npm - @authup/server-core - Versions diffs - 1.0.0-beta.63 → 1.0.0-beta.64 - Mend

@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (710) hide show

package/dist/core/index.mjs CHANGED Viewed

@@ -10,6 +10,7 @@ import { UserAuthenticator } from "./authentication/entities/user/module.mjs";
 import { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EVENT_RETENTION_SWEEP_BATCH_SIZE } from "./entities/event/constants.mjs";
 import { LoginThrottleService } from "./authentication/login-throttle/service.mjs";
 import { CredentialsAuthenticator } from "./authentication/module.mjs";
+import { SESSION_EXPIRY_SWEEP_BATCH_SIZE } from "./authentication/session/constants.mjs";
 import { SessionManager } from "./authentication/session/module.mjs";
 import { SESSION_FILTER_KEYS } from "./authentication/session/types.mjs";
 import "./authentication/index.mjs";
@@ -102,7 +103,7 @@ import { PermissionBindingPolicyEvaluator } from "./security/policy/evaluator.mj
 import { PolicyEngine } from "./security/policy/engine.mjs";
 import { OAuth2AccessPolicyEvaluator } from "./oauth2/access-policy/module.mjs";
 import { OAuth2AuthorizationCodeIssuer } from "./oauth2/authorization/code/issuer/module.mjs";
-import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier } from "./oauth2/authorization/helpers.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createOAuth2PKCE, deriveAmrAcr, generateOAuth2CodeVerifier } from "./oauth2/authorization/helpers.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./oauth2/authorization/code/verifier/module.mjs";
 import { OAuth2ClientAuthenticator } from "./oauth2/client/authenticator.mjs";
 import { assertClientGrantAllowed } from "./oauth2/client/grant-type.mjs";
@@ -111,6 +112,11 @@ import { OAuth2AuthorizationCodeRequestValidator } from "./oauth2/authorization/
 import { OAuth2AuthorizationStateManager } from "./oauth2/authorization/state/module.mjs";
 import { toIdentityPolicyData } from "./identity/permission/identity-policy-data.mjs";
 import { OAuth2Authorization } from "./oauth2/authorization/module.mjs";
+import { OAUTH2_BACKCHANNEL_LOGOUT_EVENT, OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE, OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT } from "./oauth2/backchannel-logout/constants.mjs";
+import { OAuth2BackchannelLogoutNotifier } from "./oauth2/backchannel-logout/module.mjs";
+import { CONSOLE_LOGIN_COOKIE, CONSOLE_LOGIN_TTL } from "./oauth2/console-login/constants.mjs";
+import { SESSION_COOKIE, SESSION_REFRESH_THROTTLE, SESSION_SECRET_LENGTH } from "./oauth2/session-credential/constants.mjs";
+import { createSessionSecret, hashSessionSecret } from "./oauth2/session-credential/module.mjs";
 import { OAuth2EndSessionService } from "./oauth2/end-session/service.mjs";
 import { OAuth2EndSessionRequestValidator } from "./oauth2/end-session/validator.mjs";
 import { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL } from "./oauth2/federated-login/constants.mjs";
@@ -132,10 +138,12 @@ import { OAuth2AuthorizeGrant } from "./oauth2/grant-types/authorize.mjs";
 import { ClientCredentialsGrant } from "./oauth2/grant-types/client-credentials.mjs";
 import { IdentityGrantType } from "./oauth2/grant-types/identity.mjs";
 import { PasswordGrantType } from "./oauth2/grant-types/password.mjs";
+import { SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE } from "./oauth2/session-token/constants.mjs";
 import { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError } from "./oauth2/session-token/error.mjs";
 import { OAuth2RefreshTokenGrant } from "./oauth2/grant-types/refresh-token.mjs";
-import { OAuth2MfaLoginService } from "./oauth2/mfa-login/module.mjs";
 import { OAuth2OpenIDClaimsBuilder } from "./oauth2/openid/claims.mjs";
+import { resolveIntrospectionSubject } from "./oauth2/introspection/module.mjs";
+import { OAuth2MfaLoginService } from "./oauth2/mfa-login/module.mjs";
 import { OAuth2ScopeAttributesResolver } from "./oauth2/scope/resolver.mjs";
 import { OAuth2AccessTokenIssuer } from "./oauth2/token/issuer/access/module.mjs";
 import { OAuth2MfaTokenIssuer } from "./oauth2/token/issuer/mfa/module.mjs";
@@ -192,4 +200,4 @@ import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/m
 import { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry } from "./provisioning/wildcard/module.mjs";
 import "./provisioning/index.mjs";
 import "./security/index.mjs";
-export { BaseCredentialsAuthenticator, CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EVENT_RETENTION_SWEEP_BATCH_SIZE, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, IDENTITY_PROVIDER_ACCOUNT_LINK_TTL, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountAlreadyLinkedError, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAccountService, IdentityProviderAccountUnlinkBlockedError, IdentityProviderAssuranceError, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2FederatedLoginRefusal, OAuth2FederatedLoginService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, REALM_WILDCARD_NAME, RECORD_QUERY_PARAMETERS, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RealmWildcardProvisioningValidator, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, SESSION_TOKEN_FILTER_KEYS, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, SessionTokenRelationMissingError, SessionTokenService, SystemClientProvisioner, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WildcardRealmProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, assertIdentityProviderAssurance, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildIdentityProviderAcrValues, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildProvisioningEntityKey, buildSystemClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, createRelationsReadGate, decodeQuery, defineMailTemplate, deriveAmrAcr, describeQuerySchema, eventSchema, expandWildcardRealmEntry, extractWildcardRealmEntry, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderAccountSchema, identityProviderRoleMappingSchema, identityProviderSchema, isIdentityProviderAccountAlreadyLinkedError, isIdentityProviderAccountUnlinkBlockedError, isIdentityProviderAssuranceError, isRealmCipherBlobError, isSessionTokenRelationMissingError, isWrappedKeyMaterial, keySchema, mergeProvisioningEntities, mergeProvisioningEntity, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, schemas, scopeSchema, sessionSchema, sessionTokenSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };
+export { BaseCredentialsAuthenticator, CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, CONSOLE_LOGIN_COOKIE, CONSOLE_LOGIN_TTL, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EVENT_RETENTION_SWEEP_BATCH_SIZE, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, IDENTITY_PROVIDER_ACCOUNT_LINK_TTL, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IDENTITY_PROVIDER_ASSURANCE_ERROR_INSTANCE, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountAlreadyLinkedError, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAccountService, IdentityProviderAccountUnlinkBlockedError, IdentityProviderAssuranceError, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAUTH2_BACKCHANNEL_LOGOUT_EVENT, OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE, OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT, OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2BackchannelLogoutNotifier, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2FederatedLoginRefusal, OAuth2FederatedLoginService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, REALM_WILDCARD_NAME, RECORD_QUERY_PARAMETERS, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RealmWildcardProvisioningValidator, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_COOKIE, SESSION_EXPIRY_SWEEP_BATCH_SIZE, SESSION_FILTER_KEYS, SESSION_REFRESH_THROTTLE, SESSION_SECRET_LENGTH, SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE, SESSION_TOKEN_FILTER_KEYS, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, SessionTokenRelationMissingError, SessionTokenService, SystemClientProvisioner, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WildcardRealmProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, assertIdentityProviderAssurance, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildIdentityProviderAcrValues, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildProvisioningEntityKey, buildSystemClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createOAuth2PKCE, createProvisioningEntitiesValidator, createRelationsReadGate, createSessionSecret, decodeQuery, defineMailTemplate, deriveAmrAcr, describeQuerySchema, eventSchema, expandWildcardRealmEntry, extractWildcardRealmEntry, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, hashSessionSecret, identityProviderAccountSchema, identityProviderRoleMappingSchema, identityProviderSchema, isIdentityProviderAccountAlreadyLinkedError, isIdentityProviderAccountUnlinkBlockedError, isIdentityProviderAssuranceError, isRealmCipherBlobError, isSessionTokenRelationMissingError, isWrappedKeyMaterial, keySchema, mergeProvisioningEntities, mergeProvisioningEntity, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, resolveIntrospectionSubject, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, schemas, scopeSchema, sessionSchema, sessionTokenSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };

package/dist/core/oauth2/authorization/helpers.d.ts CHANGED Viewed

@@ -11,5 +11,19 @@ export declare function deriveAmrAcr(session: Pick<Session, 'authMethod' | 'mfaA
 export declare function generateOAuth2CodeVerifier(): string;
 export declare function base64URLEncode(arrayBuffer: ArrayBuffer): string;
 export declare function buildOAuth2TokenHash(value: string, alg?: `${JWTAlgorithm}` | null): Promise<string>;
+/**
+ * A PKCE pair for a server-side authorization request (plan 088: the console
+ * login kick mints one, keeps the verifier in the pending login and sends the
+ * challenge to `/authorize`).
+ *
+ * Snake_case because these are wire parameters, not domain properties, and it
+ * mirrors the kit's browser-side `createPKCE()` so the two paths read alike.
+ */
+export type OAuth2PKCE = {
+    code_verifier: string;
+    code_challenge: string;
+    code_challenge_method: 'S256';
+};
+export declare function createOAuth2PKCE(): Promise<OAuth2PKCE>;
 export declare function buildOAuth2CodeChallenge(codeVerifier: string): Promise<string>;
 //# sourceMappingURL=helpers.d.ts.map

package/dist/core/oauth2/authorization/helpers.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAMtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIhD;;;;;;GAMG;AACH,wBAAgB,YAAY,CACxB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG,IAAI,GACtD,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,KAAK,CAAC,CA0CzC;AAED,wBAAgB,0BAA0B,WAazC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,UAWvD;AAWD,wBAAsB,oBAAoB,CACtC,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,GAC9B,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}
1	+ {"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAMtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIhD;;;;;;GAMG;AACH,wBAAgB,YAAY,CACxB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG,IAAI,GACtD,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,KAAK,CAAC,CA0CzC;AAED,wBAAgB,0BAA0B,WAazC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,UAWvD;AAWD,wBAAsB,oBAAoB,CACtC,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,GAC9B,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,wBAAsB,gBAAgB,IAAK,OAAO,CAAC,UAAU,CAAC,CAQ7D;AAED,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,mBAMlE"}

package/dist/core/oauth2/authorization/helpers.mjs CHANGED Viewed

@@ -68,11 +68,19 @@ async function buildOAuth2TokenHash(value, alg) {
 	const data = new TextEncoder().encode(value);
 	return base64URLEncode((await subtle.digest(digest.name, data)).slice(0, digest.halfLength));
 }
+async function createOAuth2PKCE() {
+	const codeVerifier = generateOAuth2CodeVerifier();
+	return {
+		code_verifier: codeVerifier,
+		code_challenge: await buildOAuth2CodeChallenge(codeVerifier),
+		code_challenge_method: "S256"
+	};
+}
 async function buildOAuth2CodeChallenge(codeVerifier) {
 	const data = new TextEncoder().encode(codeVerifier);
 	return base64URLEncode(await subtle.digest("SHA-256", data));
 }
 //#endregion
-export { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier };
+export { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createOAuth2PKCE, deriveAmrAcr, generateOAuth2CodeVerifier };
 //# sourceMappingURL=helpers.mjs.map

