@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/adapters/http/controllers/workflows/admin/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["CLIENT_ADMIN_CONSOLE_NAME","NotFoundError","DContext","DController","DGet","ADMIN_CONSOLE_SEGMENT","ConsoleLogin","AdminController","options","consoleLogin","ctx","clientName","segment","consoleUrl","refusalPath","baseURL","loginStore","sessionRepository","sessionManager","tokenVerifier","tokenRevoker","logger","login","event","assertEnabled","callback","enabled"],"sources":["../../../../../../src/adapters/http/controllers/workflows/admin/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_ADMIN_CONSOLE_NAME } from '@authup/core-kit';\nimport { NotFoundError } from '@ebec/http';\nimport {\n    DContext,\n    DController,\n    DGet,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { ADMIN_CONSOLE_SEGMENT } from '../../../constants.ts';\nimport { ConsoleLogin } from '../console-login/index.ts';\nimport type { AdminControllerContext, AdminControllerOptions } from './types.ts';\n\n/**\n * The admin console's server half (plan 088): the login kick and the code\n * redemption, bound to the per-realm `admin-console` client.\n *\n * The console itself is served by `@authup/server-admin-console`. See\n * {@link AccountController} for why these two routes stay on the API.\n */\n@DController(`/${ADMIN_CONSOLE_SEGMENT}`)\nexport class AdminController {\n    protected options: AdminControllerOptions;\n\n    protected consoleLogin: ConsoleLogin;\n\n    constructor(ctx: AdminControllerContext) {\n        this.options = ctx.options;\n        this.consoleLogin = new ConsoleLogin(\n            {\n                clientName: CLIENT_ADMIN_CONSOLE_NAME,\n                segment: ADMIN_CONSOLE_SEGMENT,\n                consoleUrl: ctx.options.consoleUrl,\n                // The page that renders the error marker: the console root is\n                // a logged-in page, whose guard would bounce to /login and\n                // drop the query.\n                refusalPath: 'login',\n            },\n            {\n                options: { baseURL: ctx.options.baseURL },\n                loginStore: ctx.loginStore,\n                sessionRepository: ctx.sessionRepository,\n                sessionManager: ctx.sessionManager,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRevoker: ctx.tokenRevoker,\n                logger: ctx.logger,\n            },\n        );\n    }\n\n    /**\n     * A path of its own rather than a `realmId`-carrying `/login` (098 C1).\n     * One URL used to mean two things: with a realm the server-side kick,\n     * without one the console's own login PAGE. The page is served by the\n     * console service now, so the kick can no longer fall back to it and the\n     * split became required rather than optional.\n     */\n    @DGet('/login/start', [])\n    async login(@DContext() event: IAppEvent): Promise<Response> {\n        this.assertEnabled();\n\n        return this.consoleLogin.login(event);\n    }\n\n    @DGet('/callback', [])\n    async callback(@DContext() event: IAppEvent): Promise<Response> {\n        this.assertEnabled();\n\n        return this.consoleLogin.callback(event);\n    }\n\n    /**\n     * Disabled means disabled on the server too: the kick must not mint a\n     * pending login and a session for a console nothing is serving.\n     */\n    protected assertEnabled(): void {\n        if (!this.options.enabled) {\n            throw new NotFoundError();\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA2BA,IAAaO,kBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,eAAe,IAAIH,aACpB;GACIK,YAAYX;GACZY,SAASP;GACTQ,YAAYH,IAAIF,QAAQK;GAIxBC,aAAa;EACjB,GACA;GACIN,SAAS,EAAEO,SAASL,IAAIF,QAAQO,QAAQ;GACxCC,YAAYN,IAAIM;GAChBC,mBAAmBP,IAAIO;GACvBC,gBAAgBR,IAAIQ;GACpBC,eAAeT,IAAIS;GACnBC,cAAcV,IAAIU;GAClBC,QAAQX,IAAIW;EAChB,CAAA;CAER;;;;;;;IASA,MACMC,MAAM,OAAiD;EACzD,KAAKE,cAAa;EAElB,OAAO,KAAKf,aAAaa,MAAMC,KAAAA;CACnC;CAEA,MACME,SAAS,OAAiD;EAC5D,KAAKD,cAAa;EAElB,OAAO,KAAKf,aAAagB,SAASF,KAAAA;CACtC;;;;IAMA,gBAAgC;EAC5B,IAAI,CAAC,KAAKf,QAAQkB,SACd,MAAM,IAAIzB,cAAAA;CAElB;AACJ;;;;;;;;;;;;;;;;CA5Dc,YAAA,IAAGI,uBAAAA"}

package/dist/adapters/http/controllers/workflows/admin/types.d.ts

@@ -0,0 +1,14 @@
+import type { ConsoleLoginContext } from '../console-login/index.ts';
+export type AdminControllerOptions = {
+    baseURL: string;
+    /**
+     * Where the console this authenticates for is served. The browser lands
+     * there once the credential is issued, and a refusal renders there.
+     */
+    consoleUrl: string;
+    enabled: boolean;
+};
+export type AdminControllerContext = Omit<ConsoleLoginContext, 'options'> & {
+    options: AdminControllerOptions;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/workflows/admin/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/admin/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,GAAG;IACxE,OAAO,EAAE,sBAAsB,CAAC;CACnC,CAAC"}

