the confirm page's\n        // client name and the redirect, which is dropped anyway). Only a\n        // malformed hint itself falls through to the parameter-less confirm\n        // page.\n        let data: OAuth2EndSessionRequest;\n        try {\n            data = await this.validator.run(merged);\n        } catch {\n            try {\n                data = await this.validator.run({ id_token_hint: merged.id_token_hint });\n            } catch {\n                data = {};\n            }\n        }\n\n        const result = await this.endSessionService.verify(data);\n\n        // A signature-verified id_token_hint proves possession — revoke the\n        // referenced session server-side immediately (only if it belongs to the\n        // hint's subject). Without a hint we mutate nothing; the SSR page's\n        // sign-out is a click-gated, bearer-authenticated action.\n        let serverRevoked = false;\n        if (result.hintVerified && result.sessionId && result.sub && result.subKind) {\n            serverRevoked = await this.endSessionService.revoke(\n                result.sessionId,\n                result.sub,\n                result.subKind,\n            );\n        }\n\n        // Build the validated post-logout redirect (the open-redirect guard\n        // lives in the service; `state` rides only alongside a validated uri).\n        let redirect: string | undefined;\n        if (result.redirectUri) {\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            redirect = url.href;\n        }\n\n        // Bounce straight back to the RP ONLY when the logout was actually\n        // performed server-side (a verified hint revoked the session). A\n        // hint-less or forged request MUST NOT silently redirect without ending\n        // the session — otherwise the RP treats a no-op round-trip as a\n        // successful logout while the authup session survives. Instead render\n        // the click-gated confirm page, which performs the bearer-authenticated\n        // sign-out and then redirects.\n        if (serverRevoked && redirect) {\n            return sendRedirect(event, redirect);\n        }\n\n        const requestURL = new URL(event.request.url);\n\n        return renderAuthConsolePage(event, {\n            url: '/logout',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    client: result.clientName ? { name: result.clientName } : undefined,\n                    hintVerified: result.hintVerified,\n                    // never reflect an unverified hint's claims\n                    hintSub: result.hintVerified ? result.sub : undefined,\n                    hintSubKind: result.hintVerified ? result.subKind : undefined,\n                    serverRevoked,\n                    // the (already validated) uri to return to after a click-gated\n                    // sign-out; carries `state` when present\n                    redirect,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAaS,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,YAAY,IAAIN,iCAAAA;CACzB;CAEA,MACMQ,MAAM,OAA0D;EAClE,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAGA,MACME,QAAQ,OAA0D;EACpE,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEA,MAAgBC,OAAOD,OAA8C;EACjE,MAAMG,SAAS,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAe/D,IAAII;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKP,UAAUQ,IAAIF,MAAAA;EACpC,QAAQ;GACJ,IAAI;IACAC,OAAO,MAAM,KAAKP,UAAUQ,IAAI,EAAEC,eAAeH,OAAOG,cAAc,CAAA;GAC1E,QAAQ;IACJF,OAAO,CAAC;GACZ;EACJ;EAEA,MAAMG,SAAS,MAAM,KAAKX,kBAAkBY,OAAOJ,IAAAA;EAMnD,IAAIK,gBAAgB;EACpB,IAAIF,OAAOG,gBAAgBH,OAAOI,aAAaJ,OAAOK,OAAOL,OAAOM,SAChEJ,gBAAgB,MAAM,KAAKb,kBAAkBkB,OACzCP,OAAOI,WACPJ,OAAOK,KACPL,OAAOM,OAAO;EAMtB,IAAIE;EACJ,IAAIR,OAAOS,aAAa;GACpB,MAAMC,MAAM,IAAI5B,IAAIkB,OAAOS,WAAW;GACtC,IAAIT,OAAOW,OACPD,IAAIE,aAAaC,IAAI,SAASb,OAAOW,KAAK;GAG9CH,WAAWE,IAAII;EACnB;EASA,IAAIZ,iBAAiBM,UACjB,OAAOzB,aAAaU,OAAOe,QAAAA;EAG/B,MAAMO,aAAa,IAAIjC,IAAIW,MAAMuB,QAAQN,GAAG;EAE5C,OAAOxB,sBAAsBO,OAAO;GAChCiB,KAAK;GACLO,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK/B,QAAQ+B,QAAQ;IACxCtB,MAAM;KACFuB,QAAQpB,OAAOqB,aAAa,EAAEC,MAAMtB,OAAOqB,WAAW,IAAIE,KAAAA;KAC1DpB,cAAcH,OAAOG;KAErBqB,SAASxB,OAAOG,eAAeH,OAAOK,MAAMkB,KAAAA;KAC5CE,aAAazB,OAAOG,eAAeH,OAAOM,UAAUiB,KAAAA;KACpDrB;KAGAM