package/dist/core/oauth2/authorization/helpers.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"helpers.mjs","names":["JWTError","OAuth2AuthenticationContextClass","OAuth2AuthenticationMethodReference","SessionAuthMethod","subtle","deriveAmrAcr","session","authMethod","amr","PASSWORD","LDAP","push","EXTERNAL","mfaAt","OTP","acr","MFA","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","TOKEN_HASH_DIGESTS","name","halfLength","buildOAuth2TokenHash","value","alg","digest","slice","headerPropertyInvalid","encoder","TextEncoder","data","encode","hashBuffer","halfHash","buildOAuth2CodeChallenge"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { JWTAlgorithm, OAuth2TokenPayload } from '@authup/specs';\nimport {\n JWTError,\n OAuth2AuthenticationContextClass,\n OAuth2AuthenticationMethodReference,\n} from '@authup/specs';\nimport type { Session } from '@authup/core-kit';\nimport { SessionAuthMethod } from '@authup/core-kit';\nimport { subtle } from 'uncrypto';\n\n/\n Derive the OIDC `amr` / `acr` claims from the backing session's\n * authMethod + mfaAt (plan 050). Pre-column sessions (null authMethod)\n * yield no claims — authup cannot retroactively know how an old session\n * authenticated. M2M methods yield none either (amr/acr are user-flow\n * claims; those grants mint no id_token).\n /\nexport function deriveAmrAcr(\n session: Pick<Session, 'authMethod' \| 'mfaAt'> \| null,\n): Pick<OAuth2TokenPayload, 'amr' \| 'acr'> {\n if (!session \|\| !session.authMethod) {\n return {};\n }\n\n const amr : string[] = [];\n switch (session.authMethod) {\n case SessionAuthMethod.PASSWORD:\n case SessionAuthMethod.LDAP: {\n // LDAP is still a password factor for amr — the finer\n // distinction lives in the authup-local authMethod.\n amr.push(OAuth2AuthenticationMethodReference.PASSWORD);\n break;\n }\n case SessionAuthMethod.EXTERNAL: {\n amr.push(OAuth2AuthenticationMethodReference.EXTERNAL);\n break;\n }\n default: {\n return {};\n }\n }\n\n if (session.mfaAt) {\n amr.push(OAuth2AuthenticationMethodReference.OTP);\n }\n\n if (session.mfaAt) {\n return { amr, acr: OAuth2AuthenticationContextClass.MFA };\n }\n\n // No `acr` for a session an external provider authenticated: authup\n // verified no credential of its own, so it asserts no assurance level.\n // `urn:authup:pwd` would say the subject authenticated with a password,\n // which is exactly what did NOT happen (issue #3478). Per OIDC Core\n // §2 the claim is voluntary, so the absence is the honest answer, and\n // `amr: ['ext']` still says how the login happened.\n if (session.authMethod === SessionAuthMethod.EXTERNAL) {\n return { amr };\n }\n\n return { amr, acr: OAuth2AuthenticationContextClass.PASSWORD };\n}\n\nexport function generateOAuth2CodeVerifier() {\n const length = 64;\n const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n let codeVerifier = '';\n const randomValues = new Uint8Array(length);\n crypto.getRandomValues(randomValues);\n\n for (let i = 0; i < length; i++) {\n codeVerifier += charset[randomValues[i] % charset.length];\n }\n\n return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n // Convert the ArrayBuffer to string using Uint8 array.\n // btoa takes chars from 0-255 and base64 encodes.\n // Then convert the base64 encoded to base64url encoded.\n // (replace + with -, replace / with _, trim trailing =)\n const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n return btoa(String.fromCharCode.apply(null, charCode))\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_')\n .replace(/=+$/, '');\n}\n\n// OIDC Core §3.1.3.6: at_hash / c_hash use the hash algorithm of the id_token's\n// JWS alg (…S256 → SHA-256, …S384 → SHA-384, …S512 → SHA-512) and keep the LEFT\n// HALF of the digest — so the half-length follows the digest (16/24/32 bytes).\nconst TOKEN_HASH_DIGESTS : Record<string, { name: string, halfLength: number }> = {\n 256: { name: 'SHA-256', halfLength: 16 },\n 384: { name: 'SHA-384', halfLength: 24 },\n 512: { name: 'SHA-512', halfLength: 32 },\n};\n\nexport async function buildOAuth2TokenHash(\n value: string,\n alg?: `${JWTAlgorithm}` \| null,\n) : Promise<string> {\n // A key row without a persisted alg (nullable legacy column) signs with\n // the signer's 256 default (RS256/ES256/HS256) — derive the matching\n // SHA-256 digest. An unrecognized alg still fails loud — silently\n // defaulting there would mint a hash no conforming verifier accepts.\n const digest = alg ?\n TOKEN_HASH_DIGESTS[alg.slice(-3)] :\n TOKEN_HASH_DIGESTS['256'];\n if (!digest) {\n throw JWTError.headerPropertyInvalid('alg');\n }\n\n const encoder = new TextEncoder();\n const data = encoder.encode(value);\n const hashBuffer = await subtle.digest(digest.name, data);\n const halfHash = hashBuffer.slice(0, digest.halfLength);\n\n return base64URLEncode(halfHash);\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n const encoder = new TextEncoder();\n const data = encoder.encode(codeVerifier);\n const arrayBuffer = await subtle.digest('SHA-256', data);\n\n return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;;;;;;;;;GAwBA,SAAgBK,aACZC,SAAqD;CAErD,IAAI,CAACA,WAAW,CAACA,QAAQC,YACrB,OAAO,CAAC;CAGZ,MAAMC,MAAiB,CAAA;CACvB,QAAQF,QAAQC,YAAhB;EACI,KAAKJ,kBAAkBM;EACvB,KAAKN,kBAAkBO;GAGnBF,IAAIG,KAAKT,oCAAoCO,QAAQ;GACrD;EAEJ,KAAKN,kBAAkBS;GACnBJ,IAAIG,KAAKT,oCAAoCU,QAAQ;GACrD;EAEJ,SACI,OAAO,CAAC;CAEhB;CAEA,IAAIN,QAAQO,OACRL,IAAIG,KAAKT,oCAAoCY,GAAG;CAGpD,IAAIR,QAAQO,OACR,OAAO;EAAEL;EAAKO,KAAKd,iCAAiCe;CAAI;CAS5D,IAAIV,QAAQC,eAAeJ,kBAAkBS,UACzC,OAAO,EAAEJ,IAAI;CAGjB,OAAO;EAAEA;EAAKO,KAAKd,iCAAiCQ;CAAS;AACjE;AAEA,SAAgBQ,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAKA,MAAMC,qBAA4E;CAC9E,KAAK;EAAEC,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;AAC3C;AAEA,eAAsBC,qBAClBC,OACAC,KAA8B;CAM9B,MAAMC,SAASD,MACXL,mBAAmBK,IAAIE,MAAM,EAAC,KAC9BP,mBAAmB;CACvB,IAAI,CAACM,QACD,MAAM1C,SAAS4C,sBAAsB,KAAA;CAIzC,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOR,KAAAA;CAI5B,OAAOd,iBAFUuB,MADQ7C,OAAOsC,OAAOA,OAAOL,MAAMU,IAAAA,EAAAA,CACxBJ,MAAM,GAAGD,OAAOJ,UAErBY,CAAAA;AAC3B;~~AAEA~~,eAAsBC,~~yBAAyB~~/B,cAAoB;CAE/D,MAAM2B,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAO5B,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGvB,OAAOsC,OAAO,WAAWK,IAAAA,CAE5BpB;AAC3B"}
1	+ {"version":3,"file":"helpers.mjs","names":["JWTError","OAuth2AuthenticationContextClass","OAuth2AuthenticationMethodReference","SessionAuthMethod","subtle","deriveAmrAcr","session","authMethod","amr","PASSWORD","LDAP","push","EXTERNAL","mfaAt","OTP","acr","MFA","generateOAuth2CodeVerifier","length","charset","codeVerifier","randomValues","Uint8Array","crypto","getRandomValues","i","base64URLEncode","arrayBuffer","charCode","Array","from","btoa","String","fromCharCode","apply","replace","TOKEN_HASH_DIGESTS","name","halfLength","buildOAuth2TokenHash","value","alg","digest","slice","headerPropertyInvalid","encoder","TextEncoder","data","encode","hashBuffer","halfHash","createOAuth2PKCE","code_verifier","code_challenge","buildOAuth2CodeChallenge","code_challenge_method"],"sources":["../../../../src/core/oauth2/authorization/helpers.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { JWTAlgorithm, OAuth2TokenPayload } from '@authup/specs';\nimport {\n JWTError,\n OAuth2AuthenticationContextClass,\n OAuth2AuthenticationMethodReference,\n} from '@authup/specs';\nimport type { Session } from '@authup/core-kit';\nimport { SessionAuthMethod } from '@authup/core-kit';\nimport { subtle } from 'uncrypto';\n\n/\n Derive the OIDC `amr` / `acr` claims from the backing session's\n * authMethod + mfaAt (plan 050). Pre-column sessions (null authMethod)\n * yield no claims — authup cannot retroactively know how an old session\n * authenticated. M2M methods yield none either (amr/acr are user-flow\n * claims; those grants mint no id_token).\n /\nexport function deriveAmrAcr(\n session: Pick<Session, 'authMethod' \| 'mfaAt'> \| null,\n): Pick<OAuth2TokenPayload, 'amr' \| 'acr'> {\n if (!session \|\| !session.authMethod) {\n return {};\n }\n\n const amr : string[] = [];\n switch (session.authMethod) {\n case SessionAuthMethod.PASSWORD:\n case SessionAuthMethod.LDAP: {\n // LDAP is still a password factor for amr — the finer\n // distinction lives in the authup-local authMethod.\n amr.push(OAuth2AuthenticationMethodReference.PASSWORD);\n break;\n }\n case SessionAuthMethod.EXTERNAL: {\n amr.push(OAuth2AuthenticationMethodReference.EXTERNAL);\n break;\n }\n default: {\n return {};\n }\n }\n\n if (session.mfaAt) {\n amr.push(OAuth2AuthenticationMethodReference.OTP);\n }\n\n if (session.mfaAt) {\n return { amr, acr: OAuth2AuthenticationContextClass.MFA };\n }\n\n // No `acr` for a session an external provider authenticated: authup\n // verified no credential of its own, so it asserts no assurance level.\n // `urn:authup:pwd` would say the subject authenticated with a password,\n // which is exactly what did NOT happen (issue #3478). Per OIDC Core\n // §2 the claim is voluntary, so the absence is the honest answer, and\n // `amr: ['ext']` still says how the login happened.\n if (session.authMethod === SessionAuthMethod.EXTERNAL) {\n return { amr };\n }\n\n return { amr, acr: OAuth2AuthenticationContextClass.PASSWORD };\n}\n\nexport function generateOAuth2CodeVerifier() {\n const length = 64;\n const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n\n let codeVerifier = '';\n const randomValues = new Uint8Array(length);\n crypto.getRandomValues(randomValues);\n\n for (let i = 0; i < length; i++) {\n codeVerifier += charset[randomValues[i] % charset.length];\n }\n\n return codeVerifier;\n}\n\nexport function base64URLEncode(arrayBuffer: ArrayBuffer) {\n // Convert the ArrayBuffer to string using Uint8 array.\n // btoa takes chars from 0-255 and base64 encodes.\n // Then convert the base64 encoded to base64url encoded.\n // (replace + with -, replace / with _, trim trailing =)\n const charCode = Array.from(new Uint8Array(arrayBuffer));\n\n return btoa(String.fromCharCode.apply(null, charCode))\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_')\n .replace(/=+$/, '');\n}\n\n// OIDC Core §3.1.3.6: at_hash / c_hash use the hash algorithm of the id_token's\n// JWS alg (…S256 → SHA-256, …S384 → SHA-384, …S512 → SHA-512) and keep the LEFT\n// HALF of the digest — so the half-length follows the digest (16/24/32 bytes).\nconst TOKEN_HASH_DIGESTS : Record<string, { name: string, halfLength: number }> = {\n 256: { name: 'SHA-256', halfLength: 16 },\n 384: { name: 'SHA-384', halfLength: 24 },\n 512: { name: 'SHA-512', halfLength: 32 },\n};\n\nexport async function buildOAuth2TokenHash(\n value: string,\n alg?: `${JWTAlgorithm}` \| null,\n) : Promise<string> {\n // A key row without a persisted alg (nullable legacy column) signs with\n // the signer's 256 default (RS256/ES256/HS256) — derive the matching\n // SHA-256 digest. An unrecognized alg still fails loud — silently\n // defaulting there would mint a hash no conforming verifier accepts.\n const digest = alg ?\n TOKEN_HASH_DIGESTS[alg.slice(-3)] :\n TOKEN_HASH_DIGESTS['256'];\n if (!digest) {\n throw JWTError.headerPropertyInvalid('alg');\n }\n\n const encoder = new TextEncoder();\n const data = encoder.encode(value);\n const hashBuffer = await subtle.digest(digest.name, data);\n const halfHash = hashBuffer.slice(0, digest.halfLength);\n\n return base64URLEncode(halfHash);\n}\n\n/*\n A PKCE pair for a server-side authorization request (plan 088: the console\n * login kick mints one, keeps the verifier in the pending login and sends the\n * challenge to `/authorize`).\n \n Snake_case because these are wire parameters, not domain properties, and it\n * mirrors the kit's browser-side `createPKCE()` so the two paths read alike.\n */\nexport type OAuth2PKCE = {\n code_verifier: string,\n code_challenge: string,\n code_challenge_method: 'S256',\n};\n\nexport async function createOAuth2PKCE() : Promise<OAuth2PKCE> {\n const codeVerifier = generateOAuth2CodeVerifier();\n\n return {\n code_verifier: codeVerifier,\n code_challenge: await buildOAuth2CodeChallenge(codeVerifier),\n code_challenge_method: 'S256',\n };\n}\n\nexport async function buildOAuth2CodeChallenge(codeVerifier: string) {\n const encoder = new TextEncoder();\n const data = encoder.encode(codeVerifier);\n const arrayBuffer = await subtle.digest('SHA-256', data);\n\n return base64URLEncode(arrayBuffer);\n}\n"],"mappings":";;;;;;;;;;;;;GAwBA,SAAgBK,aACZC,SAAqD;CAErD,IAAI,CAACA,WAAW,CAACA,QAAQC,YACrB,OAAO,CAAC;CAGZ,MAAMC,MAAiB,CAAA;CACvB,QAAQF,QAAQC,YAAhB;EACI,KAAKJ,kBAAkBM;EACvB,KAAKN,kBAAkBO;GAGnBF,IAAIG,KAAKT,oCAAoCO,QAAQ;GACrD;EAEJ,KAAKN,kBAAkBS;GACnBJ,IAAIG,KAAKT,oCAAoCU,QAAQ;GACrD;EAEJ,SACI,OAAO,CAAC;CAEhB;CAEA,IAAIN,QAAQO,OACRL,IAAIG,KAAKT,oCAAoCY,GAAG;CAGpD,IAAIR,QAAQO,OACR,OAAO;EAAEL;EAAKO,KAAKd,iCAAiCe;CAAI;CAS5D,IAAIV,QAAQC,eAAeJ,kBAAkBS,UACzC,OAAO,EAAEJ,IAAI;CAGjB,OAAO;EAAEA;EAAKO,KAAKd,iCAAiCQ;CAAS;AACjE;AAEA,SAAgBQ,6BAAAA;CACZ,MAAMC,SAAS;CACf,MAAMC,UAAU;CAEhB,IAAIC,eAAe;CACnB,MAAMC,eAAe,IAAIC,WAAWJ,MAAAA;CACpCK,OAAOC,gBAAgBH,YAAAA;CAEvB,KAAK,IAAII,IAAI,GAAGA,IAAIP,QAAQO,KACxBL,gBAAgBD,QAAQE,aAAaI,KAAKN;CAG9C,OAAOC;AACX;AAEA,SAAgBM,gBAAgBC,aAAwB;CAKpD,MAAMC,WAAWC,MAAMC,KAAK,IAAIR,WAAWK,WAAAA,CAAAA;CAE3C,OAAOI,KAAKC,OAAOC,aAAaC,MAAM,MAAMN,QAAAA,CAAAA,CAAAA,CACvCO,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,GAAA,CAAA,CACfA,QAAQ,OAAO,EAAA;AACxB;AAKA,MAAMC,qBAA4E;CAC9E,KAAK;EAAEC,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;CACvC,KAAK;EAAED,MAAM;EAAWC,YAAY;CAAG;AAC3C;AAEA,eAAsBC,qBAClBC,OACAC,KAA8B;CAM9B,MAAMC,SAASD,MACXL,mBAAmBK,IAAIE,MAAM,EAAC,KAC9BP,mBAAmB;CACvB,IAAI,CAACM,QACD,MAAM1C,SAAS4C,sBAAsB,KAAA;CAIzC,MAAMG,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAOR,KAAAA;CAI5B,OAAOd,iBAFUuB,MADQ7C,OAAOsC,OAAOA,OAAOL,MAAMU,IAAAA,EAAAA,CACxBJ,MAAM,GAAGD,OAAOJ,UAErBY,CAAAA;AAC3B;AAgBA,eAAsBC,mBAAAA;CAClB,MAAM/B,eAAeH,2BAAAA;CAErB,OAAO;EACHmC,eAAehC;EACfiC,gBAAgB,MAAMC,yBAAyBlC,YAAAA;EAC/CmC,uBAAuB;CAC3B;AACJ;AAEA,eAAsBD,yBAAyBlC,cAAoB;CAE/D,MAAM2B,OAAOF,IADOC,YACPD,CAAAA,CAAQG,OAAO5B,YAAAA;CAG5B,OAAOM,gBAAgBC,MAFGvB,OAAOsC,OAAO,WAAWK,IAAAA,CAE5BpB;AAC3B"}

