@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/adapters/http/controllers/workflows/password-forgot/module.mjs

@@ -3,8 +3,7 @@ import "node:url";
 import.meta.url;
 import { useRequestLocale } from "../../../request/helpers/locale.mjs";
 import "../../../request/index.mjs";
-import { serveWorkflowPage } from "../../../ui/auth-console/serve.mjs";
-import "../../../ui/index.mjs";
+import { redirectToAuthConsole } from "../auth-console.mjs";
 import { DBody, DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/password-forgot/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -28,13 +27,12 @@ var PasswordForgotController = class {
 		this.options = ctx.options;
 		this.service = ctx.service;
 	}
-	async serve(event) {
-		return serveWorkflowPage(event, {
-			url: "/password-forgot",
-			baseURL: this.options.baseURL,
-			features: this.options.features,
-			realmAware: true
-		});
+	/**
+	* The page renders in the auth console service; this hop carries the
+	* request's own parameters over to it. The POST below stays here:
+	* server-core keeps the protocol, the service keeps the render.
+	*/ async serve(event) {
+		return redirectToAuthConsole(event, this.options.authConsoleUrl, "/password-forgot");
 	}
 	async execute(data, event) {
 		const result = await this.service.forgotPassword(data, { locale: useRequestLocale(event) });

package/dist/adapters/http/controllers/workflows/password-forgot/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","useRequestLocale","serveWorkflowPage","PasswordForgotController","options","service","ctx","serve","event","url","baseURL","features","realmAware","execute","data","result","forgotPassword","locale","response","status"],"sources":["../../../../../../src/adapters/http/controllers/workflows/password-forgot/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PasswordForgotPayload, PasswordForgotResponse, StatusResponseFeatures } from '@authup/core-http-kit';\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { IPasswordRecoveryService } from '../../../../../core/index.ts';\nimport { useRequestLocale } from '../../../request/index.ts';\nimport { serveWorkflowPage } from '../../../ui/index.ts';\n\nexport type PasswordForgotControllerOptions = {\n    baseURL: string,\n    features: StatusResponseFeatures,\n};\n\nexport type PasswordForgotControllerContext = {\n    options: PasswordForgotControllerOptions,\n    service: IPasswordRecoveryService,\n};\n\n@DController('/password-forgot')\nexport class PasswordForgotController {\n    protected options: PasswordForgotControllerOptions;\n\n    protected service: IPasswordRecoveryService;\n\n    constructor(ctx: PasswordForgotControllerContext) {\n        this.options = ctx.options;\n        this.service = ctx.service;\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        return serveWorkflowPage(event, {\n            url: '/password-forgot',\n            baseURL: this.options.baseURL,\n            features: this.options.features,\n            realmAware: true,\n        });\n    }\n\n    @DPost('', [])\n    async execute(\n        @DBody() data: PasswordForgotPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<PasswordForgotResponse> {\n        const result = await this.service.forgotPassword(data, { locale: useRequestLocale(event) });\n\n        event.response.status = 202;\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AA0BD,IAAaO,2BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MACME,MAAM,OAA+C;EACvD,OAAOL,kBAAkBM,OAAO;GAC5BC,KAAK;GACLC,SAAS,KAAKN,QAAQM;GACtBC,UAAU,KAAKP,QAAQO;GACvBC,YAAY;EAChB,CAAA;CACJ;CAEA,MACMC,QACF,MACA,OAC+B;EAC/B,MAAME,SAAS,MAAM,KAAKV,QAAQW,eAAeF,MAAM,EAAEG,QAAQhB,iBAAiBO,KAAAA,EAAO,CAAA;EAEzFA,MAAMU,SAASC,SAAS;EAExB,OAAOJ;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","useRequestLocale","redirectToAuthConsole","PasswordForgotController","options","service","ctx","serve","event","authConsoleUrl","execute","data","result","forgotPassword","locale","response","status"],"sources":["../../../../../../src/adapters/http/controllers/workflows/password-forgot/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PasswordForgotPayload, PasswordForgotResponse } from '@authup/core-http-kit';\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { IPasswordRecoveryService } from '../../../../../core/index.ts';\nimport { useRequestLocale } from '../../../request/index.ts';\nimport { redirectToAuthConsole } from '../auth-console.ts';\n\nexport type PasswordForgotControllerOptions = {\n    authConsoleUrl: string,\n};\n\nexport type PasswordForgotControllerContext = {\n    options: PasswordForgotControllerOptions,\n    service: IPasswordRecoveryService,\n};\n\n@DController('/password-forgot')\nexport class PasswordForgotController {\n    protected options: PasswordForgotControllerOptions;\n\n    protected service: IPasswordRecoveryService;\n\n    constructor(ctx: PasswordForgotControllerContext) {\n        this.options = ctx.options;\n        this.service = ctx.service;\n    }\n\n    /**\n     * The page renders in the auth console service; this hop carries the\n     * request's own parameters over to it. The POST below stays here:\n     * server-core keeps the protocol, the service keeps the render.\n     */\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<Response> {\n        return redirectToAuthConsole(event, this.options.authConsoleUrl, '/password-forgot');\n    }\n\n    @DPost('', [])\n    async execute(\n        @DBody() data: PasswordForgotPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<PasswordForgotResponse> {\n        const result = await this.service.forgotPassword(data, { locale: useRequestLocale(event) });\n\n        event.response.status = 202;\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAyBD,IAAaO,2BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,UAAUC,IAAID;CACvB;;;;;IAOA,MACME,MAAM,OAAiD;EACzD,OAAOL,sBAAsBM,OAAO,KAAKJ,QAAQK,gBAAgB,kBAAA;CACrE;CAEA,MACMC,QACF,MACA,OAC+B;EAC/B,MAAME,SAAS,MAAM,KAAKP,QAAQQ,eAAeF,MAAM,EAAEG,QAAQb,iBAAiBO,KAAAA,EAAO,CAAA;EAEzFA,MAAMO,SAASC,SAAS;EAExB,OAAOJ;CACX;AACJ"}

package/dist/adapters/http/controllers/workflows/password-reset/module.d.ts

@@ -1,9 +1,8 @@
-import type { PasswordResetPayload, PasswordResetResponse, StatusResponseFeatures } from '@authup/core-http-kit';
+import type { PasswordResetPayload, PasswordResetResponse } from '@authup/core-http-kit';
 import type { IAppEvent } from 'routup';
 import type { IPasswordRecoveryService } from '../../../../../core/index.ts';
 export type PasswordResetControllerOptions = {
-    baseURL: string;
-    features: StatusResponseFeatures;
+    authConsoleUrl: string;
 };
 export type PasswordResetControllerContext = {
     options: PasswordResetControllerOptions;
@@ -13,7 +12,12 @@ export declare class PasswordResetController {
     protected options: PasswordResetControllerOptions;
     protected service: IPasswordRecoveryService;
     constructor(ctx: PasswordResetControllerContext);
-    serve(event: IAppEvent): Promise<string>;
+    /**
+     * The page renders in the auth console service; this hop carries the
+     * request's own parameters over to it. The POST below stays here:
+     * server-core keeps the protocol, the service keeps the render.
+     */
+    serve(event: IAppEvent): Promise<Response>;
     execute(data: PasswordResetPayload, event: IAppEvent): Promise<PasswordResetResponse>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/password-reset/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/password-reset/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAQjH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAG7E,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,OAAO,EAAE,wBAAwB,CAAC;CACrC,CAAC;AAEF,qBACa,uBAAuB;IAChC,SAAS,CAAC,OAAO,EAAE,8BAA8B,CAAC;IAElD,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;gBAEhC,GAAG,EAAE,8BAA8B;IAMzC,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAWpD,OAAO,CACA,IAAI,EAAE,oBAAoB,EACvB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,qBAAqB,CAAC;CAOpC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/password-reset/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAQzF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAG7E,MAAM,MAAM,8BAA8B,GAAG;IACzC,cAAc,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,OAAO,EAAE,wBAAwB,CAAC;CACrC,CAAC;AAEF,qBACa,uBAAuB;IAChC,SAAS,CAAC,OAAO,EAAE,8BAA8B,CAAC;IAElD,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;gBAEhC,GAAG,EAAE,8BAA8B;IAK/C;;;;OAIG;IAEG,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAKtD,OAAO,CACA,IAAI,EAAE,oBAAoB,EACvB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,qBAAqB,CAAC;CAOpC"}