package/dist/adapters/http/controllers/workflows/auth-console.d.ts

@@ -0,0 +1,16 @@
+import type { IAppEvent } from 'routup';
+/**
+ * Hand a hosted page over to the auth console service (plan 101 D2).
+ *
+ * server-core keeps the protocol: the endpoints, the issuer, every POST
+ * that mints or ends something. What moves is where the page RENDERS, so
+ * these GETs become a stateless hop, with the request's own parameters
+ * re-carried, and nothing decided here.
+ *
+ * Stateless is the point. There is no server-side handle for the pending
+ * request: the request is the application's own public URL, a cookie
+ * handle would clobber across tabs, and a TTL would break the mail-borne
+ * `redirect=` chain that arrives days later.
+ */
+export declare function redirectToAuthConsole(event: IAppEvent, authConsoleUrl: string, page: string, params?: Record<string, any>): Response;
+//# sourceMappingURL=auth-console.d.ts.map

package/dist/adapters/http/controllers/workflows/auth-console.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-console.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/auth-console.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACjC,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,QAAQ,CAkBX"}

package/dist/adapters/http/controllers/workflows/auth-console.mjs

@@ -0,0 +1,32 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { sendRedirect } from "routup";
+import { useRequestQuery } from "@routup/basic/query";
+//#region src/adapters/http/controllers/workflows/auth-console.ts
+/**
+* Hand a hosted page over to the auth console service (plan 101 D2).
+*
+* server-core keeps the protocol: the endpoints, the issuer, every POST
+* that mints or ends something. What moves is where the page RENDERS, so
+* these GETs become a stateless hop, with the request's own parameters
+* re-carried, and nothing decided here.
+*
+* Stateless is the point. There is no server-side handle for the pending
+* request: the request is the application's own public URL, a cookie
+* handle would clobber across tabs, and a TTL would break the mail-borne
+* `redirect=` chain that arrives days later.
+*/ function redirectToAuthConsole(event, authConsoleUrl, page, params) {
+	const target = new URL(`${authConsoleUrl.replace(/\/+$/, "")}${page}`);
+	const source = params ?? useRequestQuery(event);
+	for (const [key, value] of Object.entries(source)) {
+		const values = Array.isArray(value) ? value : [value];
+		for (const item of values) if (typeof item !== "undefined" && item !== null) target.searchParams.append(key, `${item}`);
+	}
+	event.response.headers.set("cache-control", "no-store");
+	return sendRedirect(event, target.href);
+}
+//#endregion
+export { redirectToAuthConsole };
+
+//# sourceMappingURL=auth-console.mjs.map

package/dist/adapters/http/controllers/workflows/auth-console.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-console.mjs","names":["useRequestQuery","sendRedirect","redirectToAuthConsole","event","authConsoleUrl","page","params","target","URL","replace","source","key","value","Object","entries","values","Array","isArray","item","searchParams","append","response","headers","set","href"],"sources":["../../../../../src/adapters/http/controllers/workflows/auth-console.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\n\n/**\n * Hand a hosted page over to the auth console service (plan 101 D2).\n *\n * server-core keeps the protocol: the endpoints, the issuer, every POST\n * that mints or ends something. What moves is where the page RENDERS, so\n * these GETs become a stateless hop, with the request's own parameters\n * re-carried, and nothing decided here.\n *\n * Stateless is the point. There is no server-side handle for the pending\n * request: the request is the application's own public URL, a cookie\n * handle would clobber across tabs, and a TTL would break the mail-borne\n * `redirect=` chain that arrives days later.\n */\nexport function redirectToAuthConsole(\n    event: IAppEvent,\n    authConsoleUrl: string,\n    page: string,\n    params?: Record<string, any>,\n) : Response {\n    const target = new URL(`${authConsoleUrl.replace(/\\/+$/, '')}${page}`);\n\n    const source = params ?? useRequestQuery(event);\n    for (const [key, value] of Object.entries(source)) {\n        const values = Array.isArray(value) ? value : [value];\n        for (const item of values) {\n            if (typeof item !== 'undefined' && item !== null) {\n                target.searchParams.append(key, `${item}`);\n            }\n        }\n    }\n\n    // The hop reflects the request's own parameters, which routinely carry\n    // an id_token_hint, a token or a redirect. Never let one be cached.\n    event.response.headers.set('cache-control', 'no-store');\n\n    return sendRedirect(event, target.href);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;GAwBA,SAAgBE,sBACZC,OACAC,gBACAC,MACAC,QAA4B;CAE5B,MAAMC,SAAS,IAAIC,IAAI,GAAGJ,eAAeK,QAAQ,QAAQ,EAAA,IAAMJ,MAAM;CAErE,MAAMK,SAASJ,UAAUN,gBAAgBG,KAAAA;CACzC,KAAK,MAAM,CAACQ,KAAKC,UAAUC,OAAOC,QAAQJ,MAAAA,GAAS;EAC/C,MAAMK,SAASC,MAAMC,QAAQL,KAAAA,IAASA,QAAQ,CAACA,KAAM;EACrD,KAAK,MAAMM,QAAQH,QACf,IAAI,OAAOG,SAAS,eAAeA,SAAS,MACxCX,OAAOY,aAAaC,OAAOT,KAAK,GAAGO,MAAM;CAGrD;CAIAf,MAAMkB,SAASC,QAAQC,IAAI,iBAAiB,UAAA;CAE5C,OAAOtB,aAAaE,OAAOI,OAAOiB,IAAI;AAC1C"}