package/dist/core/oauth2/authorization/index.mjs CHANGED Viewed

@@ -2,7 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2AuthorizationCodeIssuer } from "./code/issuer/module.mjs";
-import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier } from "./helpers.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createOAuth2PKCE, deriveAmrAcr, generateOAuth2CodeVerifier } from "./helpers.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./code/verifier/module.mjs";
 import "./code/index.mjs";
 import { OAuth2AuthorizationCodeRequestVerifier } from "./code-request/verifier/module.mjs";
@@ -11,4 +11,4 @@ import "./code-request/index.mjs";
 import { OAuth2AuthorizationStateManager } from "./state/module.mjs";
 import "./state/index.mjs";
 import { OAuth2Authorization } from "./module.mjs";
-export { OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier };
+export { OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createOAuth2PKCE, deriveAmrAcr, generateOAuth2CodeVerifier };

package/dist/core/oauth2/authorization/module.mjs CHANGED Viewed

@@ -116,7 +116,7 @@ var OAuth2Authorization = class {
 		if (options.client?.accessPolicyId) {
 			let allowed = false;
 			const subject = toIdentityPolicyData(identity);
-			if (this.accessPolicyEvaluator && subject) allowed = await this.accessPolicyEvaluator.evaluate(options.client.accessPolicyId, subject);
+			if (subject && this.accessPolicyEvaluator) allowed = await this.accessPolicyEvaluator.evaluate(options.client.accessPolicyId, subject);
 			if (!allowed) throw OAuth2AccessDeniedError.forClient(options.redirectUriVerified && data.redirect_uri ? {
 				redirectUri: data.redirect_uri,
 				state: data.state ?? null