package/dist/adapters/http/controllers/workflows/password-reset/module.mjs

@@ -1,8 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { serveWorkflowPage } from "../../../ui/auth-console/serve.mjs";
-import "../../../ui/index.mjs";
+import { redirectToAuthConsole } from "../auth-console.mjs";
 import { DBody, DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/password-reset/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -26,14 +25,12 @@ var PasswordResetController = class {
 		this.options = ctx.options;
 		this.service = ctx.service;
 	}
-	async serve(event) {
-		return serveWorkflowPage(event, {
-			url: "/password-reset",
-			baseURL: this.options.baseURL,
-			features: this.options.features,
-			realmAware: true,
-			tokenAware: true
-		});
+	/**
+	* The page renders in the auth console service; this hop carries the
+	* request's own parameters over to it. The POST below stays here:
+	* server-core keeps the protocol, the service keeps the render.
+	*/ async serve(event) {
+		return redirectToAuthConsole(event, this.options.authConsoleUrl, "/password-reset");
 	}
 	async execute(data, event) {
 		const result = await this.service.resetPassword(data);

package/dist/adapters/http/controllers/workflows/password-reset/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","serveWorkflowPage","PasswordResetController","options","service","ctx","serve","event","url","baseURL","features","realmAware","tokenAware","execute","data","result","resetPassword","response","status"],"sources":["../../../../../../src/adapters/http/controllers/workflows/password-reset/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PasswordResetPayload, PasswordResetResponse, StatusResponseFeatures } from '@authup/core-http-kit';\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { IPasswordRecoveryService } from '../../../../../core/index.ts';\nimport { serveWorkflowPage } from '../../../ui/index.ts';\n\nexport type PasswordResetControllerOptions = {\n    baseURL: string,\n    features: StatusResponseFeatures,\n};\n\nexport type PasswordResetControllerContext = {\n    options: PasswordResetControllerOptions,\n    service: IPasswordRecoveryService,\n};\n\n@DController('/password-reset')\nexport class PasswordResetController {\n    protected options: PasswordResetControllerOptions;\n\n    protected service: IPasswordRecoveryService;\n\n    constructor(ctx: PasswordResetControllerContext) {\n        this.options = ctx.options;\n        this.service = ctx.service;\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        return serveWorkflowPage(event, {\n            url: '/password-reset',\n            baseURL: this.options.baseURL,\n            features: this.options.features,\n            realmAware: true,\n            tokenAware: true,\n        });\n    }\n\n    @DPost('', [])\n    async execute(\n        @DBody() data: PasswordResetPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<PasswordResetResponse> {\n        const result = await this.service.resetPassword(data);\n\n        event.response.status = 202;\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAyBD,IAAaM,0BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MACME,MAAM,OAA+C;EACvD,OAAOL,kBAAkBM,OAAO;GAC5BC,KAAK;GACLC,SAAS,KAAKN,QAAQM;GACtBC,UAAU,KAAKP,QAAQO;GACvBC,YAAY;GACZC,YAAY;EAChB,CAAA;CACJ;CAEA,MACMC,QACF,MACA,OAC8B;EAC9B,MAAME,SAAS,MAAM,KAAKX,QAAQY,cAAcF,IAAAA;EAEhDP,MAAMU,SAASC,SAAS;EAExB,OAAOH;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","redirectToAuthConsole","PasswordResetController","options","service","ctx","serve","event","authConsoleUrl","execute","data","result","resetPassword","response","status"],"sources":["../../../../../../src/adapters/http/controllers/workflows/password-reset/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PasswordResetPayload, PasswordResetResponse } from '@authup/core-http-kit';\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { IPasswordRecoveryService } from '../../../../../core/index.ts';\nimport { redirectToAuthConsole } from '../auth-console.ts';\n\nexport type PasswordResetControllerOptions = {\n    authConsoleUrl: string,\n};\n\nexport type PasswordResetControllerContext = {\n    options: PasswordResetControllerOptions,\n    service: IPasswordRecoveryService,\n};\n\n@DController('/password-reset')\nexport class PasswordResetController {\n    protected options: PasswordResetControllerOptions;\n\n    protected service: IPasswordRecoveryService;\n\n    constructor(ctx: PasswordResetControllerContext) {\n        this.options = ctx.options;\n        this.service = ctx.service;\n    }\n\n    /**\n     * The page renders in the auth console service; this hop carries the\n     * request's own parameters over to it. The POST below stays here:\n     * server-core keeps the protocol, the service keeps the render.\n     */\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<Response> {\n        return redirectToAuthConsole(event, this.options.authConsoleUrl, '/password-reset');\n    }\n\n    @DPost('', [])\n    async execute(\n        @DBody() data: PasswordResetPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<PasswordResetResponse> {\n        const result = await this.service.resetPassword(data);\n\n        event.response.status = 202;\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAwBD,IAAaM,0BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,UAAUC,IAAID;CACvB;;;;;IAOA,MACME,MAAM,OAAiD;EACzD,OAAOL,sBAAsBM,OAAO,KAAKJ,QAAQK,gBAAgB,iBAAA;CACrE;CAEA,MACMC,QACF,MACA,OAC8B;EAC9B,MAAME,SAAS,MAAM,KAAKP,QAAQQ,cAAcF,IAAAA;EAEhDH,MAAMM,SAASC,SAAS;EAExB,OAAOH;CACX;AACJ"}

package/dist/adapters/http/controllers/workflows/register/module.d.ts

@@ -1,9 +1,8 @@
-import type { RegisterPayload, RegisterResponse, StatusResponseFeatures } from '@authup/core-http-kit';
+import type { RegisterPayload, RegisterResponse } from '@authup/core-http-kit';
 import type { IAppEvent } from 'routup';
 import type { IRegistrationService } from '../../../../../core/index.ts';
 export type RegisterControllerOptions = {
-    baseURL: string;
-    features: StatusResponseFeatures;
+    authConsoleUrl: string;
 };
 export type RegisterControllerContext = {
     options: RegisterControllerOptions;
@@ -13,7 +12,12 @@ export declare class RegisterController {
     protected options: RegisterControllerOptions;
     protected service: IRegistrationService;
     constructor(ctx: RegisterControllerContext);
-    serve(event: IAppEvent): Promise<string>;
+    /**
+     * The page renders in the auth console service; this hop carries the
+     * request's own parameters over to it. The POST below stays here:
+     * server-core keeps the protocol, the service keeps the render.
+     */
+    serve(event: IAppEvent): Promise<Response>;
     execute(data: RegisterPayload, event: IAppEvent): Promise<RegisterResponse>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/register/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/register/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAQvG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAIzE,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,yBAAyB,CAAC;IACnC,OAAO,EAAE,oBAAoB,CAAC;CACjC,CAAC;AAEF,qBACa,kBAAkB;IAC3B,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAE7C,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;gBAE5B,GAAG,EAAE,yBAAyB;IAMpC,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAUpD,OAAO,CACA,IAAI,EAAE,eAAe,EAClB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gBAAgB,CAAC;CAO/B"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/register/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAQ/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAIzE,MAAM,MAAM,yBAAyB,GAAG;IACpC,cAAc,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,yBAAyB,CAAC;IACnC,OAAO,EAAE,oBAAoB,CAAC;CACjC,CAAC;AAEF,qBACa,kBAAkB;IAC3B,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAE7C,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;gBAE5B,GAAG,EAAE,yBAAyB;IAK1C;;;;OAIG;IAEG,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAKtD,OAAO,CACA,IAAI,EAAE,eAAe,EAClB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gBAAgB,CAAC;CAO/B"}

package/dist/adapters/http/controllers/workflows/register/module.mjs

@@ -3,8 +3,7 @@ import "node:url";
 import.meta.url;
 import { useRequestLocale } from "../../../request/helpers/locale.mjs";
 import "../../../request/index.mjs";
-import { serveWorkflowPage } from "../../../ui/auth-console/serve.mjs";
-import "../../../ui/index.mjs";
+import { redirectToAuthConsole } from "../auth-console.mjs";
 import { DBody, DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/register/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -28,13 +27,12 @@ var RegisterController = class {
 		this.options = ctx.options;
 		this.service = ctx.service;
 	}
-	async serve(event) {
-		return serveWorkflowPage(event, {
-			url: "/register",
-			baseURL: this.options.baseURL,
-			features: this.options.features,
-			realmAware: true
-		});
+	/**
+	* The page renders in the auth console service; this hop carries the
+	* request's own parameters over to it. The POST below stays here:
+	* server-core keeps the protocol, the service keeps the render.
+	*/ async serve(event) {
+		return redirectToAuthConsole(event, this.options.authConsoleUrl, "/register");
 	}
 	async execute(data, event) {
 		const result = await this.service.register(data, { locale: useRequestLocale(event) });