package/dist/adapters/http/controllers/workflows/authorize/module.d.ts

@@ -1,4 +1,5 @@
 import type { IAppEvent } from 'routup';
+import type { AuthorizeInfo } from '@authup/core-http-kit';
 import { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';
 import type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';
 import { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';
@@ -12,6 +13,20 @@ export declare class AuthorizeController {
     confirm(event: IAppEvent): Promise<{
         url: string;
     }>;
-    serve(event: IAppEvent): Promise<string>;
+    /**
+     * The page's render input as JSON, for a renderer that is not this
+     * process (plan 101 D2). Anonymous like the page GET, and answering
+     * the same query: a refused request is a 200 carrying the refusal,
+     * never an error status, so the caller renders what the page renders.
+     */
+    info(event: IAppEvent): Promise<AuthorizeInfo>;
+    /**
+     * The page renders in the auth console service, which reads its
+     * whole input back from `/info` above. server-core keeps the
+     * protocol: this GET is a stateless hop, and the POST that issues
+     * the code stays here.
+     */
+    serve(event: IAppEvent): Promise<Response>;
+    protected buildAuthorizeInfo(event: IAppEvent): Promise<AuthorizeInfo>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/authorize/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAgBxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAMzF,qBACa,mBAAmB;IAI5B,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC;gBAI/B,GAAG,EAAE,0BAA0B;IAyBrC,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAmC/D,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CAmH7D"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAOxC,OAAO,KAAK,EACR,aAAa,EAIhB,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAGzF,qBACa,mBAAmB;IAI5B,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC;gBAI/B,GAAG,EAAE,0BAA0B;IAyBrC,OAAO,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAkCrE;;;;;OAKG;IAEG,IAAI,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC;IAQhE;;;;;OAKG;IAEG,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;cAM5C,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC;CAoH/E"}

package/dist/adapters/http/controllers/workflows/authorize/module.mjs

@@ -7,12 +7,11 @@ import "../../../../../utils/index.mjs";
 import "../../../../../core/index.mjs";
 import { readFromLocations } from "../../../request/helpers/locations.mjs";
 import "../../../request/index.mjs";
-import { ForceUserLoggedInMiddleware } from "../../../middleware/built-in/loggedin/user.mjs";
-import { renderAuthConsolePage } from "../../../ui/auth-console/module.mjs";
-import "../../../middleware/index.mjs";
-import "../../../ui/index.mjs";
 import { HTTPOAuth2Authorizer } from "../../../adapters/oauth2/authorization/module.mjs";
 import "../../../adapters/index.mjs";
+import { ForceUserLoggedInMiddleware } from "../../../middleware/built-in/loggedin/user.mjs";
+import "../../../middleware/index.mjs";
+import { redirectToAuthConsole } from "../auth-console.mjs";
 import { isUUID } from "@authup/kit";
 import { OAuth2AccessDeniedError, OAuth2ErrorCode, OAuth2LoginRequiredError, isOAuth2AccessDeniedError } from "@authup/specs";
 import { URL } from "node:url";
@@ -73,7 +72,24 @@ var AuthorizeController = class {
 			throw e;
 		}
 	}
-	async serve(event) {
+	/**
+	* The page's render input as JSON, for a renderer that is not this
+	* process (plan 101 D2). Anonymous like the page GET, and answering
+	* the same query: a refused request is a 200 carrying the refusal,
+	* never an error status, so the caller renders what the page renders.
+	*/ async info(event) {
+		event.response.headers.set("cache-control", "no-store");
+		return this.buildAuthorizeInfo(event);
+	}
+	/**
+	* The page renders in the auth console service, which reads its
+	* whole input back from `/info` above. server-core keeps the
+	* protocol: this GET is a stateless hop, and the POST that issues
+	* the code stays here.
+	*/ async serve(event) {
+		return redirectToAuthConsole(event, this.options.authConsoleUrl, "/authorize");
+	}
+	async buildAuthorizeInfo(event) {
 		let codeRequest;
 		let client;
 		let scopes;
@@ -123,23 +139,18 @@ var AuthorizeController = class {
 		const federatedLogin = typeof query.provider === "string" && isUUID(query.provider) ? { providerId: query.provider } : void 0;
 		const requestURL = new URL(event.request.url);
 		requestURL.searchParams.delete("provider");
-		return renderAuthConsolePage(event, {
-			url: "/authorize",
-			payload: {
-				config: { baseURL: this.options.baseURL },
-				data: {
-					codeRequest,
-					error,
-					client,
-					scopes,
-					realm,
-					redirectUriVerified,
-					federatedLogin,
-					features: this.options.features,
-					requestPath: `${requestURL.pathname}${requestURL.search}`
-				}
-			}
-		});
+		requestURL.pathname = "/authorize";
+		return {
+			codeRequest,
+			error,
+			client,
+			scopes,
+			realm,
+			redirectUriVerified,
+			federatedLogin,
+			features: this.options.features,
+			requestPath: `${requestURL.pathname}${requestURL.search}`
+		};
 	}
 };
 _ts_decorate([
@@ -149,6 +160,13 @@ _ts_decorate([
 	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
 	_ts_metadata("design:returntype", Promise)
 ], AuthorizeController.prototype, "confirm", null);
+_ts_decorate([
+	DGet("/info", []),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AuthorizeController.prototype, "info", null);
 _ts_decorate([
 	DGet("", []),
 	_ts_param(0, DContext()),