package/dist/core/oauth2/authorization/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["EventName","EventRefType","EventScope","IdentityType","SessionAuthMethod","hasInstanceof","OAUTH2_ACCESS_DENIED_ERROR_INSTANCE","OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE","OAUTH2_MFA_REQUIRED_ERROR_INSTANCE","OAuth2AccessDeniedError","OAuth2AuthenticationContextClass","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2LoginRequiredError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2ResponseTypeError","toIdentityPolicyData","DEFAULT_PROMPT_LOGIN_MAX_AGE","DEFAULT_MFA_FRESHNESS_MAX_AGE","OAuth2Authorization","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","ctx","authorize","data","identity","options","result","authorizeInner","record","scope","OAUTH2","name","AUTHORIZE","refType","CLIENT","refId","client","id","client_id","clientId","sessionId","actorType","type","actorId","actorName","realmId","realm_id","reason","builtIn","recordAuthorize","e","AUTHORIZE_FAILED","responseTypes","response_type","Array","isArray","split","responseType","CODE","unsupported","includes","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","realmMismatch","nowSeconds","Math","floor","Date","now","authTime","session","findOneById","createdAt","getTime","USER","challenge","issueMaterial","externallyAuthenticated","authMethod","EXTERNAL","required","mfaAt","challengeRequired","enrollmentRequired","acr_values","acrValues","MFA","mfaAtSeconds","stepUpRequired","prompts","prompt","LOGIN","reauthenticationRequired","max_age","maxAge","Number","isFinite","accessPolicyId","allowed","subject","evaluate","forClient","redirectUriVerified","undefined","codeEntity","issue","authorizationCode"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type {\n Identity, \n OAuth2AuthorizationCode, \n OAuth2AuthorizationCodeRequest, \n Session,\n} from '@authup/core-kit';\nimport {\n EventName, \n EventRefType, \n EventScope, \n IdentityType,\n SessionAuthMethod,\n} from '@authup/core-kit';\nimport { hasInstanceof } from '@authup/errors';\nimport {\n OAUTH2_ACCESS_DENIED_ERROR_INSTANCE,\n OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE,\n OAUTH2_MFA_REQUIRED_ERROR_INSTANCE,\n OAuth2AccessDeniedError,\n OAuth2AuthenticationContextClass,\n OAuth2AuthorizationPrompt,\n OAuth2AuthorizationResponseType,\n OAuth2GrantError,\n OAuth2LoginRequiredError,\n OAuth2MfaRequiredError,\n OAuth2RequestError,\n OAuth2ResponseTypeError,\n} from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport { toIdentityPolicyData } from '../../identity/permission/identity-policy-data.ts';\nimport type {\n OAuth2AuthorizationManagerContext,\n OAuth2AuthorizationOptions,\n OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IEventService, IUserAuthenticatorChallengeProvider } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\n\nconst DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;\n\n// Deliberately 60 (not 0, deviating from the plan-050 sketch): the hosted\n// challenge round-trip (stamp mfa_at → retry POST /authorize) takes seconds,\n// so a 0-window step-up could never be satisfied and would loop the ladder.\nconst DEFAULT_MFA_FRESHNESS_MAX_AGE = 60;\n\nexport class OAuth2Authorization {\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected sessionManager : ISessionManager;\n\n protected eventService? : IEventService;\n\n protected metrics? : IAuthFlowMetrics;\n\n protected promptLoginMaxAge : number;\n\n protected mfaFreshnessMaxAge : number;\n\n protected mfaChallengeProvider? : IUserAuthenticatorChallengeProvider;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n constructor(ctx: OAuth2AuthorizationManagerContext) {\n this.codeIssuer = ctx.codeIssuer;\n this.sessionManager = ctx.sessionManager;\n this.eventService = ctx.eventService;\n this.metrics = ctx.metrics;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;\n this.mfaFreshnessMaxAge = ctx.mfaFreshnessMaxAge ?? DEFAULT_MFA_FRESHNESS_MAX_AGE;\n this.mfaChallengeProvider = ctx.mfaChallengeProvider;\n }\n\n /\n Authorize with validated codeRequest.\n \n @param data\n * @param identity\n * @param options\n */\n async authorize(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n try {\n const result = await this.authorizeInner(data, identity, options);\n\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n sessionId: options.sessionId ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: {\n reason: options.client?.builtIn ? 'autoConsent' : 'consent',\n ...(data.scope ? { scope: data.scope } : {}),\n },\n });\n this.metrics?.recordAuthorize('issued');\n\n return result;\n } catch (e) {\n if (hasInstanceof(e, OAUTH2_ACCESS_DENIED_ERROR_INSTANCE)) {\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE_FAILED,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n sessionId: options.sessionId ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: { reason: 'accessPolicy' },\n });\n this.metrics?.recordAuthorize('denied');\n } else if (hasInstanceof(e, OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('login_required');\n } else if (hasInstanceof(e, OAUTH2_MFA_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('mfa_required');\n } else {\n this.metrics?.recordAuthorize('error');\n }\n\n throw e;\n }\n }\n\n protected async authorizeInner(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n // OAuth 2.1 posture: only the authorization-code response type is\n // supported — implicit/hybrid (token, id_token, none) were dropped\n // (plan 042 item 3). Defense in depth behind the request validator.\n let responseTypes : string[] = [];\n if (data.response_type) {\n responseTypes = Array.isArray(data.response_type) ?\n data.response_type :\n data.response_type.split(' ');\n }\n\n for (const responseType of responseTypes) {\n if (responseType !== OAuth2AuthorizationResponseType.CODE) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n }\n\n if (!responseTypes.includes(OAuth2AuthorizationResponseType.CODE)) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n\n if (!data.redirect_uri) {\n throw OAuth2GrantError.redirectUriMismatch();\n }\n\n const output : OAuth2AuthorizationResult = {\n redirectUri: data.redirect_uri,\n ...(data.state ? { state: data.state } : {}),\n };\n\n if (!identity) {\n throw OAuth2RequestError.identityInvalid();\n }\n\n // Realm binding: the code-request verifier stamped data.realm_id with the\n // resolved client's realm. The authenticated identity must belong to that\n // same realm — otherwise a lingering session for realm A could silently\n // mint a code/token for realm B's client (confused deputy). The error body\n // deliberately carries no identity data (no realm-enumeration oracle).\n // The comparison reads the scalar realmId column, NOT the realm\n // relation — the relation may simply not be loaded on the resolved\n // identity. An identity without a realmId fails closed the same way —\n // clean login_required, never a TypeError.\n if (\n data.realm_id &&\n identity.data.realmId !== data.realm_id\n ) {\n throw OAuth2LoginRequiredError.realmMismatch();\n }\n\n // Authentication time = the backing session's creation instant (NOT\n // refreshed_at — a token refresh must not reset it). Session-less flows\n // (e.g. HTTP Basic authorize) present live credentials on this request,\n // so the authentication time is \"now\".\n const nowSeconds = Math.floor(Date.now() / 1000);\n let authTime = nowSeconds;\n let session : Session \| null = null;\n if (options.sessionId) {\n session = await this.sessionManager.findOneById(options.sessionId);\n if (session && session.createdAt) {\n authTime = Math.floor(new Date(session.createdAt).getTime() / 1000);\n }\n }\n\n // MFA backstop (plan 049) — the authoritative server-side gate; the\n // hosted UI's challenge step is convenience. The proof is session-bound\n // (mfa_at — stamped by the challenge endpoint or the password grant's\n // otp param), so a session-less flow (HTTP Basic) cannot carry one and\n // fails closed while the user holds a confirmed device. A user without\n // a device under mfaRequired is routed to inline enrollment.\n if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {\n // requirement flags only — the interactive challenge material (the\n // webauthn nonce) is issued by the status endpoint, not this backstop.\n const challenge = await this.mfaChallengeProvider.challenge(\n identity.data.id,\n { issueMaterial: false },\n );\n // The local second factor belongs to a local credential. A\n // session established by an external identity provider was\n // authenticated THERE, which is where MFA is configured and\n // enforced for it, so authup does not stack a factor of its own\n // on top and `mfaRequired` does not force local enrollment on\n // those users. The route is opt-in either way: an external\n // identity reaches an existing account only through the\n // bearer-authenticated link flow, since a first login provisions\n // a NEW user (plan 091). A session-less authorize (HTTP Basic) is\n // not external and keeps the gate.\n const externallyAuthenticated = session?.authMethod === SessionAuthMethod.EXTERNAL;\n\n if (!externallyAuthenticated) {\n if (challenge.required && !session?.mfaAt) {\n throw OAuth2MfaRequiredError.challengeRequired();\n }\n\n if (challenge.enrollmentRequired) {\n throw OAuth2MfaRequiredError.enrollmentRequired();\n }\n }\n\n // Step-up (plan 050 stage 3): a requested `acr_values` containing\n // urn:authup:mfa is a TRIGGER (Auth0/Keycloak stance) — the proof\n // must additionally be FRESH (mfaFreshnessMaxAge window, mirroring\n // promptLoginMaxAge's absorb-the-round-trip semantics). Enforced\n // only while the user actually holds a factor — per OIDC Core\n // §5.5.1.1 acr is voluntary, so an unsatisfiable request degrades\n // to the achieved acr instead of bricking the RP.\n //\n // This one DOES apply to an externally authenticated session: the\n // application asked for MFA explicitly, and a local factor the\n // user holds is the only way authup can answer that. Trusting the\n // upstream is the default, not a refusal to prove anything.\n if (challenge.required && data.acr_values) {\n const acrValues = data.acr_values.split(' ');\n if (acrValues.includes(OAuth2AuthenticationContextClass.MFA)) {\n const mfaAtSeconds = session?.mfaAt ?\n Math.floor(new Date(session.mfaAt).getTime() / 1000) :\n null;\n if (mfaAtSeconds === null \|\| nowSeconds - mfaAtSeconds > this.mfaFreshnessMaxAge) {\n throw OAuth2MfaRequiredError.stepUpRequired();\n }\n }\n }\n }\n\n // OIDC §3.1.2.1 prompt=login / max_age freshness (enforced only when\n // requested — a plain authorize never throws here). The hosted page\n // renders the login form for prompt=login; this is the server backstop.\n const prompts = data.prompt ? data.prompt.split(' ') : [];\n if (\n prompts.includes(OAuth2AuthorizationPrompt.LOGIN) &&\n nowSeconds - authTime > this.promptLoginMaxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n\n if (\n typeof data.max_age !== 'undefined' &&\n data.max_age !