package/dist/adapters/http/controllers/workflows/register/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","useRequestLocale","serveWorkflowPage","RegisterController","options","service","ctx","serve","event","url","baseURL","features","realmAware","execute","data","result","register","locale","response","status"],"sources":["../../../../../../src/adapters/http/controllers/workflows/register/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RegisterPayload, RegisterResponse, StatusResponseFeatures } from '@authup/core-http-kit';\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { IRegistrationService } from '../../../../../core/index.ts';\nimport { useRequestLocale } from '../../../request/index.ts';\nimport { serveWorkflowPage } from '../../../ui/index.ts';\n\nexport type RegisterControllerOptions = {\n    baseURL: string,\n    features: StatusResponseFeatures,\n};\n\nexport type RegisterControllerContext = {\n    options: RegisterControllerOptions,\n    service: IRegistrationService,\n};\n\n@DController('/register')\nexport class RegisterController {\n    protected options: RegisterControllerOptions;\n\n    protected service: IRegistrationService;\n\n    constructor(ctx: RegisterControllerContext) {\n        this.options = ctx.options;\n        this.service = ctx.service;\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        return serveWorkflowPage(event, {\n            url: '/register',\n            baseURL: this.options.baseURL,\n            features: this.options.features,\n            realmAware: true,\n        });\n    }\n\n    @DPost('', [])\n    async execute(\n        @DBody() data: RegisterPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<RegisterResponse> {\n        const result = await this.service.register(data, { locale: useRequestLocale(event) });\n\n        event.response.status = 202;\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AA0BD,IAAaO,qBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MACME,MAAM,OAA+C;EACvD,OAAOL,kBAAkBM,OAAO;GAC5BC,KAAK;GACLC,SAAS,KAAKN,QAAQM;GACtBC,UAAU,KAAKP,QAAQO;GACvBC,YAAY;EAChB,CAAA;CACJ;CAEA,MACMC,QACF,MACA,OACyB;EACzB,MAAME,SAAS,MAAM,KAAKV,QAAQW,SAASF,MAAM,EAAEG,QAAQhB,iBAAiBO,KAAAA,EAAO,CAAA;EAEnFA,MAAMU,SAASC,SAAS;EAExB,OAAOJ;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","useRequestLocale","redirectToAuthConsole","RegisterController","options","service","ctx","serve","event","authConsoleUrl","execute","data","result","register","locale","response","status"],"sources":["../../../../../../src/adapters/http/controllers/workflows/register/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RegisterPayload, RegisterResponse } from '@authup/core-http-kit';\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { IRegistrationService } from '../../../../../core/index.ts';\nimport { useRequestLocale } from '../../../request/index.ts';\nimport { redirectToAuthConsole } from '../auth-console.ts';\n\nexport type RegisterControllerOptions = {\n    authConsoleUrl: string,\n};\n\nexport type RegisterControllerContext = {\n    options: RegisterControllerOptions,\n    service: IRegistrationService,\n};\n\n@DController('/register')\nexport class RegisterController {\n    protected options: RegisterControllerOptions;\n\n    protected service: IRegistrationService;\n\n    constructor(ctx: RegisterControllerContext) {\n        this.options = ctx.options;\n        this.service = ctx.service;\n    }\n\n    /**\n     * The page renders in the auth console service; this hop carries the\n     * request's own parameters over to it. The POST below stays here:\n     * server-core keeps the protocol, the service keeps the render.\n     */\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<Response> {\n        return redirectToAuthConsole(event, this.options.authConsoleUrl, '/register');\n    }\n\n    @DPost('', [])\n    async execute(\n        @DBody() data: RegisterPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<RegisterResponse> {\n        const result = await this.service.register(data, { locale: useRequestLocale(event) });\n\n        event.response.status = 202;\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAyBD,IAAaO,qBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,UAAUC,IAAID;CACvB;;;;;IAOA,MACME,MAAM,OAAiD;EACzD,OAAOL,sBAAsBM,OAAO,KAAKJ,QAAQK,gBAAgB,WAAA;CACrE;CAEA,MACMC,QACF,MACA,OACyB;EACzB,MAAME,SAAS,MAAM,KAAKP,QAAQQ,SAASF,MAAM,EAAEG,QAAQb,iBAAiBO,KAAAA,EAAO,CAAA;EAEnFA,MAAMO,SAASC,SAAS;EAExB,OAAOJ;CACX;AACJ"}

package/dist/adapters/http/controllers/workflows/status/module.mjs

@@ -3,8 +3,8 @@ import "node:url";
 import.meta.url;
 import { PACKAGE_PATH } from "../../../../../path.mjs";
 import path from "node:path";
-import { read } from "locter";
 import { DController, DGet } from "@routup/decorators";
+import { read } from "locter";
 //#region src/adapters/http/controllers/workflows/status/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/workflows/token/module.d.ts

@@ -1,9 +1,11 @@
-import type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse } from '@authup/specs';
+import type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPayload } from '@authup/specs';
 import { OAuth2TokenGrant } from '@authup/specs';
 import type { IAppEvent } from 'routup';
+import type { Logger } from '@authup/server-kit';
 import type { TokenControllerContext } from './types.ts';
-import type { IAuthFlowMetrics, IIdentityPermissionProvider, IIdentityResolver, IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../../../../../core/index.ts';
+import type { IAuthFlowMetrics, IIdentityPermissionProvider, IIdentityResolver, IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export declare class TokenController {
     protected refreshTokenIssuer: IOAuth2TokenIssuer;
     protected accessTokenIssuer: IOAuth2TokenIssuer;
@@ -12,10 +14,51 @@ export declare class TokenController {
     protected identityResolver: IIdentityResolver;
     protected identityPermissionProvider: IIdentityPermissionProvider;
     protected metrics?: IAuthFlowMetrics;
+    protected clientAuthenticator: OAuth2ClientAuthenticator;
+    protected certificateSource: CertificateSource;
+    protected logger?: Logger;
     protected tokenGrants: Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;
     constructor(ctx: TokenControllerContext);
     getIntrospect(event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse>;
     postIntrospect(event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse>;
+    /**
+     * RFC 7662 §2.1: the endpoint MUST require authorization, "such as client
+     * authentication [...] or a separate OAuth 2.0 access token". The
+     * credential has to be INDEPENDENT of the token being introspected, since
+     * possession of that string is exactly what a finder has too (#3489): a
+     * request identity the authorization middleware resolved (the kit's own
+     * live bearer, a resource server's client-credentials bearer, Basic), or
+     * confidential client credentials as the grants read them. A bare public
+     * `client_id` identifies and authenticates nothing, so it is refused like
+     * the client-credentials grant refuses it.
+     *
+     * An expired bearer never reaches this point: the middleware answers 401
+     * before the route runs. So the expired report in `postIntrospect` is only
+     * ever handed to a caller that proved who it is, which is what makes it
+     * safe to give.
+     */
+    protected assertIntrospectionAuthorized(event: IAppEvent): Promise<void>;
+    /**
+     * WHOSE tokens the authenticated caller may introspect (#3489, second
+     * layer): its own subject's, those issued for its own client, or any its
+     * TOKEN_INTROSPECT grant reaches (the grant's realm scope is matched
+     * against the token's realm claim, so an `admin` reaches everything and
+     * a `realm_admin` its own realm). A resource server verifying foreign
+     * tokens through the server adapters' remote mode needs that grant. The
+     * deny is reported per RFC 7662 §2.2 as a bare `active: false`, which
+     * gives the caller nothing to diagnose with, hence the log line.
+     */
+    protected isIntrospectionAllowed(event: IAppEvent, payload: OAuth2TokenPayload): Promise<boolean>;
+    /**
+     * Deliberately ungated, unlike introspection (#3489). RFC 7009 §2.1 asks
+     * the client to send its credentials (a bare `client_id` for a public
+     * client) and the server to verify the token was issued to that client;
+     * authup knowingly skips both. A public `client_id` identifies and
+     * proves nothing, so an ownership check built on it would be advisory,
+     * the consoles are public clients whose kit revokes anonymously on
+     * logout teardown, revoking a token one possesses is the benign action,
+     * and the uniform 200 below leaves a scanner nothing to learn.
+     */
     revokeToken(event: IAppEvent): Promise<null>;
     createToken(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
 }