package/dist/adapters/http/controllers/workflows/authorize/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","isUUID","useRequestQuery","OAuth2AccessDeniedError","OAuth2ErrorCode","OAuth2LoginRequiredError","isOAuth2AccessDeniedError","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderAuthConsolePage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","consentService","logger","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","e","ACCESS_DENIED","serve","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","displayName","builtIn","createdAt","normalized","message","query","mapped","forClient","LOGIN_REQUIRED","providerUnavailable","federatedLogin","provider","providerId","undefined","requestURL","request","delete","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport { isUUID } from '@authup/kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    Client,\n    OAuth2AuthorizationCodeRequest,\n    Realm,\n    Scope,\n} from '@authup/core-kit';\nimport {\n    OAuth2AccessDeniedError,\n    OAuth2ErrorCode,\n    OAuth2LoginRequiredError,\n    isOAuth2AccessDeniedError,\n} from '@authup/specs';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderAuthConsolePage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\ntype RealmSummary = Pick<Realm, 'id' | 'name' | 'displayName'>;\ntype ClientSummary = Pick<Client, 'id' | 'name' | 'displayName' | 'builtIn' | 'createdAt'>;\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            codeIssuer: ctx.codeIssuer,\n            sessionManager: ctx.sessionManager,\n            eventService: ctx.eventService,\n            metrics: ctx.metrics,\n            promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n            mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,\n            mfaChallengeProvider: ctx.mfaChallengeProvider,\n            accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n            consentService: ctx.consentService,\n            logger: ctx.logger,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        try {\n            const result = await this.authorizer.authorizeWithRequest(event);\n\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            if (result.authorizationCode) {\n                url.searchParams.set('code', result.authorizationCode);\n            }\n\n            return { url: url.href };\n        } catch (e) {\n            // Access-policy denial (plan 052): with a pattern-verified\n            // redirect_uri the denial is answered as an error redirect\n            // (RFC 6749 §4.1.2.1) — the kit navigates the returned url like\n            // any success. Unverified → rethrow → 400 body → interactive\n            // denial card.\n            if (isOAuth2AccessDeniedError(e) && e.redirectUri) {\n                const url = new URL(e.redirectUri);\n                url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n                if (e.state) {\n                    url.searchParams.set('state', e.state);\n                }\n\n                return { url: url.href };\n            }\n\n            throw e;\n        }\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : ClientSummary | undefined;\n        let scopes : Scope[] | undefined;\n\n        // Target realm summary (the client's realm) — the UI names it in the\n        // realm-mismatch notice. codeRequest.realm_id is only the id.\n        let realm : RealmSummary | undefined;\n\n        // Whether the request redirect_uri matched a registered client pattern —\n        // the UI must not offer an automatic \"return to application\" redirect to\n        // an unverified (pattern-less-client) redirect_uri.\n        let redirectUriVerified = false;\n\n        let error : Error | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n\n            // Trim the client to a deliberate DTO before it reaches the\n            // anonymous SSR hydration payload — never disclose redirect_uri\n            // patterns (the trusted-origin set), grant_types, internal\n            // base/root URLs, auth methods, or the secret storage flags to an\n            // unauthenticated visitor. (ClientEntity.secret is additionally\n            // select:false, so the secret is never loaded — but the DTO must not\n            // rely on that alone: a future entity/query change could unset it.)\n            client = {\n                id: result.client.id,\n                name: result.client.name,\n                displayName: result.client.displayName,\n                builtIn: result.client.builtIn,\n                createdAt: result.client.createdAt,\n            };\n            scopes = result.scopes;\n            redirectUriVerified = result.redirectUriVerified;\n\n            if (result.client.realm) {\n                realm = {\n                    id: result.client.realm.id,\n                    name: result.client.realm.name,\n                    displayName: result.client.realm.displayName,\n                };\n            }\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // A recognized `error` query param (the federated-IdP callback\n        // redirects back here with one when it refuses a completion) is\n        // mapped onto the hydration payload's error. The set stays closed and\n        // the text is server-side and neutral, never attacker-controlled;\n        // any other value is ignored.\n        if (!error) {\n            const query = useRequestQuery(event);\n            let mapped : Error | undefined;\n            if (query.error === OAuth2ErrorCode.ACCESS_DENIED) {\n                mapped = OAuth2AccessDeniedError.forClient();\n            } else if (query.error === OAuth2ErrorCode.LOGIN_REQUIRED) {\n                mapped = OAuth2LoginRequiredError.providerUnavailable();\n            }\n\n            if (mapped) {\n                const normalized = sanitizeError(mapped);\n                error = {\n                    ...normalized,\n                    message: normalized.message,\n                };\n            }\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        // A federated callback sends the browser back here to complete the\n        // login it established (plan 094). Only the provider is named: the\n        // pending login itself rides a cookie, so nothing here is a secret.\n        // It is interpolated into the completion request path by the page, so\n        // it is accepted as an id and nothing else, and dropped from\n        // `requestPath` so the register / password links do not carry it.\n        const query = useRequestQuery(event);\n        const federatedLogin = typeof query.provider === 'string' && isUUID(query.provider) ?