== null\n ) {\n const maxAge = Number(data.max_age);\n if (\n Number.isFinite(maxAge) &&\n nowSeconds - authTime > maxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n }\n\n // Application access policy (plan 052) — the last gate before\n // issuance: a denial is only revealed to a fully-authenticated\n // (incl. second-factor) identity. A client carrying a policy id with\n // no wired evaluator denies too (never silently allow a configured\n // gate). The redirect target rides the error only when the\n // redirect_uri was pattern-verified (RFC 6749 §4.1.2.1).\n if (options.client?.accessPolicyId) {\n let allowed = false;\n\n const subject = toIdentityPolicyData(identity);\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n options.client.accessPolicyId,\n subject,\n );\n }\n\n if (!allowed) {\n throw OAuth2AccessDeniedError.forClient(\n options.redirectUriVerified && data.redirect_uri ?\n { redirectUri: data.redirect_uri, state: data.state ?? null } :\n undefined,\n );\n }\n }\n\n // The id_token is NOT minted here — the /token exchange mints it after\n // resolving the real backing session, so its `sid` is authoritative\n // (plan 042 item 6). The code carries the authentication instant.\n const codeEntity : OAuth2AuthorizationCode = await this.codeIssuer.issue(\n data,\n identity,\n {\n sessionId: options.sessionId,\n authTime,\n authMethod: session?.authMethod ?? null,\n },\n );\n\n output.authorizationCode = codeEntity.id;\n\n return output;\n }\n}\n"],"mappings":";;;;;;;;AA+CA,MAAMmB,+BAA+B;AAKrC,MAAMC,gCAAgC;AAEtC,IAAaC,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKR,aAAaQ,IAAIR;EACtB,KAAKC,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,UAAUK,IAAIL;EACnB,KAAKI,wBAAwBC,IAAID;EACjC,KAAKH,oBAAoBI,IAAIJ,qBAAqBP;EAClD,KAAKQ,qBAAqBG,IAAIH,sBAAsBP;EACpD,KAAKQ,uBAAuBE,IAAIF;CACpC;;;;;;;IASA,MAAMG,UACFC,MACAC,UACAC,UAAsC,CAAC,GACJ;EACnC,IAAI;GACA,MAAMC,SAAS,MAAM,KAAKC,eAAeJ,MAAMC,UAAUC,OAAAA;GAEzD,MAAM,KAAKV,cAAca,OAAO;IAC5BC,OAAOpC,WAAWqC;IAClBC,MAAMxC,UAAUyC;IAChBC,SAASzC,aAAa0C;IACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAClDE,WAAWf,QAAQe,aAAa;IAChCC,WAAWjB,SAASkB;IACpBC,SAASnB,SAASD,KAAKc;IACvBO,WAAWpB,SAASD,KAAKQ;IACzBc,SAAStB,KAAKuB,YAAY;IAC1BvB,MAAM;KACFwB,QAAQtB,QAAQW,QAAQY,UAAU,gBAAgB;KAClD,GAAIzB,KAAKM,QAAQ,EAAEA,OAAON,KAAKM,MAAM,IAAI,CAAC;IAC9C;GACJ,CAAA;GACA,KAAKb,SAASiC,gBAAgB,QAAA;GAE9B,OAAOvB;EACX,SAASwB,GAAG;GACR,IAAItD,cAAcsD,GAAGrD,mCAAAA,GAAsC;IACvD,MAAM,KAAKkB,cAAca,OAAO;KAC5BC,OAAOpC,WAAWqC;KAClBC,MAAMxC,UAAU4D;KAChBlB,SAASzC,aAAa0C;KACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAClDE,WAAWf,QAAQe,aAAa;KAChCC,WAAWjB,SAASkB;KACpBC,SAASnB,SAASD,KAAKc;KACvBO,WAAWpB,SAASD,KAAKQ;KACzBc,SAAStB,KAAKuB,YAAY;KAC1BvB,MAAM,EAAEwB,QAAQ,eAAe;IACnC,CAAA;IACA,KAAK/B,SAASiC,gBAAgB,QAAA;GAClC,OAAO,IAAIrD,cAAcsD,GAAGpD,oCAAAA,GACxB,KAAKkB,SAASiC,gBAAgB,gBAAA;QAC3B,IAAIrD,cAAcsD,GAAGnD,kCAAAA,GACxB,KAAKiB,SAASiC,gBAAgB,cAAA;QAE9B,KAAKjC,SAASiC,gBAAgB,OAAA;GAGlC,MAAMC;EACV;CACJ;CAEA,MAAgBvB,eACZJ,MACAC,UACAC,UAAsC,CAAC,GACJ;EAInC,IAAI2B,gBAA2B,CAAA;EAC/B,IAAI7B,KAAK8B,eACLD,gBAAgBE,MAAMC,QAAQhC,KAAK8B,aAAa,IAC5C9B,KAAK8B,gBACL9B,KAAK8B,cAAcG,MAAM,GAAA;EAGjC,KAAK,MAAMC,gBAAgBL,eACvB,IAAIK,iBAAiBtD,gCAAgCuD,MACjD,MAAMlD,wBAAwBmD,YAAW;EAIjD,IAAI,CAACP,cAAcQ,SAASzD,gCAAgCuD,IAAI,GAC5D,MAAMlD,wBAAwBmD,YAAW;EAG7C,IAAI,CAACpC,KAAKsC,cACN,MAAMzD,iBAAiB0D,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAazC,KAAKsC;GAClB,GAAItC,KAAK0C,QAAQ,EAAEA,OAAO1C,KAAK0C,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACzC,UACD,MAAMjB,mBAAmB2D,gBAAe;EAY5C,IACI3C,KAAKuB,YACLtB,SAASD,KAAKsB,YAAYtB,KAAKuB,UAE/B,MAAMzC,yBAAyB8D,cAAa;EAOhD,MAAMC,aAAaC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;EAC3C,IAAIC,WAAWL;EACf,IAAIM,UAA2B;EAC/B,IAAIjD,QAAQe,WAAW;GACnBkC,UAAU,MAAM,KAAK5D,eAAe6D,YAAYlD,QAAQe,SAAS;GACjE,IAAIkC,WAAWA,QAAQE,WACnBH,WAAWJ,KAAKC,MAAM,IAAIC,KAAKG,QAAQE,SAAS,CAAA,CAAEC,QAAO,IAAK,GAAA;EAEtE;EAQA,IAAI,KAAK1D,wBAAwBK,SAASkB,SAAShD,aAAaoF,MAAM;GAGlE,MAAMC,YAAY,MAAM,KAAK5D,qBAAqB4D,UAC9CvD,SAASD,KAAKc,IACd,EAAE2C,eAAe,MAAM,CAAA;GAc3B,IAAI,EAF4BN,SAASQ,eAAevF,kBAAkBwF,WAE5C;IAC1B,IAAIJ,UAAUK,YAAY,CAACV,SAASW,OAChC,MAAM/E,uBAAuBgF,kBAAiB;IAGlD,IAAIP,UAAUQ,oBACV,MAAMjF,uBAAuBiF,mBAAkB;GAEvD;GAcA,IAAIR,UAAUK,YAAY7D,KAAKiE,YACTjE;QAAAA,KAAKiE,WAAWhC,MAAM,GACpCiC,CAAAA,CAAU7B,SAAS3D,iCAAiCyF,GAAG,GAAG;KAC1D,MAAMC,eAAejB,SAASW,QAC1BhB,KAAKC,MAAM,IAAIC,KAAKG,QAAQW,KAAK,CAAA,CAAER,QAAO,IAAK,GAAA,IAC/C;KACJ,IAAIc,iBAAiB,QAAQvB,aAAauB,eAAe,KAAKzE,oBAC1D,MAAMZ,uBAAuBsF,eAAc;IAEnD;;EAER;EAMA,KADgBrE,KAAKuE,SAASvE,KAAKuE,OAAOtC,MAAM,GAAA,IAAO,CAAA,EAAA,CAE3CI,SAAS1D,0BAA0B6F,KAAK,KAChD3B,aAAaK,WAAW,KAAKxD,mBAE7B,MAAMZ,yBAAyB2F,yBAAwB;EAG3D,IACI,OAAOzE,KAAK0E,YAAY,eACxB1E,KAAK0E,YAAY,MACnB;GACE,MAAMC,SAASC,OAAO5E,KAAK0E,OAAO;GAClC,IACIE,OAAOC,SAASF,MAAAA,KAChB9B,aAAaK,WAAWyB,QAExB,MAAM7F,yBAAyB2F,yBAAwB;EAE/D;EAQA,IAAIvE,QAAQW,QAAQiE,gBAAgB;GAChC,IAAIC,UAAU;GAEd,MAAMC,UAAU9F,qBAAqBe,QAAAA;GACrC,IAAI,KAAKJ,yBAAyBmF,SAC9BD,UAAU,MAAM,KAAKlF,sBAAsBoF,SACvC/E,QAAQW,OAAOiE,gBACfE,OAAAA;GAIR,IAAI,CAACD,SACD,MAAMtG,wBAAwByG,UAC1BhF,QAAQiF,uBAAuBnF,KAAKsC,eAChC;IAAEG,aAAazC,KAAKsC;IAAcI,OAAO1C,KAAK0C,SAAS;GAAK,IAC5D0C,KAAAA,CAAAA;EAGhB;EAeA5C,OAAO+C,qBAAoBF,MAVwB,KAAK/F,WAAWgG,MAC/DtF,MACAC,UACA;GACIgB,WAAWf,QAAQe;GACnBiC;GACAS,YAAYR,SAASQ,cAAc;EACvC,CAAA,EAAA,CAGkC7C;EAEtC,OAAO0B;CACX;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["EventName","EventRefType","EventScope","IdentityType","SessionAuthMethod","hasInstanceof","OAUTH2_ACCESS_DENIED_ERROR_INSTANCE","OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE","OAUTH2_MFA_REQUIRED_ERROR_INSTANCE","OAuth2AccessDeniedError","OAuth2AuthenticationContextClass","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","OAuth2GrantError","OAuth2LoginRequiredError","OAuth2MfaRequiredError","OAuth2RequestError","OAuth2ResponseTypeError","toIdentityPolicyData","DEFAULT_PROMPT_LOGIN_MAX_AGE","DEFAULT_MFA_FRESHNESS_MAX_AGE","OAuth2Authorization","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","ctx","authorize","data","identity","options","result","authorizeInner","record","scope","OAUTH2","name","AUTHORIZE","refType","CLIENT","refId","client","id","client_id","clientId","sessionId","actorType","type","actorId","actorName","realmId","realm_id","reason","builtIn","recordAuthorize","e","AUTHORIZE_FAILED","responseTypes","response_type","Array","isArray","split","responseType","CODE","unsupported","includes","redirect_uri","redirectUriMismatch","output","redirectUri","state","identityInvalid","realmMismatch","nowSeconds","Math","floor","Date","now","authTime","session","findOneById","createdAt","getTime","USER","challenge","issueMaterial","externallyAuthenticated","authMethod","EXTERNAL","required","mfaAt","challengeRequired","enrollmentRequired","acr_values","acrValues","MFA","mfaAtSeconds","stepUpRequired","prompts","prompt","LOGIN","reauthenticationRequired","max_age","maxAge","Number","isFinite","accessPolicyId","allowed","subject","evaluate","forClient","redirectUriVerified","undefined","codeEntity","issue","authorizationCode"],"sources":["../../../../src/core/oauth2/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type {\n Identity, \n OAuth2AuthorizationCode, \n OAuth2AuthorizationCodeRequest, \n Session,\n} from '@authup/core-kit';\nimport {\n EventName, \n EventRefType, \n EventScope, \n IdentityType,\n SessionAuthMethod,\n} from '@authup/core-kit';\nimport { hasInstanceof } from '@authup/errors';\nimport {\n OAUTH2_ACCESS_DENIED_ERROR_INSTANCE,\n OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE,\n OAUTH2_MFA_REQUIRED_ERROR_INSTANCE,\n OAuth2AccessDeniedError,\n OAuth2AuthenticationContextClass,\n OAuth2AuthorizationPrompt,\n OAuth2AuthorizationResponseType,\n OAuth2GrantError,\n OAuth2LoginRequiredError,\n OAuth2MfaRequiredError,\n OAuth2RequestError,\n OAuth2ResponseTypeError,\n} from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeIssuer } from './code/index.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport { toIdentityPolicyData } from '../../identity/permission/identity-policy-data.ts';\nimport type {\n OAuth2AuthorizationManagerContext,\n OAuth2AuthorizationOptions,\n OAuth2AuthorizationResult,\n} from './types.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IEventService, IUserAuthenticatorChallengeProvider } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\n\nconst DEFAULT_PROMPT_LOGIN_MAX_AGE = 60;\n\n// Deliberately 60 (not 0, deviating from the plan-050 sketch): the hosted\n// challenge round-trip (stamp mfa_at → retry POST /authorize) takes seconds,\n// so a 0-window step-up could never be satisfied and would loop the ladder.\nconst DEFAULT_MFA_FRESHNESS_MAX_AGE = 60;\n\nexport class OAuth2Authorization {\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected sessionManager : ISessionManager;\n\n protected eventService? : IEventService;\n\n protected metrics? : IAuthFlowMetrics;\n\n protected promptLoginMaxAge : number;\n\n protected mfaFreshnessMaxAge : number;\n\n protected mfaChallengeProvider? : IUserAuthenticatorChallengeProvider;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n constructor(ctx: OAuth2AuthorizationManagerContext) {\n this.codeIssuer = ctx.codeIssuer;\n this.sessionManager = ctx.sessionManager;\n this.eventService = ctx.eventService;\n this.metrics = ctx.metrics;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n this.promptLoginMaxAge = ctx.promptLoginMaxAge ?? DEFAULT_PROMPT_LOGIN_MAX_AGE;\n this.mfaFreshnessMaxAge = ctx.mfaFreshnessMaxAge ?? DEFAULT_MFA_FRESHNESS_MAX_AGE;\n this.mfaChallengeProvider = ctx.mfaChallengeProvider;\n }\n\n /\n Authorize with validated codeRequest.\n \n @param data\n * @param identity\n * @param options\n */\n async authorize(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n try {\n const result = await this.authorizeInner(data, identity, options);\n\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n sessionId: options.sessionId ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: {\n reason: options.client?.builtIn ? 'autoConsent' : 'consent',\n ...(data.scope ? { scope: data.scope } : {}),\n },\n });\n this.metrics?.recordAuthorize('issued');\n\n return result;\n } catch (e) {\n if (hasInstanceof(e, OAUTH2_ACCESS_DENIED_ERROR_INSTANCE)) {\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE_FAILED,\n refType: EventRefType.CLIENT,\n refId: options.client?.id ?? data.client_id ?? null,\n clientId: options.client?.id ?? data.client_id ?? null,\n sessionId: options.sessionId ?? null,\n actorType: identity.type,\n actorId: identity.data.id,\n actorName: identity.data.name,\n realmId: data.realm_id ?? null,\n data: { reason: 'accessPolicy' },\n });\n this.metrics?.recordAuthorize('denied');\n } else if (hasInstanceof(e, OAUTH2_LOGIN_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('login_required');\n } else if (hasInstanceof(e, OAUTH2_MFA_REQUIRED_ERROR_INSTANCE)) {\n this.metrics?.recordAuthorize('mfa_required');\n } else {\n this.metrics?.recordAuthorize('error');\n }\n\n throw e;\n }\n }\n\n protected async authorizeInner(\n data: OAuth2AuthorizationCodeRequest,\n identity: Identity,\n options: OAuth2AuthorizationOptions = {},\n ) : Promise<OAuth2AuthorizationResult> {\n // OAuth 2.1 posture: only the authorization-code response type is\n // supported — implicit/hybrid (token, id_token, none) were dropped\n // (plan 042 item 3). Defense in depth behind the request validator.