package/dist/adapters/http/controllers/workflows/token/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,gCAAgC,EAAyB,MAAM,eAAe,CAAC;AACvH,OAAO,EAA4C,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQ3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EACR,gBAAgB,EAChB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAUnE,qBAEa,eAAe;IACxB,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,EAAG,2BAA2B,CAAC;IAEnE,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC,GAAG,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAI5D,GAAG,EAAE,sBAAsB;IAgEjC,aAAa,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAKtF,cAAc,CACJ,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IA4DtC,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;IA+BV,WAAW,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAiBrF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,wBAAwB,EACxB,gCAAgC,EAChC,kBAAkB,EACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAIH,gBAAgB,EAGnB,MAAM,eAAe,CAAC;AAgBvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EACR,gBAAgB,EAChB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAWnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAUnE,qBAEa,eAAe;IACxB,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,EAAG,2BAA2B,CAAC;IAEnE,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,iBAAiB,EAAG,iBAAiB,CAAC;IAEhD,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAE3B,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC,GAAG,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAI5D,GAAG,EAAE,sBAAsB;IAmEjC,aAAa,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAKtF,cAAc,CACJ,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IAgH5C;;;;;;;;;;;;;;;OAeG;cACa,6BAA6B,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,IAAI,CAAC;IAiC/E;;;;;;;;;OASG;cACa,sBAAsB,CAClC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,kBAAkB,GAC3B,OAAO,CAAC,OAAO,CAAC;IAuCpB;;;;;;;;;OASG;IAEG,WAAW,CACD,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;IA6CV,WAAW,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAiBrF"}

package/dist/adapters/http/controllers/workflows/token/module.mjs

@@ -1,9 +1,16 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { OAuth2OpenIDClaimsBuilder } from "../../../../../core/oauth2/openid/claims.mjs";
+import { resolveIntrospectionSubject } from "../../../../../core/oauth2/introspection/module.mjs";
 import "../../../../../core/index.mjs";
+import { setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "../../../request/helpers/identity.mjs";
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import { setRequestScopes } from "../../../request/helpers/scopes.mjs";
+import "../../../request/index.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "../../../adapters/oauth2/grant-types/utils/certificate.mjs";
+import { extractClientCredentialsFromRequest } from "../../../adapters/oauth2/grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "../../../adapters/oauth2/grant-types/utils/guess.mjs";
+import { readRealmHint } from "../../../adapters/oauth2/grant-types/utils/realm.mjs";
 import { HTTPOAuth2AuthorizeGrant } from "../../../adapters/oauth2/grant-types/authorize.mjs";
 import { HTTPClientCredentialsGrant } from "../../../adapters/oauth2/grant-types/client-credentials.mjs";
 import { HTTPPasswordGrant } from "../../../adapters/oauth2/grant-types/password.mjs";
@@ -13,8 +20,10 @@ import { toOAuth2Error } from "../../../../../core/oauth2/helpers/error.mjs";
 import "../../../../../core/oauth2/helpers/index.mjs";
 import { extractTokenFromRequest } from "./utils/extract.mjs";
 import "./utils/index.mjs";
-import { buildPermissionKey } from "@authup/access";
-import { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from "@authup/specs";
+import { ClientAuthMethod, IdentityType, PermissionName, ScopeName } from "@authup/core-kit";
+import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { OAuth2ClientError, OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant, OAuth2TokenKind, isJWTError } from "@authup/specs";
+import { readRequestBody } from "@routup/basic/body";
 import { DContext, DController, DGet, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/token/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -39,6 +48,9 @@ var TokenController = class {
 	identityResolver;
 	identityPermissionProvider;
 	metrics;
+	clientAuthenticator;
+	certificateSource;
+	logger;
 	tokenGrants;
 	constructor(ctx) {
 		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
@@ -48,6 +60,9 @@ var TokenController = class {
 		this.identityResolver = ctx.identityResolver;
 		this.identityPermissionProvider = ctx.identityPermissionProvider;
 		this.metrics = ctx.metrics;
+		this.clientAuthenticator = ctx.oauth2ClientAuthenticator;
+		this.certificateSource = ctx.certificateSource;
+		this.logger = ctx.logger;
 		this.tokenGrants = {
 			[OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({
 				codeVerifier: ctx.codeVerifier,
@@ -103,41 +118,113 @@ var TokenController = class {
 		return this.postIntrospect(event);
 	}
 	async postIntrospect(event) {
+		await this.assertIntrospectionAuthorized(event);
 		try {
 			const token = await extractTokenFromRequest(event);
-			const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });
-			if (!payload.sub || !payload.sub_kind) throw OAuth2RequestError.identityInvalid();
-			const permissions = await this.identityPermissionProvider.getFor({
-				id: payload.sub,
-				type: payload.sub_kind,
-				clientId: payload.client_id,
-				realmId: payload.realm_id
+			const payload = await this.tokenVerifier.verify(token, {
+				ignoreExpiry: true,
+				skipActiveCheck: true
 			});
-			const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);
-			if (!identity) throw OAuth2RequestError.identityInvalid();
-			const claims = new OAuth2OpenIDClaimsBuilder().fromIdentity(identity);
+			if (payload.kind === OAuth2TokenKind.LOGOUT) return { active: false };
+			if (!await this.isIntrospectionAllowed(event, payload)) return { active: false };
+			if (!payload.sub || !payload.sub_kind) throw OAuth2RequestError.identityInvalid();
 			let active;
-			if (payload.jti) active = !await this.tokenVerifier.isInactive(payload.jti);
+			if (payload.jti && typeof payload.exp === "number") active = !await this.tokenVerifier.isInactive(payload.jti) && payload.exp * 1e3 > Date.now();
 			else active = false;
+			const subject = await resolveIntrospectionSubject({
+				identityResolver: this.identityResolver,
+				identityPermissionProvider: this.identityPermissionProvider
+			}, {
+				sub: payload.sub,
+				subKind: payload.sub_kind,
+				clientId: payload.client_id,
+				realmId: payload.realm_id,
+				active
+			});
+			if (!active) return {
+				active,
+				...payload,
+				...subject.claims
+			};
 			return {
 				active,
-				permissions: Object.values(permissions.reduce((acc, binding) => {
-					const key = buildPermissionKey(binding.permission);
-					if (!acc[key]) acc[key] = {
-						name: binding.permission.name,
-						client_id: binding.permission.clientId,
-						realm_id: binding.permission.realmId
-					};
-					return acc;
-				}, {})),
+				permissions: subject.permissions,
 				...payload,
-				...claims
+				...subject.claims
 			};
 		} catch (e) {
+			if (isJWTError(e)) return { active: false };
 			throw toOAuth2Error(e);
 		}
 	}
-	async revokeToken(event) {
+	/**
+	* RFC 7662 §2.1: the endpoint MUST require authorization, "such as client
+	* authentication [...] or a separate OAuth 2.0 access token". The
+	* credential has to be INDEPENDENT of the token being introspected, since
+	* possession of that string is exactly what a finder has too (#3489): a
+	* request identity the authorization middleware resolved (the kit's own
+	* live bearer, a resource server's client-credentials bearer, Basic), or
+	* confidential client credentials as the grants read them. A bare public
+	* `client_id` identifies and authenticates nothing, so it is refused like
+	* the client-credentials grant refuses it.
+	*
+	* An expired bearer never reaches this point: the middleware answers 401
+	* before the route runs. So the expired report in `postIntrospect` is only
+	* ever handed to a caller that proved who it is, which is what makes it
+	* safe to give.
+	*/ async assertIntrospectionAuthorized(event) {
+		if (useRequestIdentity(event)) return;
+		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
+		if (!clientId) {
+			useRequestIdentityOrFail(event);
+			return;
+		}
+		const body = await readRequestBody(event);
+		const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);
+		const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, readRealmHint(body), certificateEvidence);
+		if (client.authMethod === ClientAuthMethod.NONE) throw OAuth2ClientError.invalid();
+		setRequestScopes(event, [ScopeName.GLOBAL]);
+		setRequestIdentity(event, {
+			type: IdentityType.CLIENT,
+			data: client
+		});
+	}
+	/**
+	* WHOSE tokens the authenticated caller may introspect (#3489, second
+	* layer): its own subject's, those issued for its own client, or any its
+	* TOKEN_INTROSPECT grant reaches (the grant's realm scope is matched
+	* against the token's realm claim, so an `admin` reaches everything and
+	* a `realm_admin` its own realm). A resource server verifying foreign
+	* tokens through the server adapters' remote mode needs that grant. The
+	* deny is reported per RFC 7662 §2.2 as a bare `active: false`, which
+	* gives the caller nothing to diagnose with, hence the log line.
+	*/ async isIntrospectionAllowed(event, payload) {
+		const identity = useRequestIdentity(event);
+		if (!identity) return false;
+		if (payload.sub && identity.type === payload.sub_kind && identity.id === payload.sub) return true;
+		if (identity.type === IdentityType.CLIENT && payload.client_id && identity.id === payload.client_id) return true;
+		const actor = buildActorContext(event);
+		try {
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.TOKEN_INTROSPECT,
+				data: new PolicyData({ ...payload.realm_id ? { [BuiltInPolicyType.REALM_MATCH]: payload.realm_id } : {} })
+			});
+			return true;
+		} catch {
+			this.logger?.info(`introspection denied: ${identity.type} ${identity.id} may not introspect the presented token`);
+			return false;
+		}
+	}
+	/**
+	* Deliberately ungated, unlike introspection (#3489). RFC 7009 §2.1 asks
+	* the client to send its credentials (a bare `client_id` for a public
+	* client) and the server to verify the token was issued to that client;
+	* authup knowingly skips both. A public `client_id` identifies and
+	* proves nothing, so an ownership check built on it would be advisory,
+	* the consoles are public clients whose kit revokes anonymously on
+	* logout teardown, revoking a token one possesses is the benign action,
+	* and the uniform 200 below leaves a scanner nothing to learn.
+	*/ async revokeToken(event) {
 		try {
 			const token = await extractTokenFromRequest(event);
 			const payload = await this.tokenVerifier.verify(token, {
@@ -145,9 +232,13 @@ var TokenController = class {
 				skipActiveCheck: true
 			});
 			await this.tokenRevoker.revoke(payload);
-			event.response.status = 202;
+			event.response.status = 200;
 			return null;
 		} catch (e) {
+			if (isJWTError(e)) {
+				event.response.status = 200;
+				return null;
+			}
 			throw toOAuth2Error(e);
 		}
 	}