\n            { providerId: query.provider } :\n            undefined;\n\n        const requestURL = new URL(event.request.url);\n        requestURL.searchParams.delete('provider');\n\n        return renderAuthConsolePage(event, {\n            url: '/authorize',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    codeRequest,\n                    error,\n                    client,\n                    scopes,\n                    realm,\n                    redirectUriVerified,\n                    federatedLogin,\n                    features: this.options.features,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,IAAaiB,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,cAAcH,IAAIG;GAClBC,SAASJ,IAAII;GACbC,mBAAmBL,IAAIJ,QAAQS;GAC/BC,oBAAoBN,IAAIJ,QAAQU;GAChCC,sBAAsBP,IAAIO;GAC1BC,uBAAuBR,IAAIQ;GAC3BC,gBAAgBT,IAAIS;GACpBC,QAAQV,IAAIU;EAChB,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,IAAI;GACA,MAAME,SAAS,MAAM,KAAKd,WAAWe,qBAAqBF,KAAAA;GAE1D,MAAMG,MAAM,IAAIjC,IAAI+B,OAAOG,WAAW;GACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;GAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;GAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;EAC3B,SAASC,GAAG;GAMR,IAAIlC,0BAA0BkC,CAAAA,KAAMA,EAAEN,aAAa;IAC/C,MAAMD,MAAM,IAAIjC,IAAIwC,EAAEN,WAAW;IACjCD,IAAIG,aAAaC,IAAI,SAASjC,gBAAgBqC,aAAa;IAC3D,IAAID,EAAEL,OACFF,IAAIG,aAAaC,IAAI,SAASG,EAAEL,KAAK;IAGzC,OAAO,EAAEF,KAAKA,IAAIM,KAAK;GAC3B;GAEA,MAAMC;EACV;CACJ;CAEA,MACME,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAE1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAMvC,kBAAkBoB,OAAO,CAAC,QAAQ,OAAQ,CAAA;GAC/D,MAAMoB,OAAO,MAAM,KAAKlC,qBAAqBmC,IAAIF,MAAAA;GAEjD,MAAMlB,SAAS,MAAM,KAAKhB,oBAAoBqC,OAAOF,IAAAA;GASrDN,SAAS;IACLS,IAAItB,OAAOa,OAAOS;IAClBC,MAAMvB,OAAOa,OAAOU;IACpBC,aAAaxB,OAAOa,OAAOW;IAC3BC,SAASzB,OAAOa,OAAOY;IACvBC,WAAW1B,OAAOa,OAAOa;GAC7B;GACAZ,SAASd,OAAOc;GAChBE,sBAAsBhB,OAAOgB;GAE7B,IAAIhB,OAAOa,OAAOE,OACdA,QAAQ;IACJO,IAAItB,OAAOa,OAAOE,MAAMO;IACxBC,MAAMvB,OAAOa,OAAOE,MAAMQ;IAC1BC,aAAaxB,OAAOa,OAAOE,MAAMS;GACrC;GAGJZ,cAAcZ,OAAOmB;EACzB,SAASV,GAAG;GACR,MAAMkB,aAAa9C,cAAc4B,CAAAA;GACjCQ,QAAQ;IACJ,GAAGU;IACHC,SAASD,WAAWC;GACxB;EACJ;EAOA,IAAI,CAACX,OAAO;GACR,MAAMY,QAAQ1D,gBAAgB4B,KAAAA;GAC9B,IAAI+B;GACJ,IAAID,MAAMZ,UAAU5C,gBAAgBqC,eAChCoB,SAAS1D,wBAAwB2D,UAAS;QACvC,IAAIF,MAAMZ,UAAU5C,gBAAgB2D,gBACvCF,SAASxD,yBAAyB2D,oBAAmB;GAGzD,IAAIH,QAAQ;IACR,MAAMH,aAAa9C,cAAciD,MAAAA;IACjCb,QAAQ;KACJ,GAAGU;KACHC,SAASD,WAAWC;IACxB;GACJ;EACJ;EAWA,MAAMC,QAAQ1D,gBAAgB4B,KAAAA;EAC9B,MAAMmC,iBAAiB,OAAOL,MAAMM,aAAa,YAAYjE,OAAO2D,MAAMM,QAAQ,IAC9E,EAAEC,YAAYP,MAAMM,SAAS,IAC7BE,KAAAA;EAEJ,MAAMC,aAAa,IAAIrE,IAAI8B,MAAMwC,QAAQrC,GAAG;EAC5CoC,WAAWjC,aAAamC,OAAO,UAAA;EAE/B,OAAO9D,sBAAsBqB,OAAO;GAChCG,KAAK;GACLuC,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK5D,QAAQ4D,QAAQ;IACxCxB,MAAM;KACFP;KACAK;KACAJ;KACAC;KACAC;KACAC;KACAkB;KACAU,UAAU,KAAK7D,QAAQ6D;KACvBC,aAAa,GAAGP,WAAWQ,WAAWR,WAAWS;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;CAvJgBvE,MAAAA,IAAAA,CAAAA,2BAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","isUUID","useRequestQuery","OAuth2AccessDeniedError","OAuth2ErrorCode","OAuth2LoginRequiredError","isOAuth2AccessDeniedError","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","redirectToAuthConsole","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","consentService","logger","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","e","ACCESS_DENIED","info","response","headers","buildAuthorizeInfo","serve","authConsoleUrl","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","displayName","builtIn","createdAt","normalized","message","query","mapped","forClient","LOGIN_REQUIRED","providerUnavailable","federatedLogin","provider","providerId","undefined","requestURL","request","delete","pathname","features","requestPath","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport { isUUID } from '@authup/kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    OAuth2AuthorizationCodeRequest,\n    Scope,\n} from '@authup/core-kit';\nimport type {\n    AuthorizeInfo,\n    AuthorizeInfoError,\n    ClientSummary,\n    RealmSummary,\n} from '@authup/core-http-kit';\nimport {\n    OAuth2AccessDeniedError,\n    OAuth2ErrorCode,\n    OAuth2LoginRequiredError,\n    isOAuth2AccessDeniedError,\n} from '@authup/specs';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { redirectToAuthConsole } from '../auth-console.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            codeIssuer: ctx.codeIssuer,\n            sessionManager: ctx.sessionManager,\n            eventService: ctx.eventService,\n            metrics: ctx.metrics,\n            promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n            mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,\n            mfaChallengeProvider: ctx.mfaChallengeProvider,\n            accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n            consentService: ctx.consentService,\n            logger: ctx.logger,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        try {\n            const result = await this.authorizer.authorizeWithRequest(event);\n\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            if (result.authorizationCode) {\n                url.searchParams.set('code', result.authorizationCode);\n            }\n\n            return { url: url.href };\n        } catch (e) {\n            // Access-policy denial (plan 052): with a pattern-verified\n            // redirect_uri the denial is answered as an error redirect\n            // (RFC 6749 §4.1.2.1) — the kit navigates the returned url like\n            // any success. Unverified → rethrow → 400 body → interactive\n            // denial card.\n            if (isOAuth2AccessDeniedError(e) && e.redirectUri) {\n                const url = new URL(e.redirectUri);\n                url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n                if (e.state) {\n                    url.searchParams.set('state', e.state);\n                }\n\n                return { url: url.href };\n            }\n\n            throw e;\n        }\n    }\n\n    /**\n     * The page's render input as JSON, for a renderer that is not this\n     * process (plan 101 D2). Anonymous like the page GET, and answering\n     * the same query: a refused request is a 200 carrying the refusal,\n     * never an error status, so the caller renders what the page renders.\n     */\n    @DGet('/info', [])\n    async info(@DContext() event: IAppEvent): Promise<AuthorizeInfo> {\n        // The page inherits this from applyUIPageHeaders. A login context\n        // is per-request and must never be served from a cache.\n        event.response.headers.set('cache-control', 'no-store');\n\n        return this.buildAuthorizeInfo(event);\n    }\n\n    /**\n     * The page renders in the auth console service, which reads its\n     * whole input back from `/info` above. server-core keeps the\n     * protocol: this GET is a stateless hop, and the POST that issues\n     * the code stays here.\n     */\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<Response> {\n        return redirectToAuthConsole(event, this.options.authConsoleUrl, '/authorize');\n    }\n\n    // ---------------------------------------------------------\n\n    protected async buildAuthorizeInfo(event: IAppEvent): Promise<AuthorizeInfo> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : ClientSummary | undefined;\n        let scopes : Scope[] | undefined;\n\n        // Target realm summary (the client's realm) — the UI names it in the\n        // realm-mismatch notice. codeRequest.realm_id is only the id.