\n let responseTypes : string[] = [];\n if (data.response_type) {\n responseTypes = Array.isArray(data.response_type) ?\n data.response_type :\n data.response_type.split(' ');\n }\n\n for (const responseType of responseTypes) {\n if (responseType !== OAuth2AuthorizationResponseType.CODE) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n }\n\n if (!responseTypes.includes(OAuth2AuthorizationResponseType.CODE)) {\n throw OAuth2ResponseTypeError.unsupported();\n }\n\n if (!data.redirect_uri) {\n throw OAuth2GrantError.redirectUriMismatch();\n }\n\n const output : OAuth2AuthorizationResult = {\n redirectUri: data.redirect_uri,\n ...(data.state ? { state: data.state } : {}),\n };\n\n if (!identity) {\n throw OAuth2RequestError.identityInvalid();\n }\n\n // Realm binding: the code-request verifier stamped data.realm_id with the\n // resolved client's realm. The authenticated identity must belong to that\n // same realm — otherwise a lingering session for realm A could silently\n // mint a code/token for realm B's client (confused deputy). The error body\n // deliberately carries no identity data (no realm-enumeration oracle).\n // The comparison reads the scalar realmId column, NOT the realm\n // relation — the relation may simply not be loaded on the resolved\n // identity. An identity without a realmId fails closed the same way —\n // clean login_required, never a TypeError.\n if (\n data.realm_id &&\n identity.data.realmId !== data.realm_id\n ) {\n throw OAuth2LoginRequiredError.realmMismatch();\n }\n\n // Authentication time = the backing session's creation instant (NOT\n // refreshed_at — a token refresh must not reset it). Session-less flows\n // (e.g. HTTP Basic authorize) present live credentials on this request,\n // so the authentication time is \"now\".\n const nowSeconds = Math.floor(Date.now() / 1000);\n let authTime = nowSeconds;\n let session : Session \| null = null;\n if (options.sessionId) {\n session = await this.sessionManager.findOneById(options.sessionId);\n if (session && session.createdAt) {\n authTime = Math.floor(new Date(session.createdAt).getTime() / 1000);\n }\n }\n\n // MFA backstop (plan 049) — the authoritative server-side gate; the\n // hosted UI's challenge step is convenience. The proof is session-bound\n // (mfa_at — stamped by the challenge endpoint or the password grant's\n // otp param), so a session-less flow (HTTP Basic) cannot carry one and\n // fails closed while the user holds a confirmed device. A user without\n // a device under mfaRequired is routed to inline enrollment.\n if (this.mfaChallengeProvider && identity.type === IdentityType.USER) {\n // requirement flags only — the interactive challenge material (the\n // webauthn nonce) is issued by the status endpoint, not this backstop.\n const challenge = await this.mfaChallengeProvider.challenge(\n identity.data.id,\n { issueMaterial: false },\n );\n // The local second factor belongs to a local credential. A\n // session established by an external identity provider was\n // authenticated THERE, which is where MFA is configured and\n // enforced for it, so authup does not stack a factor of its own\n // on top and `mfaRequired` does not force local enrollment on\n // those users. The route is opt-in either way: an external\n // identity reaches an existing account only through the\n // bearer-authenticated link flow, since a first login provisions\n // a NEW user (plan 091). A session-less authorize (HTTP Basic) is\n // not external and keeps the gate.\n const externallyAuthenticated = session?.authMethod === SessionAuthMethod.EXTERNAL;\n\n if (!externallyAuthenticated) {\n if (challenge.required && !session?.mfaAt) {\n throw OAuth2MfaRequiredError.challengeRequired();\n }\n\n if (challenge.enrollmentRequired) {\n throw OAuth2MfaRequiredError.enrollmentRequired();\n }\n }\n\n // Step-up (plan 050 stage 3): a requested `acr_values` containing\n // urn:authup:mfa is a TRIGGER (Auth0/Keycloak stance) — the proof\n // must additionally be FRESH (mfaFreshnessMaxAge window, mirroring\n // promptLoginMaxAge's absorb-the-round-trip semantics). Enforced\n // only while the user actually holds a factor — per OIDC Core\n // §5.5.1.1 acr is voluntary, so an unsatisfiable request degrades\n // to the achieved acr instead of bricking the RP.\n //\n // This one DOES apply to an externally authenticated session: the\n // application asked for MFA explicitly, and a local factor the\n // user holds is the only way authup can answer that. Trusting the\n // upstream is the default, not a refusal to prove anything.\n if (challenge.required && data.acr_values) {\n const acrValues = data.acr_values.split(' ');\n if (acrValues.includes(OAuth2AuthenticationContextClass.MFA)) {\n const mfaAtSeconds = session?.mfaAt ?\n Math.floor(new Date(session.mfaAt).getTime() / 1000) :\n null;\n if (mfaAtSeconds === null \|\| nowSeconds - mfaAtSeconds > this.mfaFreshnessMaxAge) {\n throw OAuth2MfaRequiredError.stepUpRequired();\n }\n }\n }\n }\n\n // OIDC §3.1.2.1 prompt=login / max_age freshness (enforced only when\n // requested — a plain authorize never throws here). The hosted page\n // renders the login form for prompt=login; this is the server backstop.\n const prompts = data.prompt ? data.prompt.split(' ') : [];\n if (\n prompts.includes(OAuth2AuthorizationPrompt.LOGIN) &&\n nowSeconds - authTime > this.promptLoginMaxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n\n if (\n typeof data.max_age !== 'undefined' &&\n data.max_age !== null\n ) {\n const maxAge = Number(data.max_age);\n if (\n Number.isFinite(maxAge) &&\n nowSeconds - authTime > maxAge\n ) {\n throw OAuth2LoginRequiredError.reauthenticationRequired();\n }\n }\n\n // Application access policy (plan 052) — the last gate before\n // issuance: a denial is only revealed to a fully-authenticated\n // (incl. second-factor) identity. A client carrying a policy id with\n // no wired evaluator denies too (never silently allow a configured\n // gate). The redirect target rides the error only when the\n // redirect_uri was pattern-verified (RFC 6749 §4.1.2.1).\n if (options.client?.accessPolicyId) {\n let allowed = false;\n\n const subject = toIdentityPolicyData(identity);\n if (subject && this.accessPolicyEvaluator) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n options.client.accessPolicyId,\n subject,\n );\n }\n\n if (!allowed) {\n throw OAuth2AccessDeniedError.forClient(\n options.redirectUriVerified && data.redirect_uri ?\n { redirectUri: data.redirect_uri, state: data.state ?? null } :\n undefined,\n );\n }\n }\n\n // The id_token is NOT minted here — the /token exchange mints it after\n // resolving the real backing session, so its `sid` is authoritative\n // (plan 042 item 6). The code carries the authentication instant.\n const codeEntity : OAuth2AuthorizationCode = await this.codeIssuer.issue(\n data,\n identity,\n {\n sessionId: options.sessionId,\n authTime,\n authMethod: session?.authMethod ?? null,\n },\n );\n\n output.authorizationCode = codeEntity.id;\n\n return output;\n }\n}\n"],"mappings":";;;;;;;;AA+CA,MAAMmB,+BAA+B;AAKrC,MAAMC,gCAAgC;AAEtC,IAAaC,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKR,aAAaQ,IAAIR;EACtB,KAAKC,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,UAAUK,IAAIL;EACnB,KAAKI,wBAAwBC,IAAID;EACjC,KAAKH,oBAAoBI,IAAIJ,qBAAqBP;EAClD,KAAKQ,qBAAqBG,IAAIH,sBAAsBP;EACpD,KAAKQ,uBAAuBE,IAAIF;CACpC;;;;;;;IASA,MAAMG,UACFC,MACAC,UACAC,UAAsC,CAAC,GACJ;EACnC,IAAI;GACA,MAAMC,SAAS,MAAM,KAAKC,eAAeJ,MAAMC,UAAUC,OAAAA;GAEzD,MAAM,KAAKV,cAAca,OAAO;IAC5BC,OAAOpC,WAAWqC;IAClBC,MAAMxC,UAAUyC;IAChBC,SAASzC,aAAa0C;IACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;IAClDE,WAAWf,QAAQe,aAAa;IAChCC,WAAWjB,SAASkB;IACpBC,SAASnB,SAASD,KAAKc;IACvBO,WAAWpB,SAASD,KAAKQ;IACzBc,SAAStB,KAAKuB,YAAY;IAC1BvB,MAAM;KACFwB,QAAQtB,QAAQW,QAAQY,UAAU,gBAAgB;KAClD,GAAIzB,KAAKM,QAAQ,EAAEA,OAAON,KAAKM,MAAM,IAAI,CAAC;IAC9C;GACJ,CAAA;GACA,KAAKb,SAASiC,gBAAgB,QAAA;GAE9B,OAAOvB;EACX,SAASwB,GAAG;GACR,IAAItD,cAAcsD,GAAGrD,mCAAAA,GAAsC;IACvD,MAAM,KAAKkB,cAAca,OAAO;KAC5BC,OAAOpC,WAAWqC;KAClBC,MAAMxC,UAAU4D;KAChBlB,SAASzC,aAAa0C;KACtBC,OAAOV,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAC/CC,UAAUd,QAAQW,QAAQC,MAAMd,KAAKe,aAAa;KAClDE,WAAWf,QAAQe,aAAa;KAChCC,WAAWjB,SAASkB;KACpBC,SAASnB,SAASD,KAAKc;KACvBO,WAAWpB,SAASD,KAAKQ;KACzBc,SAAStB,KAAKuB,YAAY;KAC1BvB,MAAM,EAAEwB,QAAQ,eAAe;IACnC,CAAA;IACA,KAAK/B,SAASiC,gBAAgB,QAAA;GAClC,OAAO,IAAIrD,cAAcsD,GAAGpD,oCAAAA,GACxB,KAAKkB,SAASiC,gBAAgB,gBAAA;QAC3B,IAAIrD,cAAcsD,GAAGnD,kCAAAA,GACxB,KAAKiB,SAASiC,gBAAgB,cAAA;QAE9B,KAAKjC,SAASiC,gBAAgB,OAAA;GAGlC,MAAMC;EACV;CACJ;CAEA,MAAgBvB,eACZJ,MACAC,UACAC,UAAsC,CAAC,GACJ;EAInC,IAAI2B,gBAA2B,CAAA;EAC/B,IAAI7B,KAAK8B,eACLD,gBAAgBE,MAAMC,QAAQhC,KAAK8B,aAAa,IAC5C9B,KAAK8B,gBACL9B,KAAK8B,cAAcG,MAAM,GAAA;EAGjC,KAAK,MAAMC,gBAAgBL,eACvB,IAAIK,iBAAiBtD,gCAAgCuD,MACjD,MAAMlD,wBAAwBmD,YAAW;EAIjD,IAAI,CAACP,cAAcQ,SAASzD,gCAAgCuD,IAAI,GAC5D,MAAMlD,wBAAwBmD,YAAW;EAG7C,IAAI,CAACpC,KAAKsC,cACN,MAAMzD,iBAAiB0D,oBAAmB;EAG9C,MAAMC,SAAqC;GACvCC,aAAazC,KAAKsC;GAClB,GAAItC,KAAK0C,QAAQ,EAAEA,OAAO1C,KAAK0C,MAAM,IAAI,CAAC;EAC9C;EAEA,IAAI,CAACzC,UACD,MAAMjB,mBAAmB2D,gBAAe;EAY5C,IACI3C,KAAKuB,YACLtB,SAASD,KAAKsB,YAAYtB,KAAKuB,UAE/B,MAAMzC,yBAAyB8D,cAAa;EAOhD,MAAMC,aAAaC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;EAC3C,IAAIC,WAAWL;EACf,IAAIM,UAA2B;EAC/B,IAAIjD,QAAQe,WAAW;GACnBkC,UAAU,MAAM,KAAK5D,eAAe6D,YAAYlD,QAAQe,SAAS;GACjE,IAAIkC,WAAWA,QAAQE,WACnBH,WAAWJ,KAAKC,MAAM,IAAIC,KAAKG,QAAQE,SAAS,CAAA,CAAEC,QAAO,IAAK,GAAA;EAEtE;EAQA,IAAI,KAAK1D,wBAAwBK,SAASkB,SAAShD,aAAaoF,MAAM;GAGlE,MAAMC,YAAY,MAAM,KAAK5D,qBAAqB4D,UAC9CvD,SAASD,KAAKc,IACd,EAAE2C,eAAe,MAAM,CAAA;GAc3B,IAAI,EAF4BN,SAASQ,eAAevF,kBAAkBwF,WAE5C;IAC1B,IAAIJ,UAAUK,YAAY,CAACV,SAASW,OAChC,MAAM/E,uBAAuBgF,kBAAiB;IAGlD,IAAIP,UAAUQ,oBACV,MAAMjF,uBAAuBiF,mBAAkB;GAEvD;GAcA,IAAIR,UAAUK,YAAY7D,KAAKiE,YACTjE;QAAAA,KAAKiE,WAAWhC,MAAM,GACpCiC,CAAAA,CAAU7B,SAAS3D,iCAAiCyF,GAAG,GAAG;KAC1D,MAAMC,eAAejB,SAASW,QAC1BhB,KAAKC,MAAM,IAAIC,KAAKG,QAAQW,KAAK,CAAA,CAAER,QAAO,IAAK,GAAA,IAC/C;KACJ,IAAIc,iBAAiB,QAAQvB,aAAauB,eAAe,KAAKzE,oBAC1D,MAAMZ,uBAAuBsF,eAAc;IAEnD;;EAER;EAMA,KADgBrE,KAAKuE,SAASvE,KAAKuE,OAAOtC,MAAM,GAAA,IAAO,CAAA,EAAA,CAE3CI,SAAS1D,0BAA0B6F,KAAK,KAChD3B,aAAaK,WAAW,KAAKxD,mBAE7B,MAAMZ,yBAAyB2F,yBAAwB;EAG3D,IACI,OAAOzE,KAAK0E,YAAY,eACxB1E,KAAK0E,YAAY,MACnB;GACE,MAAMC,SAASC,OAAO5E,KAAK0E,OAAO;GAClC,IACIE,OAAOC,SAASF,MAAAA,KAChB9B,aAAaK,WAAWyB,QAExB,MAAM7F,yBAAyB2F,yBAAwB;EAE/D;EAQA,IAAIvE,QAAQW,QAAQiE,gBAAgB;GAChC,IAAIC,UAAU;GAEd,MAAMC,UAAU9F,qBAAqBe,QAAAA;GACrC,IAAI+E,WAAW,KAAKnF,uBAChBkF,UAAU,MAAM,KAAKlF,sBAAsBoF,SACvC/E,QAAQW,OAAOiE,gBACfE,OAAAA;GAIR,IAAI,CAACD,SACD,MAAMtG,wBAAwByG,UAC1BhF,QAAQiF,uBAAuBnF,KAAKsC,eAChC;IAAEG,aAAazC,KAAKsC;IAAcI,OAAO1C,KAAK0C,SAAS;GAAK,IAC5D0C,KAAAA,CAAAA;EAGhB;EAeA5C,OAAO+C,qBAAoBF,MAVwB,KAAK/F,WAAWgG,MAC/DtF,MACAC,UACA;GACIgB,WAAWf,QAAQe;GACnBiC;GACAS,YAAYR,SAASQ,cAAc;EACvC,CAAA,EAAA,CAGkC7C;EAEtC,OAAO0B;CACX;AACJ"}