package/dist/adapters/http/controllers/workflows/token/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","metrics","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","openIdTokenIssuer","keyStore","sessionManager","realmRepository","accessPolicyEvaluator","certificateSource","CLIENT_CREDENTIALS","PASSWORD","authenticator","userAuthenticator","eventService","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","REFRESH_TOKEN","tokenRepository","sessionTokenRepository","options","gracePeriod","tokenRefreshGracePeriod","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","ignoreExpiry","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest","recordTokenGrant"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n    IAuthFlowMetrics,\n    IIdentityPermissionProvider,\n    IIdentityResolver,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n    HTTPClientCredentialsGrant,\n    HTTPOAuth2AuthorizeGrant,\n    HTTPOAuth2RefreshTokenGrant,\n    HTTPPasswordGrant,\n    guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n    protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected tokenRevoker: IOAuth2TokenRevoker;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected identityPermissionProvider : IIdentityPermissionProvider;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n    // -------------------------------------------\n\n    constructor(ctx: TokenControllerContext) {\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.metrics = ctx.metrics;\n\n        this.tokenGrants = {\n            [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n                codeVerifier: ctx.codeVerifier,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                openIdTokenIssuer: ctx.openIdTokenIssuer,\n                keyStore: ctx.keyStore,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n                accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                authenticator: ctx.userAuthenticator,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n                eventService: ctx.eventService,\n                metrics: ctx.metrics,\n                loginThrottleService: ctx.loginThrottleService,\n                userAuthenticatorService: ctx.userAuthenticatorService,\n                mfaLoginService: ctx.mfaLoginService,\n                logger: ctx.logger,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRepository: ctx.tokenRepository,\n                sessionTokenRepository: ctx.sessionTokenRepository,\n                sessionManager: ctx.sessionManager,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                realmRepository: ctx.realmRepository,\n                eventService: ctx.eventService,\n                metrics: ctx.metrics,\n                logger: ctx.logger,\n                options: { gracePeriod: ctx.tokenRefreshGracePeriod },\n                certificateSource: ctx.certificateSource,\n            }),\n        };\n    }\n\n    // -------------------------------------------\n\n    @DGet('/introspect', [])\n    async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n        return this.postIntrospect(event);\n    }\n\n    @DPost('/introspect', [])\n    async postIntrospect(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        try {\n            const token = await extractTokenFromRequest(event);\n            const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n            if (!payload.sub || !payload.sub_kind) {\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            // todo: only receive client specific permissions\n            const permissions = await this.identityPermissionProvider.getFor({\n                id: payload.sub,\n                type: payload.sub_kind,\n                clientId: payload.client_id,\n                realmId: payload.realm_id,\n            });\n\n            const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n            if (!identity) {\n                // todo: differentiate between client & user\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n            const claims = claimsBuilder.fromIdentity(identity);\n\n            let active : boolean;\n            if (payload.jti) {\n                const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n                active = !isInactive;\n            } else {\n                active = false;\n            }\n\n            return {\n                active,\n                // todo: permissions property should be removed.\n                permissions: Object.values(\n                    permissions.reduce((acc, binding) => {\n                        const key = buildPermissionKey(binding.permission);\n                        if (!acc[key]) {\n                            acc[key] = {\n                                name: binding.permission.name,\n                                client_id: binding.permission.clientId,\n                                realm_id: binding.permission.realmId,\n                            } as OAuth2TokenPermission;\n                        }\n                        return acc;\n                    }, {} as Record<string, OAuth2TokenPermission>),\n                ),\n                ...payload,\n                ...claims,\n            };\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('/revoke', [])\n    async revokeToken(\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            // RFC 7009 §2.2: revoking an invalid token — here one that is expired\n            // or already inactive — MUST still succeed. The client cannot act on\n            // an error, and the token's invalidation (the point of the request)\n            // is already achieved. Signature + kind still anchor the token, so a\n            // forged/garbage token is rejected; `ignoreExpiry` additionally keeps\n            // this exp-bypass out of the shared claims cache (see\n            // OAuth2TokenVerifier). Without this, revoking a stale refresh token\n            // threw `expired_token`, so the caller's revoke-then-clear-cookie\n            // flow aborted, the durable row was never soft-revoked, and the stale\n            // refresh cookie survived into the next login.\n            const payload = await this.tokenVerifier.verify(token, {\n                ignoreExpiry: true,\n                skipActiveCheck: true,\n            });\n\n            await this.tokenRevoker.revoke(payload);\n\n            event.response.status = 202;\n            return null;\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('', [])\n    async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const grantType = await guessOauth2GrantTypeByRequest(event);\n        if (!grantType) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const grant = this.tokenGrants[grantType];\n        if (!grant) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const response = await grant.runWithRequest(event);\n\n        this.metrics?.recordTokenGrant(grantType);\n\n        return