\n        let realm : RealmSummary | undefined;\n\n        // Whether the request redirect_uri matched a registered client pattern —\n        // the UI must not offer an automatic \"return to application\" redirect to\n        // an unverified (pattern-less-client) redirect_uri.\n        let redirectUriVerified = false;\n\n        // A plain object, not an Error: it is spread onto the wire, where\n        // only data survives.\n        let error : AuthorizeInfoError | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n\n            // Trim the client to a deliberate DTO before it reaches the\n            // anonymous SSR hydration payload — never disclose redirect_uri\n            // patterns (the trusted-origin set), grant_types, the home URL,\n            // the back-channel logout endpoint, auth methods, or the secret\n            // storage flags to an unauthenticated visitor. (ClientEntity.secret\n            // is additionally\n            // select:false, so the secret is never loaded — but the DTO must not\n            // rely on that alone: a future entity/query change could unset it.)\n            client = {\n                id: result.client.id,\n                name: result.client.name,\n                displayName: result.client.displayName,\n                builtIn: result.client.builtIn,\n                createdAt: result.client.createdAt,\n            };\n            scopes = result.scopes;\n            redirectUriVerified = result.redirectUriVerified;\n\n            if (result.client.realm) {\n                realm = {\n                    id: result.client.realm.id,\n                    name: result.client.realm.name,\n                    displayName: result.client.realm.displayName,\n                };\n            }\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // A recognized `error` query param (the federated-IdP callback\n        // redirects back here with one when it refuses a completion) is\n        // mapped onto the hydration payload's error. The set stays closed and\n        // the text is server-side and neutral, never attacker-controlled;\n        // any other value is ignored.\n        if (!error) {\n            const query = useRequestQuery(event);\n            let mapped : Error | undefined;\n            if (query.error === OAuth2ErrorCode.ACCESS_DENIED) {\n                mapped = OAuth2AccessDeniedError.forClient();\n            } else if (query.error === OAuth2ErrorCode.LOGIN_REQUIRED) {\n                mapped = OAuth2LoginRequiredError.providerUnavailable();\n            }\n\n            if (mapped) {\n                const normalized = sanitizeError(mapped);\n                error = {\n                    ...normalized,\n                    message: normalized.message,\n                };\n            }\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        // A federated callback sends the browser back here to complete the\n        // login it established (plan 094). Only the provider is named: the\n        // pending login itself rides a cookie, so nothing here is a secret.\n        // It is interpolated into the completion request path by the page, so\n        // it is accepted as an id and nothing else, and dropped from\n        // `requestPath` so the register / password links do not carry it.\n        const query = useRequestQuery(event);\n        const federatedLogin = typeof query.provider === 'string' && isUUID(query.provider) ?\n            { providerId: query.provider } :\n            undefined;\n\n        const requestURL = new URL(event.request.url);\n        requestURL.searchParams.delete('provider');\n        // Anchored on the page, never on the route that was called:\n        // `GET /authorize/info` answers the context of the same authorize\n        // request, and the value is rendered as a link back to the page.\n        requestURL.pathname = '/authorize';\n\n        return {\n            codeRequest,\n            error,\n            client,\n            scopes,\n            realm,\n            redirectUriVerified,\n            federatedLogin,\n            features: this.options.features,\n            requestPath: `${requestURL.pathname}${requestURL.search}`,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,IAAaiB,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,cAAcH,IAAIG;GAClBC,SAASJ,IAAII;GACbC,mBAAmBL,IAAIJ,QAAQS;GAC/BC,oBAAoBN,IAAIJ,QAAQU;GAChCC,sBAAsBP,IAAIO;GAC1BC,uBAAuBR,IAAIQ;GAC3BC,gBAAgBT,IAAIS;GACpBC,QAAQV,IAAIU;EAChB,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,IAAI;GACA,MAAME,SAAS,MAAM,KAAKd,WAAWe,qBAAqBF,KAAAA;GAE1D,MAAMG,MAAM,IAAIjC,IAAI+B,OAAOG,WAAW;GACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;GAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;GAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;EAC3B,SAASC,GAAG;GAMR,IAAIlC,0BAA0BkC,CAAAA,KAAMA,EAAEN,aAAa;IAC/C,MAAMD,MAAM,IAAIjC,IAAIwC,EAAEN,WAAW;IACjCD,IAAIG,aAAaC,IAAI,SAASjC,gBAAgBqC,aAAa;IAC3D,IAAID,EAAEL,OACFF,IAAIG,aAAaC,IAAI,SAASG,EAAEL,KAAK;IAGzC,OAAO,EAAEF,KAAKA,IAAIM,KAAK;GAC3B;GAEA,MAAMC;EACV;CACJ;;;;;;IAQA,MACME,KAAK,OAAsD;EAG7DZ,MAAMa,SAASC,QAAQP,IAAI,iBAAiB,UAAA;EAE5C,OAAO,KAAKQ,mBAAmBf,KAAAA;CACnC;;;;;;IAQA,MACMgB,MAAM,OAAiD;EACzD,OAAOrC,sBAAsBqB,OAAO,KAAKhB,QAAQiC,gBAAgB,YAAA;CACrE;CAIA,MAAgBF,mBAAmBf,OAA0C;EACzE,IAAIkB;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAI1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAM5C,kBAAkBoB,OAAO,CAAC,QAAQ,OAAQ,CAAA;GAC/D,MAAMyB,OAAO,MAAM,KAAKvC,qBAAqBwC,IAAIF,MAAAA;GAEjD,MAAMvB,SAAS,MAAM,KAAKhB,oBAAoB0C,OAAOF,IAAAA;GAUrDN,SAAS;IACLS,IAAI3B,OAAOkB,OAAOS;IAClBC,MAAM5B,OAAOkB,OAAOU;IACpBC,aAAa7B,OAAOkB,OAAOW;IAC3BC,SAAS9B,OAAOkB,OAAOY;IACvBC,WAAW/B,OAAOkB,OAAOa;GAC7B;GACAZ,SAASnB,OAAOmB;GAChBE,sBAAsBrB,OAAOqB;GAE7B,IAAIrB,OAAOkB,OAAOE,OACdA,QAAQ;IACJO,IAAI3B,OAAOkB,OAAOE,MAAMO;IACxBC,MAAM5B,OAAOkB,OAAOE,MAAMQ;IAC1BC,aAAa7B,OAAOkB,OAAOE,MAAMS;GACrC;GAGJZ,cAAcjB,OAAOwB;EACzB,SAASf,GAAG;GACR,MAAMuB,aAAanD,cAAc4B,CAAAA;GACjCa,QAAQ;IACJ,GAAGU;IACHC,SAASD,WAAWC;GACxB;EACJ;EAOA,IAAI,CAACX,OAAO;GACR,MAAMY,QAAQ/D,gBAAgB4B,KAAAA;GAC9B,IAAIoC;GACJ,IAAID,MAAMZ,UAAUjD,gBAAgBqC,eAChCyB,SAAS/D,wBAAwBgE,UAAS;QACvC,IAAIF,MAAMZ,UAAUjD,gBAAgBgE,gBACvCF,SAAS7D,yBAAyBgE,oBAAmB;GAGzD,IAAIH,QAAQ;IACR,MAAMH,aAAanD,cAAcsD,MAAAA;IACjCb,QAAQ;KACJ,GAAGU;KACHC,SAASD,WAAWC;IACxB;GACJ;EACJ;EAWA,MAAMC,QAAQ/D,gBAAgB4B,KAAAA;EAC9B,MAAMwC,iBAAiB,OAAOL,MAAMM,aAAa,YAAYtE,OAAOgE,MAAMM,QAAQ,IAC9E,EAAEC,YAAYP,MAAMM,SAAS,IAC7BE,KAAAA;EAEJ,MAAMC,aAAa,IAAI1E,IAAI8B,MAAM6C,QAAQ1C,GAAG;EAC5CyC,WAAWtC,aAAawC,OAAO,UAAA;EAI/BF,WAAWG,WAAW;EAEtB,OAAO;GACH7B;GACAK;GACAJ;GACAC;GACAC;GACAC;GACAkB;GACAQ,UAAU,KAAKhE,QAAQgE;GACvBC,aAAa,GAAGL,WAAWG,WAAWH,WAAWM;EACrD;CACJ;AACJ;;CAnLgBzE,MAAAA,IAAAA,CAAAA,2BAAAA,CAAAA"}