package/dist/core/oauth2/backchannel-logout/constants.d.ts ADDED Viewed

@@ -0,0 +1,16 @@
+/**
+ * The `events` member a logout token MUST carry
+ * (OIDC Back-Channel Logout 1.0, section 2.4).
+ */
+export declare const OAUTH2_BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+/**
+ * Logout token lifetime in seconds. The token is consumed by the RP the
+ * moment it arrives, so the lifetime only bounds a replay of a captured one.
+ */
+export declare const OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE = 120;
+/**
+ * Per-delivery timeout in milliseconds. The revoke awaits every delivery, so
+ * an unreachable RP must not hold the caller's request open for long.
+ */
+export declare const OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT = 5000;
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/oauth2/backchannel-logout/constants.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/backchannel-logout/constants.ts"],"names":[],"mappings":"AAOA;;;GAGG;AACH,eAAO,MAAM,+BAA+B,uDAAuD,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,iCAAiC,OAAQ,CAAC"}

package/dist/core/oauth2/backchannel-logout/constants.mjs ADDED Viewed

@@ -0,0 +1,20 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/oauth2/backchannel-logout/constants.ts
+/**
+* The `events` member a logout token MUST carry
+* (OIDC Back-Channel Logout 1.0, section 2.4).
+*/ const OAUTH2_BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+/**
+* Logout token lifetime in seconds. The token is consumed by the RP the
+* moment it arrives, so the lifetime only bounds a replay of a captured one.
+*/ const OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE = 120;
+/**
+* Per-delivery timeout in milliseconds. The revoke awaits every delivery, so
+* an unreachable RP must not hold the caller's request open for long.
+*/ const OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT = 5e3;
+//#endregion
+export { OAUTH2_BACKCHANNEL_LOGOUT_EVENT, OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE, OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT };
+//# sourceMappingURL=constants.mjs.map

package/dist/core/oauth2/backchannel-logout/constants.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"constants.mjs","names":["OAUTH2_BACKCHANNEL_LOGOUT_EVENT","OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE","OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT"],"sources":["../../../../src/core/oauth2/backchannel-logout/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * The `events` member a logout token MUST carry\n * (OIDC Back-Channel Logout 1.0, section 2.4).\n */\nexport const OAUTH2_BACKCHANNEL_LOGOUT_EVENT = 'http://schemas.openid.net/event/backchannel-logout';\n\n/**\n * Logout token lifetime in seconds. The token is consumed by the RP the\n * moment it arrives, so the lifetime only bounds a replay of a captured one.\n */\nexport const OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE = 120;\n\n/**\n * Per-delivery timeout in milliseconds. The revoke awaits every delivery, so\n * an unreachable RP must not hold the caller's request open for long.\n */\nexport const OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT = 5_000;\n"],"mappings":";;;;;;;GAWA,MAAaA,kCAAkC;;;;GAM/C,MAAaC,oCAAoC;;;;GAMjD,MAAaC,oCAAoC"}

package/dist/core/oauth2/backchannel-logout/index.d.ts ADDED Viewed

@@ -0,0 +1,4 @@
+export * from './constants.ts';
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/backchannel-logout/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/backchannel-logout/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/backchannel-logout/index.mjs ADDED Viewed

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAUTH2_BACKCHANNEL_LOGOUT_EVENT, OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE, OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT } from "./constants.mjs";
+import { OAuth2BackchannelLogoutNotifier } from "./module.mjs";
+export { OAUTH2_BACKCHANNEL_LOGOUT_EVENT, OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE, OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT, OAuth2BackchannelLogoutNotifier };

package/dist/core/oauth2/backchannel-logout/module.d.ts ADDED Viewed

@@ -0,0 +1,26 @@
+import type { Client, Session } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { ISessionRevokeNotifier } from '../../authentication/session/types.ts';
+import type { IOAuth2ClientRepository } from '../client/types.ts';
+import type { ISessionTokenRepository } from '../session-token/types.ts';
+import type { IOAuth2TokenSigner } from '../token/signer/types.ts';
+import type { OAuth2BackchannelLogoutNotifierContext, OAuth2BackchannelLogoutNotifierOptions } from './types.ts';
+export declare class OAuth2BackchannelLogoutNotifier implements ISessionRevokeNotifier {
+    protected signer: IOAuth2TokenSigner;
+    protected sessionTokenRepository: ISessionTokenRepository;
+    protected clientRepository: IOAuth2ClientRepository;
+    protected options: OAuth2BackchannelLogoutNotifierOptions;
+    protected logger?: Logger;
+    constructor(ctx: OAuth2BackchannelLogoutNotifierContext);
+    resolve(session: Session): Promise<Client[]>;
+    notify(session: Session, clients: Client[]): Promise<void>;
+    protected deliver(session: Session, client: Client): Promise<void>;
+    protected buildPayload(session: Session, client: Client): OAuth2TokenPayload;
+    /**
+     * The same shape `OAuth2BaseTokenIssuer.buildIss` produces for the
+     * id_token, so an RP comparing against its discovered issuer matches.
+     */
+    protected buildIss(client: Client): string;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/backchannel-logout/module.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/backchannel-logout/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGxD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAMnE,OAAO,KAAK,EACR,sCAAsC,EACtC,sCAAsC,EACzC,MAAM,YAAY,CAAC;AAEpB,qBAAa,+BAAgC,YAAW,sBAAsB;IAC1E,SAAS,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAErC,SAAS,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IAE1D,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,OAAO,EAAE,sCAAsC,CAAC;IAE1D,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,sCAAsC;IAQjD,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAqB5C,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;cAIhD,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BxE,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB;IAsB5E;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAK7C"}