response;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAoCD,IAAaiB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKR,qBAAqBQ,IAAIR;EAC9B,KAAKC,oBAAoBO,IAAIP;EAC7B,KAAKC,gBAAgBM,IAAIN;EACzB,KAAKC,eAAeK,IAAIL;EACxB,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,6BAA6BG,IAAIH;EACtC,KAAKC,UAAUE,IAAIF;EAEnB,KAAKC,cAAc;IACdvB,iBAAiByB,qBAAqB,IAAIf,yBAAyB;IAChEgB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBX,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBa,mBAAmBL,IAAIK;IACvBC,UAAUN,IAAIM;IACdC,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBC,uBAAuBT,IAAIS;IAC3BC,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiBmC,qBAAqB,IAAI1B,2BAA2B;IAClEQ,mBAAmBO,IAAIP;IACvBU,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBG,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiBoC,WAAW,IAAIxB,kBAAkB;IAC/CK,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBqB,eAAeb,IAAIc;IACnBX,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBO,cAAcf,IAAIe;IAClBjB,SAASE,IAAIF;IACbkB,sBAAsBhB,IAAIgB;IAC1BC,0BAA0BjB,IAAIiB;IAC9BC,iBAAiBlB,IAAIkB;IACrBC,QAAQnB,IAAImB;IACZT,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiB4C,gBAAgB,IAAIjC,4BAA4B;IAC9DM,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBE,eAAeM,IAAIN;IACnB2B,iBAAiBrB,IAAIqB;IACrBC,wBAAwBtB,IAAIsB;IAC5Bf,gBAAgBP,IAAIO;IACpBJ,qBAAqBH,IAAII;IACzBI,iBAAiBR,IAAIQ;IACrBO,cAAcf,IAAIe;IAClBjB,SAASE,IAAIF;IACbqB,QAAQnB,IAAImB;IACZI,SAAS,EAAEC,aAAaxB,IAAIyB,wBAAwB;IACpDf,mBAAmBV,IAAIU;GAC3B,CAAA;EACJ;CACJ;CAIA,MACMgB,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAMvC,wBAAwBqC,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAKpC,cAAcqC,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAM3D,mBAAmB4D,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAKvC,2BAA2BwC,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAKhD,iBAAiBiD,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMrE,mBAAmB4D,gBAAe;GAI5C,MAAMY,SAASD,IADW9D,0BACX8D,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAKzD,cAAcyD,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAM3E,mBAAmB0E,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWlB;MAC9BG,UAAUa,QAAQE,WAAWhB;KACjC;KAEJ,OAAOa;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAM7E,cAAc6E,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAMvC,wBAAwBqC,KAAAA;GAY5C,MAAMG,UAAU,MAAM,KAAKpC,cAAcqC,OAAOF,OAAO;IACnDiC,cAAc;IACd9B,iBAAiB;GACrB,CAAA;GAEA,MAAM,KAAKrC,aAAaoE,OAAOjC,OAAAA;GAE/BH,MAAMqC,SAASC,SAAS;GACxB,OAAO;EACX,SAASL,GAAG;GACR,MAAM7E,cAAc6E,CAAAA;EACxB;CACJ;CAIA,MACMM,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAM9E,8BAA8BsC,KAAAA;EACtD,IAAI,CAACwC,WACD,MAAM7F,qBAAqB8F,YAAW;EAG1C,MAAMC,QAAQ,KAAKtE,YAAYoE;EAC/B,IAAI,CAACE,OACD,MAAM/F,qBAAqB8F,YAAW;EAG1C,MAAMJ,WAAW,MAAMK,MAAMC,eAAe3C,KAAAA;EAE5C,KAAK7B,SAASyE,iBAAiBJ,SAAAA;EAE/B,OAAOH;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2ClientError","OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","OAuth2TokenKind","isJWTError","ClientAuthMethod","IdentityType","PermissionName","ScopeName","BuiltInPolicyType","PolicyData","readRequestBody","DContext","DController","DGet","DPost","DTags","toOAuth2Error","resolveIntrospectionSubject","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","extractClientCredentialsFromRequest","extractOAuth2ClientCertificateEvidence","guessOauth2GrantTypeByRequest","readRealmHint","buildActorContext","setRequestIdentity","setRequestScopes","useRequestIdentity","useRequestIdentityOrFail","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","metrics","clientAuthenticator","certificateSource","logger","tokenGrants","ctx","oauth2ClientAuthenticator","AUTHORIZATION_CODE","codeVerifier","openIdTokenIssuer","keyStore","sessionManager","realmRepository","accessPolicyEvaluator","CLIENT_CREDENTIALS","PASSWORD","authenticator","userAuthenticator","eventService","loginThrottleService","userAuthenticatorService","mfaLoginService","REFRESH_TOKEN","tokenRepository","sessionTokenRepository","options","gracePeriod","tokenRefreshGracePeriod","getIntrospect","event","postIntrospect","assertIntrospectionAuthorized","token","payload","verify","ignoreExpiry","skipActiveCheck","kind","LOGOUT","active","isIntrospectionAllowed","sub","sub_kind","identityInvalid","jti","exp","isInactive","Date","now","subject","subKind","clientId","client_id","realmId","realm_id","claims","permissions","e","clientSecret","body","certificateEvidence","client","authenticate","authMethod","NONE","invalid","GLOBAL","type","CLIENT","data","identity","id","actor","permissionEvaluator","evaluate","name","TOKEN_INTROSPECT","REALM_MATCH","info","revokeToken","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest","recordTokenGrant"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    OAuth2TokenGrantResponse,\n    OAuth2TokenIntrospectionResponse,\n    OAuth2TokenPayload,\n} from '@authup/specs';\nimport {\n    OAuth2ClientError,\n    OAuth2GrantTypeError,\n    OAuth2RequestError,\n    OAuth2TokenGrant,\n    OAuth2TokenKind,\n    isJWTError,\n} from '@authup/specs';\nimport { \n    ClientAuthMethod, \n    IdentityType, \n    PermissionName, \n    ScopeName, \n} from '@authup/core-kit';\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { readRequestBody } from '@routup/basic/body';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n    IAuthFlowMetrics,\n    IIdentityPermissionProvider,\n    IIdentityResolver,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport { resolveIntrospectionSubject } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n    HTTPClientCredentialsGrant,\n    HTTPOAuth2AuthorizeGrant,\n    HTTPOAuth2RefreshTokenGrant,\n    HTTPPasswordGrant,\n    extractClientCredentialsFromRequest,\n    extractOAuth2ClientCertificateEvidence,\n    guessOauth2GrantTypeByRequest,\n    readRealmHint,\n} from '../../../adapters/index.ts';\nimport type { CertificateSource } from '../../../request/index.ts';\nimport {\n    buildActorContext,\n    setRequestIdentity,\n    setRequestScopes,\n    useRequestIdentity,\n    useRequestIdentityOrFail,\n} from '../../../request/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n    protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected tokenRevoker: IOAuth2TokenRevoker;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected identityPermissionProvider : IIdentityPermissionProvider;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected certificateSource : CertificateSource;\n\n    protected logger? : Logger;\n\n    protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n    // -------------------------------------------\n\n    constructor(ctx: TokenControllerContext) {\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.metrics = ctx.metrics;\n        this.clientAuthenticator = ctx.oauth2ClientAuthenticator;\n        this.certificateSource = ctx.certificateSource;\n        this.logger = ctx.logger;\n\n        this.tokenGrants = {\n            [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n                codeVerifier: ctx.codeVerifier,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                openIdTokenIssuer: ctx.openIdTokenIssuer,\n                keyStore: ctx.keyStore,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n                accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                authenticator: ctx.userAuthenticator,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n                eventService: ctx.eventService,\n                metrics: ctx.metrics,\n                loginThrottleService: ctx.loginThrottleService,\n                userAuthenticatorService: ctx.userAuthenticatorService,\n                mfaLoginService: ctx.mfaLoginService,\n                logger: ctx.logger,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRepository: ctx.tokenRepository,\n                sessionTokenRepository: ctx.sessionTokenRepository,\n                sessionManager: ctx.sessionManager,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                realmRepository: ctx.realmRepository,\n                eventService: ctx.eventService,\n                metrics: ctx.metrics,\n                logger: ctx.logger,\n                options: { gracePeriod: ctx.tokenRefreshGracePeriod },\n                certificateSource: ctx.certificateSource,\n            }),\n        };\n    }\n\n    // -------------------------------------------\n\n    @DGet('/introspect', [])\n    async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n        return this.postIntrospect(event);\n    }\n\n    @DPost('/introspect', [])\n    async postIntrospect(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        await this.assertIntrospectionAuthorized(event);\n\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            // `ignoreExpiry`, so an expired token still reports WHOSE it was:\n            // a third-party app can say \"your session ended, <name>\" instead\n            // of only \"no\". Everything the caller could act on - the subject,\n            // its claims - is in a token we did issue and can still read.