package/dist/adapters/http/controllers/workflows/authorize/types.d.ts

@@ -3,6 +3,11 @@ import type { Logger } from '@authup/server-kit';
 import type { IAuthFlowMetrics, IConsentService, IEventService, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, ISessionManager, IUserAuthenticatorChallengeProvider } from '../../../../../core/index.ts';
 export type AuthorizeControllerOptions = {
     baseURL: string;
+    /**
+     * Where the auth console service renders the page this controller
+     * hands over to (plan 101 D2).
+     */
+    authConsoleUrl: string;
     features: StatusResponseFeatures;
     /**
      * Max age (seconds) a `prompt=login` request accepts before forcing re-auth

package/dist/adapters/http/controllers/workflows/authorize/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,eAAe,EACf,mCAAmC,EACtC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IAEpC,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAE7D,cAAc,EAAE,eAAe,CAAC;IAEhC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAE3B,oBAAoB,CAAC,EAAE,mCAAmC,CAAC;IAC3D,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD;;;OAGG;IACH,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,eAAe,EACf,mCAAmC,EACtC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IAEpC,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAE7D,cAAc,EAAE,eAAe,CAAC;IAEhC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAE3B,oBAAoB,CAAC,EAAE,mCAAmC,CAAC;IAC3D,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD;;;OAGG;IACH,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/controllers/workflows/console-login/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/workflows/console-login/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/console-login/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/controllers/workflows/console-login/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ConsoleLogin } from "./module.mjs";
+export { ConsoleLogin };