;KACAkB,aAAa,GAAGX,WAAWY,WAAWZ,WAAWa;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","getRequestHeader","OAuth2EndSessionRequestValidator","readFromLocations","redirectToAuthConsole","LogoutController","options","endSessionService","validator","ctx","serve","event","forward","execute","isJSONRequest","endSession","contentType","toLowerCase","includes","merged","authConsoleUrl","data","run","id_token_hint","result","verify","serverRevoked","hintVerified","sessionId","sub","subKind","revoke","redirect","redirectUri","url","state","searchParams","set","href","response","headers","clientName","hintSub","undefined","hintSubKind"],"sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { EndSessionResponse } from '@authup/core-http-kit';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader } from 'routup';\nimport type { IOAuth2EndSessionService, OAuth2EndSessionRequest } from '../../../../../core/index.ts';\nimport { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport { redirectToAuthConsole } from '../auth-console.ts';\nimport type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';\n\n@DController('/logout')\nexport class LogoutController {\n    protected options: LogoutControllerOptions;\n\n    protected endSessionService: IOAuth2EndSessionService;\n\n    protected validator: OAuth2EndSessionRequestValidator;\n\n    constructor(ctx: LogoutControllerContext) {\n        this.options = ctx.options;\n        this.endSessionService = ctx.endSessionService;\n        this.validator = new OAuth2EndSessionRequestValidator();\n    }\n\n    /**\n     * `end_session_endpoint` keeps both of its OIDC bindings, and both are\n     * BROWSER NAVIGATIONS: the RP either redirects the user here (GET) or\n     * auto-submits a form at it (form_post). Neither can consume a JSON\n     * answer, so both hand over to the console service, carrying the\n     * request's own parameters.\n     *\n     * The revoke moved to the JSON call the rendered page makes (plan 101\n     * D2). It could not stay here: the page needs `serverRevoked`,\n     * `hintSub` and `hintSubKind` to decide whether to tear its own local\n     * session down, and those must reach it as the answer to its OWN\n     * request. Putting them in the redirect URL would let anyone craft\n     * them, which is exactly the forced-logout CSRF the client-side gate\n     * exists to refuse.\n     *\n     * The consequence to know: a browser with JavaScript disabled no\n     * longer revokes. It also never returns to the RP, so both sides stay\n     * consistent rather than the RP believing a logout it did not get.\n     */\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<Response> {\n        return this.forward(event);\n    }\n\n    @DPost('', [])\n    async execute(@DContext() event: IAppEvent): Promise<Response | EndSessionResponse> {\n        // A JSON body is the console page asking us to end the session; a\n        // form body is the OIDC form_post binding, i.e. a navigation. A\n        // browser cannot navigate with a JSON body, so the two never blur.\n        if (this.isJSONRequest(event)) {\n            return this.endSession(event);\n        }\n\n        return this.forward(event);\n    }\n\n    protected isJSONRequest(event: IAppEvent) : boolean {\n        const contentType = getRequestHeader(event, 'content-type');\n\n        // Media types are case-insensitive (RFC 9110), and the header\n        // routinely carries parameters (`; charset=UTF-8`). Reading it\n        // literally would send an `Application/JSON` caller down the\n        // navigation path and answer its XHR with a redirect.\n        return typeof contentType === 'string' &&\n            contentType.toLowerCase().includes('application/json');\n    }\n\n    protected async forward(event: IAppEvent): Promise<Response> {\n        // Both bindings merge body and query, so the form_post parameters\n        // survive the hop (a 302 turns the POST into a GET).\n        const merged = await readFromLocations(event, ['body', 'query']);\n\n        return redirectToAuthConsole(event, this.options.authConsoleUrl, '/logout', merged);\n    }\n\n    /**\n     * The end-session work itself, unchanged from when it ran on the page\n     * GET: validate, verify the hint, revoke the session it references, and\n     * validate the post-logout redirect. Only the reply is different, and\n     * only because the caller is now the page rather than the browser's\n     * address bar.