\n            //\n            // `active` is derived below and NEVER from this call. The\n            // signature-keyed cache returns a hit without re-checking `exp`\n            // (verifier/module.ts), so relying on the verify to reject an\n            // expired token would report one as active for as long as its\n            // entry survives. The verifier deliberately skips WRITING the\n            // cache on this path, so no expired payload can enter it here.\n            const payload = await this.tokenVerifier.verify(token, {\n                ignoreExpiry: true,\n                skipActiveCheck: true,\n            });\n\n            if (payload.kind === OAuth2TokenKind.LOGOUT) {\n                // A back-channel logout token verifies (it is signed with the\n                // realm key) but is a notification, never a credential: no\n                // endpoint accepts it as a bearer, so it is reported dead\n                // rather than raised (RFC 7662 §2.2), bare like any other.\n                return { active: false };\n            }\n\n            if (!await this.isIntrospectionAllowed(event, payload)) {\n                // RFC 7662 §2.2's third clause: a caller \"not allowed to\n                // introspect\" the token is answered like a dead one,\n                // indistinguishable and bare.\n                return { active: false };\n            }\n\n            if (!payload.sub || !payload.sub_kind) {\n                // Not a report about a token this server ever issued: authup\n                // mints every one with a subject, so a verifying token without\n                // one was never valid. `active: false` would claim we knew it\n                // and let it lapse.\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            // Both halves, fail-closed on a missing claim: a token carrying no\n            // `jti` cannot be checked against the revocation list, and one\n            // carrying no `exp` cannot be shown to be current. Authup mints\n            // every token with both. Derived BEFORE the permission read so a\n            // dead token never pays for one.\n            let active : boolean;\n            if (payload.jti && typeof payload.exp === 'number') {\n                const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n                active = !isInactive && payload.exp * 1000 > Date.now();\n            } else {\n                active = false;\n            }\n\n            // An inactive token reports WHO it belonged to and nothing about\n            // what they may do (RFC 7662 §2.2 / §4): naming the subject is the\n            // point of reading an expired token at all, handing over their\n            // authorization set is not. It also skips resolving that set for\n            // a token nobody can use - which is why `active` is passed in\n            // rather than the permissions being dropped afterwards.\n            const subject = await resolveIntrospectionSubject({\n                identityResolver: this.identityResolver,\n                identityPermissionProvider: this.identityPermissionProvider,\n            }, {\n                sub: payload.sub,\n                subKind: payload.sub_kind,\n                clientId: payload.client_id,\n                realmId: payload.realm_id,\n                active,\n            });\n\n            if (!active) {\n                return {\n                    active,\n                    ...payload,\n                    ...subject.claims,\n                };\n            }\n\n            return {\n                active,\n                // todo: permissions property should be removed.\n                permissions: subject.permissions,\n                ...payload,\n                ...subject.claims,\n            };\n        } catch (e) {\n            // RFC 7662 §2.2: a token that \"is not active, does not exist on\n            // this server, or the protected resource is not allowed to\n            // introspect\" MUST be answered with `active: false`. A token this\n            // server cannot read does not exist on it, so it is reported like\n            // any other rather than raised - which is what §2.2 asks for and\n            // what keeps this endpoint from telling a caller whether a string\n            // was signed by a key we hold.\n            //\n            // The report is BARE, no payload: §2.2 and §4 both say not to\n            // disclose more about an inactive token, and there is nothing to\n            // disclose here anyway. The expired case is the deliberate\n            // exception, and it never reaches this catch - it is verified\n            // above and reported with its claims.\n            if (isJWTError(e)) {\n                return { active: false };\n            }\n\n            throw toOAuth2Error(e);\n        }\n    }\n\n    /**\n     * RFC 7662 §2.1: the endpoint MUST require authorization, \"such as client\n     * authentication [...] or a separate OAuth 2.0 access token\". The\n     * credential has to be INDEPENDENT of the token being introspected, since\n     * possession of that string is exactly what a finder has too (#3489): a\n     * request identity the authorization middleware resolved (the kit's own\n     * live bearer, a resource server's client-credentials bearer, Basic), or\n     * confidential client credentials as the grants read them. A bare public\n     * `client_id` identifies and authenticates nothing, so it is refused like\n     * the client-credentials grant refuses it.\n     *\n     * An expired bearer never reaches this point: the middleware answers 401\n     * before the route runs. So the expired report in `postIntrospect` is only\n     * ever handed to a caller that proved who it is, which is what makes it\n     * safe to give.\n     */\n    protected async assertIntrospectionAuthorized(event: IAppEvent) : Promise<void> {\n        if (useRequestIdentity(event)) {\n            return;\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        if (!clientId) {\n            useRequestIdentityOrFail(event);\n            return;\n        }\n\n        const body = await readRequestBody(event);\n        const certificateEvidence = await extractOAuth2ClientCertificateEvidence(event, this.certificateSource);\n        const client = await this.clientAuthenticator.authenticate(\n            clientId,\n            clientSecret,\n            readRealmHint(body),\n            certificateEvidence,\n        );\n        if (client.authMethod === ClientAuthMethod.NONE) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        // the authorization layer below reads the request identity, so the\n        // credential-authenticated client becomes one, exactly as the\n        // middleware's `clientAuthBasic` branch would have set it.\n        setRequestScopes(event, [ScopeName.GLOBAL]);\n        setRequestIdentity(event, {\n            type: IdentityType.CLIENT,\n            data: client,\n        });\n    }\n\n    /**\n     * WHOSE tokens the authenticated caller may introspect (#3489, second\n     * layer): its own subject's, those issued for its own client, or any its\n     * TOKEN_INTROSPECT grant reaches (the grant's realm scope is matched\n     * against the token's realm claim, so an `admin` reaches everything and\n     * a `realm_admin` its own realm). A resource server verifying foreign\n     * tokens through the server adapters' remote mode needs that grant. The\n     * deny is reported per RFC 7662 §2.2 as a bare `active: false`, which\n     * gives the caller nothing to diagnose with, hence the log line.\n     */\n    protected async isIntrospectionAllowed(\n        event: IAppEvent,\n        payload: OAuth2TokenPayload,\n    ) : Promise<boolean> {\n        const identity = useRequestIdentity(event);\n        if (!identity) {\n            return false;\n        }\n\n        if (\n            payload.sub &&\n            identity.type === payload.sub_kind &&\n            identity.id === payload.sub\n        ) {\n            return true;\n        }\n\n        if (\n            identity.type === IdentityType.CLIENT &&\n            payload.client_id &&\n            identity.id === payload.client_id\n        ) {\n            return true;\n        }\n\n        const actor = buildActorContext(event);\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.TOKEN_INTROSPECT,\n                data: new PolicyData({ ...