package/dist/core/oauth2/backchannel-logout/module.mjs ADDED Viewed

@@ -0,0 +1,78 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAUTH2_BACKCHANNEL_LOGOUT_EVENT } from "./constants.mjs";
+import { describeError } from "../../../utils/error.mjs";
+import "../../../utils/index.mjs";
+import { OAuth2TokenKind } from "@authup/specs";
+import { randomUUID } from "node:crypto";
+//#region src/core/oauth2/backchannel-logout/module.ts
+var OAuth2BackchannelLogoutNotifier = class {
+	signer;
+	sessionTokenRepository;
+	clientRepository;
+	options;
+	logger;
+	constructor(ctx) {
+		this.signer = ctx.signer;
+		this.sessionTokenRepository = ctx.sessionTokenRepository;
+		this.clientRepository = ctx.clientRepository;
+		this.options = ctx.options;
+		this.logger = ctx.logger;
+	}
+	async resolve(session) {
+		const tokens = await this.sessionTokenRepository.findBySessionId(session.id);
+		const clientIds = /* @__PURE__ */ new Set();
+		for (const token of tokens) if (token.clientId) clientIds.add(token.clientId);
+		const clients = [];
+		for (const clientId of clientIds) {
+			const client = await this.clientRepository.findOneByIdOrName(clientId);
+			if (client && client.backchannelLogoutUri) clients.push(client);
+		}
+		return clients;
+	}
+	async notify(session, clients) {
+		await Promise.allSettled(clients.map((client) => this.deliver(session, client)));
+	}
+	async deliver(session, client) {
+		if (!client.backchannelLogoutUri) return;
+		try {
+			const logoutToken = await this.signer.sign(this.buildPayload(session, client));
+			const response = await fetch(client.backchannelLogoutUri, {
+				method: "POST",
+				headers: { "content-type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({ logout_token: logoutToken }),
+				signal: AbortSignal.timeout(this.options.timeout ?? 5e3),
+				redirect: "manual"
+			});
+			await response.body?.cancel();
+			if (!response.ok) this.logger?.warn(`The back-channel logout of client ${client.id} was refused with status ${response.status}.`);
+		} catch (e) {
+			this.logger?.warn(describeError(e, `The back-channel logout of client ${client.id} failed.`));
+		}
+	}
+	buildPayload(session, client) {
+		const utc = Math.floor(Date.now() / 1e3);
+		return {
+			kind: OAuth2TokenKind.LOGOUT,
+			jti: randomUUID(),
+			iss: this.buildIss(client),
+			aud: client.id,
+			sub: session.sub,
+			sid: session.id,
+			exp: utc + (this.options.maxAge ?? 120),
+			realm_id: client.realmId,
+			events: { [OAUTH2_BACKCHANNEL_LOGOUT_EVENT]: {} }
+		};
+	}
+	/**
+	* The same shape `OAuth2BaseTokenIssuer.buildIss` produces for the
+	* id_token, so an RP comparing against its discovered issuer matches.
+	*/ buildIss(client) {
+		return `${this.options.issuer.replace(/\/+$/, "")}/realms/${client.realm.name}`;
+	}
+};
+//#endregion
+export { OAuth2BackchannelLogoutNotifier };
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/backchannel-logout/module.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.mjs","names":["randomUUID","OAuth2TokenKind","describeError","OAUTH2_BACKCHANNEL_LOGOUT_EVENT","OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE","OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT","OAuth2BackchannelLogoutNotifier","signer","sessionTokenRepository","clientRepository","options","logger","ctx","resolve","session","tokens","findBySessionId","id","clientIds","Set","token","clientId","add","clients","client","findOneByIdOrName","backchannelLogoutUri","push","notify","Promise","allSettled","map","deliver","logoutToken","sign","buildPayload","response","fetch","method","headers","body","URLSearchParams","logout_token","signal","AbortSignal","timeout","redirect","cancel","ok","warn","status","e","utc","Math","floor","Date","now","kind","LOGOUT","jti","iss","buildIss","aud","sub","sid","exp","maxAge","realm_id","realmId","events","base","issuer","replace","realm","name"],"sources":["../../../../src/core/oauth2/backchannel-logout/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport type { Client, Session } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport { describeError } from '../../../utils/index.ts';\nimport type { ISessionRevokeNotifier } from '../../authentication/session/types.ts';\nimport type { IOAuth2ClientRepository } from '../client/types.ts';\nimport type { ISessionTokenRepository } from '../session-token/types.ts';\nimport type { IOAuth2TokenSigner } from '../token/signer/types.ts';\nimport {\n OAUTH2_BACKCHANNEL_LOGOUT_EVENT,\n OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE,\n OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT,\n} from './constants.ts';\nimport type {\n OAuth2BackchannelLogoutNotifierContext,\n OAuth2BackchannelLogoutNotifierOptions,\n} from './types.ts';\n\nexport class OAuth2BackchannelLogoutNotifier implements ISessionRevokeNotifier {\n protected signer: IOAuth2TokenSigner;\n\n protected sessionTokenRepository: ISessionTokenRepository;\n\n protected clientRepository: IOAuth2ClientRepository;\n\n protected options: OAuth2BackchannelLogoutNotifierOptions;\n\n protected logger?: Logger;\n\n constructor(ctx: OAuth2BackchannelLogoutNotifierContext) {\n this.signer = ctx.signer;\n this.sessionTokenRepository = ctx.sessionTokenRepository;\n this.clientRepository = ctx.clientRepository;\n this.options = ctx.options;\n this.logger = ctx.logger;\n }\n\n async resolve(session: Session): Promise<Client[]> {\n const tokens = await this.sessionTokenRepository.findBySessionId(session.id);\n\n const clientIds = new Set<string>();\n for (const token of tokens) {\n if (token.clientId) {\n clientIds.add(token.clientId);\n }\n }\n\n const clients : Client[] = [];\n for (const clientId of clientIds) {\n const client = await this.clientRepository.findOneByIdOrName(clientId);\n if (client && client.backchannelLogoutUri) {\n clients.push(client);\n }\n }\n\n return clients;\n }\n\n async notify(session: Session, clients: Client[]): Promise<void> {\n await Promise.allSettled(clients.map((client) => this.deliver(session, client)));\n }\n\n protected async deliver(session: Session, client: Client): Promise<void> {\n if (!client.backchannelLogoutUri) {\n return;\n }\n\n try {\n const logoutToken = await this.signer.sign(this.buildPayload(session, client));\n\n // `redirect: 'manual'`: a 3xx is the RP's refusal, not an\n // invitation to POST the token somewhere else.\n const response = await fetch(client.backchannelLogoutUri, {\n method: 'POST',\n headers: { 'content-type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams({ logout_token: logoutToken }),\n signal: AbortSignal.timeout(this.options.timeout ?? OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT),\n redirect: 'manual',\n });\n\n // The body is never read, and an unread body pins the keep-alive socket.\n await response.body?.cancel();\n\n if (!response.ok) {\n this.logger?.warn(\n `The back-channel logout of client ${client.id} was refused with status ${response.status}.`,\n );\n }\n } catch (e) {\n this.logger?.warn(describeError(e, `The back-channel logout of client ${client.id} failed.`));\n }\n }\n\n protected buildPayload(session: Session, client: Client): OAuth2TokenPayload {\n const utc = Math.floor(Date.now() / 1000);\n\n return {\n kind: OAuth2TokenKind.LOGOUT,\n jti: randomUUID(),\n iss: this.buildIss(client),\n aud: client.id,\n sub: session.sub,\n sid: session.id,\n exp: utc + (this.options.maxAge ?? OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE),\n // The signer keys on the realm, so the claim rides along (the\n // specification permits additional claims). It is the CLIENT's\n // realm: `iss` is built from `client.realm.name`, so the signing\n // key has to come from the same realm or an RP resolving `kid`\n // through the issuer's JWKS finds nothing. The two differ on the\n // cross-realm password grant (a UUID user with the master client).\n realm_id: client.realmId,\n events: { [OAUTH2_BACKCHANNEL_LOGOUT_EVENT]: {} },\n };\n }\n\n /**\n * The same shape `OAuth2BaseTokenIssuer.buildIss` produces for the\n * id_token, so an RP comparing against its discovered issuer matches.\n */\n protected buildIss(client: Client): string {\n const base = this.options.issuer.replace(/\\/+$/, '');\n\n return `${base}/realms/${client.realm.name}`;\n }\n}\n"],"mappings":";;;;;;;;;AA2BA,IAAaM,kCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA6C;EACrD,KAAKL,SAASK,IAAIL;EAClB,KAAKC,yBAAyBI,IAAIJ;EAClC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,UAAUE,IAAIF;EACnB,KAAKC,SAASC,IAAID;CACtB;CAEA,MAAME,QAAQC,SAAqC;EAC/C,MAAMC,SAAS,MAAM,KAAKP,uBAAuBQ,gBAAgBF,QAAQG,EAAE;EAE3E,MAAMC,4BAAY,IAAIC,IAAAA;EACtB,KAAK,MAAMC,SAASL,QAChB,IAAIK,MAAMC,UACNH,UAAUI,IAAIF,MAAMC,QAAQ;EAIpC,MAAME,UAAqB,CAAA;EAC3B,KAAK,MAAMF,YAAYH,WAAW;GAC9B,MAAMM,SAAS,MAAM,KAAKf,iBAAiBgB,kBAAkBJ,QAAAA;GAC7D,IAAIG,UAAUA,OAAOE,sBACjBH,QAAQI,KAAKH,MAAAA;EAErB;EAEA,OAAOD;CACX;CAEA,MAAMK,OAAOd,SAAkBS,SAAkC;EAC7D,MAAMM,QAAQC,WAAWP,QAAQQ,KAAKP,WAAW,KAAKQ,QAAQlB,SAASU,MAAAA,CAAAA,CAAAA;CAC3E;CAEA,MAAgBQ,QAAQlB,SAAkBU,QAA+B;EACrE,IAAI,CAACA,OAAOE,sBACR;EAGJ,IAAI;GACA,MAAMO,cAAc,MAAM,KAAK1B,OAAO2B,KAAK,KAAKC,aAAarB,SAASU,MAAAA,CAAAA;GAItE,MAAMY,WAAW,MAAMC,MAAMb,OAAOE,sBAAsB;IACtDY,QAAQ;IACRC,SAAS,EAAE,gBAAgB,oCAAoC;IAC/DC,MAAM,IAAIC,gBAAgB,EAAEC,cAAcT,YAAY,CAAA;IACtDU,QAAQC,YAAYC,QAAQ,KAAKnC,QAAQmC,WAAAA,GAAWxC;IACpDyC,UAAU;GACd,CAAA;GAGA,MAAMV,SAASI,MAAMO,OAAAA;GAErB,IAAI,CAACX,SAASY,IACV,KAAKrC,QAAQsC,KACT,qCAAqCzB,OAAOP,GAAG,2BAA2BmB,SAASc,OAAO,EAAE;EAGxG,SAASC,GAAG;GACR,KAAKxC,QAAQsC,KAAK/C,cAAciD,GAAG,qCAAqC3B,OAAOP,GAAG,SAAS,CAAA;EAC/F;CACJ;CAEUkB,aAAarB,SAAkBU,QAAoC;EACzE,MAAM4B,MAAMC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;EAEpC,OAAO;GACHC,MAAMxD,gBAAgByD;GACtBC,KAAK3D,WAAAA;GACL4D,KAAK,KAAKC,SAASrC,MAAAA;GACnBsC,KAAKtC,OAAOP;GACZ8C,KAAKjD,QAAQiD;GACbC,KAAKlD,QAAQG;GACbgD,KAAKb,OAAO,KAAK1C,QAAQwD,UAAAA;GAOzBC,UAAU3C,OAAO4C;GACjBC,QAAQ,GAAGlE,kCAAkC,CAAC,EAAE;EACpD;CACJ;;;;IAMA,SAAmBqB,QAAwB;EAGvC,OAAO,GAFM,KAAKd,QAAQ6D,OAAOC,QAAQ,QAAQ,EAEvCF,EAAK,UAAU9C,OAAOiD,MAAMC;CAC1C;AACJ"}

package/dist/core/oauth2/backchannel-logout/types.d.ts ADDED Viewed

@@ -0,0 +1,29 @@
+import type { Logger } from '@authup/server-kit';
+import type { IOAuth2ClientRepository } from '../client/types.ts';
+import type { ISessionTokenRepository } from '../session-token/types.ts';
+import type { IOAuth2TokenSigner } from '../token/signer/types.ts';
+export type OAuth2BackchannelLogoutNotifierOptions = {
+    /**
+     * The issuer base (publicUrl). The logout token's `iss` is derived from
+     * it the way every other token's is: `<issuer>/realms/<realm name>`.
+     */
+    issuer: string;
+    /**
+     * Logout token lifetime in seconds
+     * (default: OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE).
+     */
+    maxAge?: number;
+    /**
+     * Per-delivery timeout in milliseconds
+     * (default: OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT).
+     */
+    timeout?: number;
+};
+export type OAuth2BackchannelLogoutNotifierContext = {
+    signer: IOAuth2TokenSigner;
+    sessionTokenRepository: ISessionTokenRepository;
+    clientRepository: IOAuth2ClientRepository;
+    options: OAuth2BackchannelLogoutNotifierOptions;
+    logger?: Logger;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/backchannel-logout/types.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/backchannel-logout/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,MAAM,sCAAsC,GAAG;IACjD;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG;IACjD,MAAM,EAAE,kBAAkB,CAAC;IAC3B,sBAAsB,EAAE,uBAAuB,CAAC;IAChD,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,OAAO,EAAE,sCAAsC,CAAC;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/core/oauth2/console-login/constants.d.ts ADDED Viewed

@@ -0,0 +1,19 @@
+/**
+ * Lifetime of a pending console login (plan 088).
+ *
+ * It covers one redirect to `/authorize` and the return leg, which may
+ * traverse an external identity provider, so it is sized like the federated
+ * login's pending entry rather than like a session.
+ */
+export declare const CONSOLE_LOGIN_TTL: number;
+/**
+ * The cookie carrying the pending login between the server-side kick and the
+ * server-side callback that redeems the code.
+ *
+ * `SameSite=Lax` (the federated-login precedent): the return leg is a
+ * top-level navigation that may come back through an external provider, which
+ * a `Strict` cookie would not accompany. It holds nothing but the id of a
+ * single-use cache entry.
+ */
+export declare const CONSOLE_LOGIN_COOKIE = "authup_console_login";
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/oauth2/console-login/constants.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/console-login/constants.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAgB,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,yBAAyB,CAAC"}

package/dist/core/oauth2/console-login/constants.mjs ADDED Viewed

@@ -0,0 +1,24 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/oauth2/console-login/constants.ts
+/**
+* Lifetime of a pending console login (plan 088).
+*
+* It covers one redirect to `/authorize` and the return leg, which may
+* traverse an external identity provider, so it is sized like the federated
+* login's pending entry rather than like a session.
+*/ const CONSOLE_LOGIN_TTL = 3e5;
+/**
+* The cookie carrying the pending login between the server-side kick and the
+* server-side callback that redeems the code.
+*
+* `SameSite=Lax` (the federated-login precedent): the return leg is a
+* top-level navigation that may come back through an external provider, which
+* a `Strict` cookie would not accompany. It holds nothing but the id of a
+* single-use cache entry.
+*/ const CONSOLE_LOGIN_COOKIE = "authup_console_login";
+//#endregion
+export { CONSOLE_LOGIN_COOKIE, CONSOLE_LOGIN_TTL };
+//# sourceMappingURL=constants.mjs.map

package/dist/core/oauth2/console-login/constants.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"constants.mjs","names":["CONSOLE_LOGIN_TTL","CONSOLE_LOGIN_COOKIE"],"sources":["../../../../src/core/oauth2/console-login/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Lifetime of a pending console login (plan 088).\n *\n * It covers one redirect to `/authorize` and the return leg, which may\n * traverse an external identity provider, so it is sized like the federated\n * login's pending entry rather than like a session.\n */\nexport const CONSOLE_LOGIN_TTL = 1000 * 60 * 5;\n\n/**\n * The cookie carrying the pending login between the server-side kick and the\n * server-side callback that redeems the code.\n *\n * `SameSite=Lax` (the federated-login precedent): the return leg is a\n * top-level navigation that may come back through an external provider, which\n * a `Strict` cookie would not accompany. It holds nothing but the id of a\n * single-use cache entry.\n */\nexport const CONSOLE_LOGIN_COOKIE = 'authup_console_login';\n"],"mappings":";;;;;;;;;;GAcA,MAAaA,oBAAoB;;;;;;;;;GAWjC,MAAaC,uBAAuB"}

package/dist/core/oauth2/console-login/index.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+export * from './constants.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map