\n     */\n    protected async endSession(event: IAppEvent): Promise<EndSessionResponse> {\n        const merged = await readFromLocations(event, ['body', 'query']);\n\n        // Malformed input (oversized / duplicated params) must never dead-end\n        // the human behind the browser on a JSON error, nor discard a valid\n        // id_token_hint: a bad *cosmetic* param (post_logout_redirect_uri /\n        // state / client_id / realm hint) must NOT cancel the\n        // security-critical revoke the hint authorizes. So on a full-request\n        // validation failure, retry with the hint ALONE — the revoke needs\n        // nothing else: its subject/session come from the verified hint's\n        // claims, and client resolution degrades gracefully (the service\n        // falls back to the hint's sole `aud`, scoped by the hint's own realm\n        // claim — the dropped request params only affected the confirm page's\n        // client name and the redirect, which is dropped anyway). Only a\n        // malformed hint itself falls through to the parameter-less answer.\n        let data: OAuth2EndSessionRequest;\n        try {\n            data = await this.validator.run(merged);\n        } catch {\n            try {\n                data = await this.validator.run({ id_token_hint: merged.id_token_hint });\n            } catch {\n                data = {};\n            }\n        }\n\n        const result = await this.endSessionService.verify(data);\n\n        // A signature-verified id_token_hint proves possession — revoke the\n        // referenced session server-side immediately (only if it belongs to the\n        // hint's subject). Without a hint we mutate nothing; the page's\n        // sign-out is a click-gated, bearer-authenticated action.\n        let serverRevoked = false;\n        if (result.hintVerified && result.sessionId && result.sub && result.subKind) {\n            serverRevoked = await this.endSessionService.revoke(\n                result.sessionId,\n                result.sub,\n                result.subKind,\n            );\n        }\n\n        // Build the validated post-logout redirect (the open-redirect guard\n        // lives in the service; `state` rides only alongside a validated uri).\n        let redirect: string | undefined;\n        if (result.redirectUri) {\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            redirect = url.href;\n        }\n\n        // `redirect` rides along whether or not the session was revoked\n        // here, because the page navigates it only AFTER its own sign-out\n        // has run. That is the same rule as before: what was gated on\n        // `serverRevoked` was the server's automatic 302, so that a\n        // hint-less round-trip could not make an RP believe a logout it\n        // never got. A hint-less request still reaches the RP, but only\n        // once a human has clicked and the local session is actually gone.\n        event.response.headers.set('cache-control', 'no-store');\n\n        return {\n            clientName: result.clientName,\n            hintVerified: result.hintVerified,\n            // never reflect an unverified hint's claims: they are the\n            // operands of the page's own auto-clear gate\n            hintSub: result.hintVerified ? result.sub : undefined,\n            hintSubKind: result.hintVerified ? result.subKind : undefined,\n            serverRevoked,\n            