(payload.realm_id ? { [BuiltInPolicyType.REALM_MATCH]: payload.realm_id } : {}) }),\n            });\n            return true;\n        } catch {\n            this.logger?.info(\n                `introspection denied: ${identity.type} ${identity.id} may not introspect the presented token`,\n            );\n            return false;\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    /**\n     * Deliberately ungated, unlike introspection (#3489). RFC 7009 §2.1 asks\n     * the client to send its credentials (a bare `client_id` for a public\n     * client) and the server to verify the token was issued to that client;\n     * authup knowingly skips both. A public `client_id` identifies and\n     * proves nothing, so an ownership check built on it would be advisory,\n     * the consoles are public clients whose kit revokes anonymously on\n     * logout teardown, revoking a token one possesses is the benign action,\n     * and the uniform 200 below leaves a scanner nothing to learn.\n     */\n    @DPost('/revoke', [])\n    async revokeToken(\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            // RFC 7009 §2.2: revoking an invalid token — here one that is expired\n            // or already inactive — MUST still succeed. The client cannot act on\n            // an error, and the token's invalidation (the point of the request)\n            // is already achieved. Signature + kind still anchor the token, so a\n            // forged/garbage token is rejected; `ignoreExpiry` additionally keeps\n            // this exp-bypass out of the shared claims cache (see\n            // OAuth2TokenVerifier). Without this, revoking a stale refresh token\n            // threw `expired_token`, so the caller's revoke-then-clear-cookie\n            // flow aborted, the durable row was never soft-revoked, and the stale\n            // refresh cookie survived into the next login.\n            const payload = await this.tokenVerifier.verify(token, {\n                ignoreExpiry: true,\n                skipActiveCheck: true,\n            });\n\n            await this.tokenRevoker.revoke(payload);\n\n            // RFC 7009 §2.2 names 200 for a successful revocation. This was a\n            // 202 - within the 2xx family, so a client reading the class was\n            // unaffected, but not the status the spec asks for.\n            event.response.status = 200;\n            return null;\n        } catch (e) {\n            // Same clause, the other half: \"invalid tokens do not cause an\n            // error response since the client cannot handle such an error in a\n            // reasonable way\". Expiry is already bypassed above, so this covers\n            // a malformed or unverifiable token, which answered 401/404. The\n            // answer is the one a valid token gets - the point is that the two\n            // are indistinguishable.\n            if (isJWTError(e)) {\n                event.response.status = 200;\n                return null;\n            }\n\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('', [])\n    async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const grantType = await guessOauth2GrantTypeByRequest(event);\n        if (!grantType) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const grant = this.tokenGrants[grantType];\n        if (!grant) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const response = await grant.runWithRequest(event);\n\n        this.metrics?.recordTokenGrant(grantType);\n\n        return response;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAmED,IAAakC,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKX,qBAAqBW,IAAIX;EAC9B,KAAKC,oBAAoBU,IAAIV;EAC7B,KAAKC,gBAAgBS,IAAIT;EACzB,KAAKC,eAAeQ,IAAIR;EACxB,KAAKC,mBAAmBO,IAAIP;EAC5B,KAAKC,6BAA6BM,IAAIN;EACtC,KAAKC,UAAUK,IAAIL;EACnB,KAAKC,sBAAsBI,IAAIC;EAC/B,KAAKJ,oBAAoBG,IAAIH;EAC7B,KAAKC,SAASE,IAAIF;EAElB,KAAKC,cAAc;IACd1C,iBAAiB6C,qBAAqB,IAAI3B,yBAAyB;IAChE4B,cAAcH,IAAIG;IAClBP,qBAAqBI,IAAIC;IACzBX,mBAAmBU,IAAIV;IACvBD,oBAAoBW,IAAIX;IACxBe,mBAAmBJ,IAAII;IACvBC,UAAUL,IAAIK;IACdC,gBAAgBN,IAAIM;IACpBC,iBAAiBP,IAAIO;IACrBC,uBAAuBR,IAAIQ;IAC3BX,mBAAmBG,IAAIH;GAC3B,CAAA;IACCxC,iBAAiBoD,qBAAqB,IAAInC,2BAA2B;IAClEgB,mBAAmBU,IAAIV;IACvBM,qBAAqBI,IAAIC;IACzBK,gBAAgBN,IAAIM;IACpBT,mBAAmBG,IAAIH;GAC3B,CAAA;IACCxC,iBAAiBqD,WAAW,IAAIjC,kBAAkB;IAC/Ca,mBAAmBU,IAAIV;IACvBD,oBAAoBW,IAAIX;IACxBsB,eAAeX,IAAIY;IACnBhB,qBAAqBI,IAAIC;IACzBK,gBAAgBN,IAAIM;IACpBC,iBAAiBP,IAAIO;IACrBM,cAAcb,IAAIa;IAClBlB,SAASK,IAAIL;IACbmB,sBAAsBd,IAAIc;IAC1BC,0BAA0Bf,IAAIe;IAC9BC,iBAAiBhB,IAAIgB;IACrBlB,QAAQE,IAAIF;IACZD,mBAAmBG,IAAIH;GAC3B,CAAA;IACCxC,iBAAiB4D,gBAAgB,IAAIzC,4BAA4B;IAC9Dc,mBAAmBU,IAAIV;IACvBD,oBAAoBW,IAAIX;IACxBE,eAAeS,IAAIT;IACnB2B,iBAAiBlB,IAAIkB;IACrBC,wBAAwBnB,IAAImB;IAC5Bb,gBAAgBN,IAAIM;IACpBV,qBAAqBI,IAAIC;IACzBM,iBAAiBP,IAAIO;IACrBM,cAAcb,IAAIa;IAClBlB,SAASK,IAAIL;IACbG,QAAQE,IAAIF;IACZsB,SAAS,EAAEC,aAAarB,IAAIsB,wBAAwB;IACpDzB,mBAAmBG,IAAIH;GAC3B,CAAA;EACJ;CACJ;CAIA,MACM0B,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,MAAM,KAAKC,8BAA8BF,KAAAA;EAEzC,IAAI;GACA,MAAMG,QAAQ,MAAMxC,wBAAwBqC,KAAAA;GAa5C,MAAMI,UAAU,MAAM,KAAKrC,cAAcsC,OAAOF,OAAO;IACnDG,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAEA,IAAIH,QAAQI,SAAS1E,gBAAgB2E,QAKjC,OAAO,EAAEC,QAAQ,MAAM;GAG3B,IAAI,CAAC,MAAM,KAAKC,uBAAuBX,OAAOI,OAAAA,GAI1C,OAAO,EAAEM,QAAQ,MAAM;GAG3B,IAAI,CAACN,QAAQQ,OAAO,CAACR,QAAQS,UAKzB,MAAMjF,mBAAmBkF,gBAAe;GAQ5C,IAAIJ;GACJ,IAAIN,QAAQW,OAAO,OAAOX,QAAQY,QAAQ,UAEtCN,SAAS,CAACO,MADe,KAAKlD,cAAckD,WAAWb,QAAQW,GAAG,KAC1CX,QAAQY,MAAM,MAAOE,KAAKC,IAAG;QAErDT,SAAS;GASb,MAAMU,UAAU,MAAMvE,4BAA4B;IAC9CoB,kBAAkB,KAAKA;IACvBC,4BAA4B,KAAKA;GACrC,GAAG;IACC0C,KAAKR,QAAQQ;IACbS,SAASjB,QAAQS;IACjBS,UAAUlB,QAAQmB;IAClBC,SAASpB,QAAQqB;IACjBf;GACJ,CAAA;GAEA,IAAI,CAACA,QACD,OAAO;IACHA;IACA,GAAGN;IACH,GAAGgB,QAAQM;GACf;GAGJ,OAAO;IACHhB;IAEAiB,aAAaP,QAAQO;IACrB,GAAGvB;IACH,GAAGgB,QAAQM;GACf;EACJ,SAASE,GAAG;GAcR,IAAI7F,WAAW6F,CAAAA,GACX,OAAO,EAAElB,QAAQ,MAAM;GAG3B,MAAM9D,cAAcgF,CAAAA;EACxB;CACJ;;;;;;;;;;;;;;;;IAkBA,MAAgB1B,8BAA8BF,OAAkC;EAC5E,IAAIvC,mBAAmBuC,KAAAA,GACnB;EAGJ,MAAM,EAAEsB,UAAUO,iBAAiB,MAAM3E,oCAAoC8C,KAAAA;EAC7E,IAAI,CAACsB,UAAU;GACX5D,yBAAyBsC,KAAAA;GACzB;EACJ;EAEA,MAAM8B,OAAO,MAAMxF,gBAAgB0D,KAAAA;EACnC,MAAM+B,sBAAsB,MAAM5E,uCAAuC6C,OAAO,KAAK3B,iBAAiB;EACtG,MAAM2D,SAAS,MAAM,KAAK5D,oBAAoB6D,aAC1CX,UACAO,cACAxE,cAAcyE,IAAAA,GACdC,mBAAAA;EAEJ,IAAIC,OAAOE,eAAelG,iBAAiBmG,MACvC,MAAMzG,kBAAkB0G,QAAO;EAMnC5E,iBAAiBwC,OAAO,CAAC7D,UAAUkG,MAAO,CAAA;EAC1C9E,mBAAmByC,OAAO;GACtBsC,MAAMrG,aAAasG;GACnBC,MAAMR;EACV,CAAA;CACJ;;;;;;;;;;IAYA,MAAgBrB,uBACZX,OACAI,SACiB;EACjB,MAAMqC,WAAWhF,mBAAmBuC,KAAAA;EACpC,IAAI,CAACyC,UACD,OAAO;EAGX,IACIrC,QAAQQ,OACR6B,SAASH,SAASlC,QAAQS,YAC1B4B,SAASC,OAAOtC,QAAQQ,KAExB,OAAO;EAGX,IACI6B,SAASH,SAASrG,aAAasG,UAC/BnC,QAAQmB,aACRkB,SAASC,OAAOtC,QAAQmB,WAExB,OAAO;EAGX,MAAMoB,QAAQrF,kBAAkB0C,KAAAA;EAChC,IAAI;GACA,MAAM2C,MAAMC,oBAAoBC,SAAS;IACrCC,MAAM5G,eAAe6G;IACrBP,MAAM,IAAInG,WAAW,EAAE,GAAI+D,QAAQqB,WAAW,GAAGrF,kBAAkB4G,cAAc5C,QAAQqB,SAAS,IAAI,CAAC,EAAG,CAAA;GAC9G,CAAA;GACA,OAAO;EACX,QAAQ;GACJ,KAAKnD,QAAQ2E,KACT,yBAAyBR,SAASH,KAAK,GAAGG,SAASC,GAAG,wCAAwC;GAElG,OAAO;EACX;CACJ;;;;;;;;;;IAcA,MACMQ,YACF,OACa;EACb,IAAI;GACA,MAAM/C,QAAQ,MAAMxC,wBAAwBqC,KAAAA;GAY5C,MAAMI,UAAU,MAAM,KAAKrC,cAAcsC,OAAOF,OAAO;IACnDG,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAEA,MAAM,KAAKvC,aAAamF,OAAO/C,OAAAA;GAK/BJ,MAAMoD,SAASC,SAAS;GACxB,OAAO;EACX,SAASzB,GAAG;GAOR,IAAI7F,WAAW6F,CAAAA,GAAI;IACf5B,MAAMoD,SAASC,SAAS;IACxB,OAAO;GACX;GAEA,MAAMzG,cAAcgF,CAAAA;EACxB;CACJ;CAIA,MACM0B,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAMnG,8BAA8B4C,KAAAA;EACtD,IAAI,CAACuD,WACD,MAAM5H,qBAAqB6H,YAAW;EAG1C,MAAMC,QAAQ,KAAKlF,YAAYgF;EAC/B,IAAI,CAACE,OACD,MAAM9H,qBAAqB6H,YAAW;EAG1C,MAAMJ,WAAW,MAAMK,MAAMC,eAAe1D,KAAAA;EAE5C,KAAK7B,SAASwF,iBAAiBJ,SAAAA;EAE/B,OAAOH;CACX;AACJ"}

package/dist/adapters/http/cookie/index.d.ts

@@ -0,0 +1,2 @@
+export * from './session.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/cookie/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/cookie/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC"}