package/dist/adapters/http/controllers/workflows/console-login/module.d.ts

@@ -0,0 +1,83 @@
+import type { IClient } from '@authup/core-http-kit';
+import type { Logger } from '@authup/server-kit';
+import { OAuth2ErrorCode } from '@authup/specs';
+import type { IAppEvent } from 'routup';
+import type { IConsoleLoginStore, IOAuth2TokenRevoker, IOAuth2TokenVerifier, ISessionManager, ISessionRepository } from '../../../../../core/index.ts';
+import type { ConsoleLoginContext, ConsoleLoginDefinition } from './types.ts';
+/**
+ * A console's server-side login (plan 088): the kick and the code redemption.
+ * Both exist so no OAuth2 token ever reaches the console's JavaScript. The
+ * browser holds an opaque, `HttpOnly` credential naming its `auth_sessions`
+ * row instead.
+ *
+ * One instance per console, parameterized by the client it authenticates
+ * against and the path it is served under (`console/account`,
+ * `console/admin`: the two pending-login cookies stay apart by RFC 6265 path
+ * matching); the account and the admin console differ in nothing else here.
+ */
+export declare class ConsoleLogin {
+    protected definition: ConsoleLoginDefinition;
+    protected baseURL: string;
+    protected loginStore: IConsoleLoginStore;
+    protected sessionRepository: ISessionRepository;
+    protected sessionManager: ISessionManager;
+    protected tokenVerifier: IOAuth2TokenVerifier;
+    protected tokenRevoker: IOAuth2TokenRevoker;
+    protected logger?: Logger;
+    constructor(definition: ConsoleLoginDefinition, ctx: ConsoleLoginContext);
+    /**
+     * Start a console login: mint PKCE + `state`, park them in the pending
+     * login, and send the browser to `/authorize`.
+     *
+     * The verifier never reaches the browser, which is what moves the code
+     * exchange server-side: the callback is the only party that can redeem the
+     * code it comes back with.
+     */
+    login(event: IAppEvent): Promise<Response>;
+    /**
+     * Redeem the authorization code and hand the browser its session cookie.
+     *
+     * Nothing token-shaped leaves this method: the pair is verified, used to
+     * find the session it belongs to, and revoked before the response is
+     * built. What the browser gets back is the opaque `auth_sessions.secret`.
+     */
+    callback(event: IAppEvent): Promise<Response>;
+    protected resolveHttpClient(event: IAppEvent): IClient;
+    /**
+     * Revoke what the exchange returned. Best effort per token: a revoke that
+     * fails must not leave the visitor without a session, and both tokens are
+     * unreachable to anyone but this process either way.
+     */
+    protected revokeGrant(accessToken: string, refreshToken?: string): Promise<void>;
+    protected mapCallbackError(input: string): `${OAuth2ErrorCode}`;
+    /**
+     * Land a refusal on the console rather than in a JSON body: this is a
+     * top-level navigation at the end of a login, and the person behind it has
+     * to be told something. The marker set is closed, so nothing
+     * attacker-shaped is echoed.
+     */
+    protected refuse(event: IAppEvent, error: `${OAuth2ErrorCode}`): Response;
+    protected trimmedBaseURL(): string;
+    protected basePath(): string;
+    protected buildConsoleURL(): string;
+    protected buildCallbackURL(): string;
+    /**
+     * Whether the cookies may carry the `Secure` flag. Read from the parsed
+     * URL rather than the raw string: `publicUrl` is validated but never
+     * canonicalized, so a configured `HTTPS://...` would leave a prefix test
+     * false and silently drop the flag.
+     */
+    protected isSecureBaseURL(): boolean;
+    /**
+     * Scoped to the routes that read it, so it never rides an ordinary API
+     * request and two consoles keep separate logins in flight, and
+     * `SameSite=Lax` because the return leg is a top-level navigation that
+     * may come back through an external identity provider, which a `Strict`
+     * cookie would not accompany. It holds nothing but the id of a single-use
+     * cache entry.
+     */
+    protected buildLoginCookiePath(): string;
+    protected setLoginCookie(event: IAppEvent, value: string): void;
+    protected unsetLoginCookie(event: IAppEvent): void;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/console-login/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/console-login/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAGrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EACH,eAAe,EAIlB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AASxC,OAAO,KAAK,EACR,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EACrB,MAAM,8BAA8B,CAAC;AAItC,OAAO,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAiB9E;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACrB,SAAS,CAAC,UAAU,EAAG,sBAAsB,CAAC;IAE9C,SAAS,CAAC,OAAO,EAAG,MAAM,CAAC;IAE3B,SAAS,CAAC,UAAU,EAAG,kBAAkB,CAAC;IAE1C,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;IAE/C,SAAS,CAAC,YAAY,EAAG,mBAAmB,CAAC;IAE7C,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAEf,UAAU,EAAE,sBAAsB,EAAE,GAAG,EAAE,mBAAmB;IAWxE;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,QAAQ,CAAC;IAyCjD;;;;;;OAMG;IACG,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,QAAQ,CAAC;IAuHpD,SAAS,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO;IASvD;;;;OAIG;cACa,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IAcvF,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAI,GAAG,eAAe,EAAE;IAQhE;;;;;OAKG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,eAAe,EAAE,GAAI,QAAQ;IAc1E,SAAS,CAAC,cAAc,IAAK,MAAM;IAInC,SAAS,CAAC,QAAQ,IAAK,MAAM;IAI7B,SAAS,CAAC,eAAe,IAAK,MAAM;IAIpC,SAAS,CAAC,gBAAgB,IAAK,MAAM;IAIrC;;;;;OAKG;IACH,SAAS,CAAC,eAAe,IAAK,OAAO;IAQrC;;;;;;;OAOG;IACH,SAAS,CAAC,oBAAoB,IAAK,MAAM;IAMzC,SAAS,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAI,IAAI;IAUhE,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAI,IAAI;CAGtD"}