redirect,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAmBD,IAAaS,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,YAAY,IAAIN,iCAAAA;CACzB;;;;;;;;;;;;;;;;;;;IAqBA,MACMQ,MAAM,OAAiD;EACzD,OAAO,KAAKE,QAAQD,KAAAA;CACxB;CAEA,MACME,QAAQ,OAAsE;EAIhF,IAAI,KAAKC,cAAcH,KAAAA,GACnB,OAAO,KAAKI,WAAWJ,KAAAA;EAG3B,OAAO,KAAKC,QAAQD,KAAAA;CACxB;CAEUG,cAAcH,OAA4B;EAChD,MAAMK,cAAcf,iBAAiBU,OAAO,cAAA;EAM5C,OAAO,OAAOK,gBAAgB,YAC1BA,YAAYC,YAAW,CAAA,CAAGC,SAAS,kBAAA;CAC3C;CAEA,MAAgBN,QAAQD,OAAqC;EAGzD,MAAMQ,SAAS,MAAMhB,kBAAkBQ,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAE/D,OAAOP,sBAAsBO,OAAO,KAAKL,QAAQc,gBAAgB,WAAWD,MAAAA;CAChF;;;;;;;IASA,MAAgBJ,WAAWJ,OAA+C;EACtE,MAAMQ,SAAS,MAAMhB,kBAAkBQ,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAc/D,IAAIU;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKb,UAAUc,IAAIH,MAAAA;EACpC,QAAQ;GACJ,IAAI;IACAE,OAAO,MAAM,KAAKb,UAAUc,IAAI,EAAEC,eAAeJ,OAAOI,cAAc,CAAA;GAC1E,QAAQ;IACJF,OAAO,CAAC;GACZ;EACJ;EAEA,MAAMG,SAAS,MAAM,KAAKjB,kBAAkBkB,OAAOJ,IAAAA;EAMnD,IAAIK,gBAAgB;EACpB,IAAIF,OAAOG,gBAAgBH,OAAOI,aAAaJ,OAAOK,OAAOL,OAAOM,SAChEJ,gBAAgB,MAAM,KAAKnB,kBAAkBwB,OACzCP,OAAOI,WACPJ,OAAOK,KACPL,OAAOM,OAAO;EAMtB,IAAIE;EACJ,IAAIR,OAAOS,aAAa;GACpB,MAAMC,MAAM,IAAIlC,IAAIwB,OAAOS,WAAW;GACtC,IAAIT,OAAOW,OACPD,IAAIE,aAAaC,IAAI,SAASb,OAAOW,KAAK;GAG9CH,WAAWE,IAAII;EACnB;EASA3B,MAAM4B,SAASC,QAAQH,IAAI,iBAAiB,UAAA;EAE5C,OAAO;GACHI,YAAYjB,OAAOiB;GACnBd,cAAcH,OAAOG;GAGrBe,SAASlB,OAAOG,eAAeH,OAAOK,MAAMc,KAAAA;GAC5CC,aAAapB,OAAOG,eAAeH,OAAOM,UAAUa,KAAAA;GACpDjB;GACAM;EACJ;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/logout/types.d.ts

@@ -1,6 +1,6 @@
 import type { IOAuth2EndSessionService } from '../../../../../core/index.ts';
 export type LogoutControllerOptions = {
-    baseURL: string;
+    authConsoleUrl: string;
 };
 export type LogoutControllerContext = {
     options: LogoutControllerOptions;

package/dist/adapters/http/controllers/workflows/logout/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/logout/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,iBAAiB,EAAE,wBAAwB,CAAC;CAC/C,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/logout/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,MAAM,uBAAuB,GAAG;IAClC,cAAc,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,iBAAiB,EAAE,wBAAwB,CAAC;CAC/C,CAAC"}

package/dist/adapters/http/controllers/workflows/password-forgot/module.d.ts

@@ -1,9 +1,8 @@
-import type { PasswordForgotPayload, PasswordForgotResponse, StatusResponseFeatures } from '@authup/core-http-kit';
+import type { PasswordForgotPayload, PasswordForgotResponse } from '@authup/core-http-kit';
 import type { IAppEvent } from 'routup';
 import type { IPasswordRecoveryService } from '../../../../../core/index.ts';
 export type PasswordForgotControllerOptions = {
-    baseURL: string;
-    features: StatusResponseFeatures;
+    authConsoleUrl: string;
 };
 export type PasswordForgotControllerContext = {
     options: PasswordForgotControllerOptions;
@@ -13,7 +12,12 @@ export declare class PasswordForgotController {
     protected options: PasswordForgotControllerOptions;
     protected service: IPasswordRecoveryService;
     constructor(ctx: PasswordForgotControllerContext);
-    serve(event: IAppEvent): Promise<string>;
+    /**
+     * The page renders in the auth console service; this hop carries the
+     * request's own parameters over to it. The POST below stays here:
+     * server-core keeps the protocol, the service keeps the render.
+     */
+    serve(event: IAppEvent): Promise<Response>;
     execute(data: PasswordForgotPayload, event: IAppEvent): Promise<PasswordForgotResponse>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/password-forgot/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/password-forgot/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAQnH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAI7E,MAAM,MAAM,+BAA+B,GAAG;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC1C,OAAO,EAAE,+BAA+B,CAAC;IACzC,OAAO,EAAE,wBAAwB,CAAC;CACrC,CAAC;AAEF,qBACa,wBAAwB;IACjC,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;gBAEhC,GAAG,EAAE,+BAA+B;IAM1C,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAUpD,OAAO,CACA,IAAI,EAAE,qBAAqB,EACxB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,sBAAsB,CAAC;CAOrC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/password-forgot/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAQ3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAI7E,MAAM,MAAM,+BAA+B,GAAG;IAC1C,cAAc,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC1C,OAAO,EAAE,+BAA+B,CAAC;IACzC,OAAO,EAAE,wBAAwB,CAAC;CACrC,CAAC;AAEF,qBACa,wBAAwB;IACjC,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;gBAEhC,GAAG,EAAE,+BAA+B;IAKhD;;;;OAIG;IAEG,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAKtD,OAAO,CACA,IAAI,EAAE,qBAAqB,EACxB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,sBAAsB,CAAC;CAOrC"}