@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/adapters/http/middleware/built-in/authorization/module.mjs

@@ -4,22 +4,29 @@ import.meta.url;
 import { ClientAuthenticator } from "../../../../../core/authentication/entities/client/module.mjs";
 import { UserAuthenticator } from "../../../../../core/authentication/entities/user/module.mjs";
 import { assertClientCertificateEvidenceValidForBinding } from "../../../../../core/client-certificate/module.mjs";
+import { SYSTEM_CLIENT_SCOPE_NAMES } from "../../../../../core/entities/client/system-clients.mjs";
 import { PolicyEngine as PolicyEngine$1 } from "../../../../../core/security/policy/engine.mjs";
+import { SESSION_COOKIE } from "../../../../../core/oauth2/session-credential/constants.mjs";
 import "../../../../../core/index.mjs";
 import { extractClientCertificateEvidence } from "../../../request/client-certificate.mjs";
 import { setRequestPermissionEvaluator } from "../../../request/permission/helper.mjs";
 import { RequestIdentity, setRequestIdentity } from "../../../request/helpers/identity.mjs";
 import { setRequestMfaLoginTicket } from "../../../request/helpers/mfa-login-ticket.mjs";
+import { isSameOriginRequest } from "../../../request/helpers/same-origin.mjs";
 import { setRequestScopes } from "../../../request/helpers/scopes.mjs";
 import { setRequestSessionId } from "../../../request/helpers/session-id.mjs";
 import { setRequestToken } from "../../../request/helpers/token.mjs";
 import { RequestPermissionEvaluator } from "../../../request/permission/module.mjs";
 import "../../../request/index.mjs";
+import { isOAuth2IssuancePath } from "./issuance.mjs";
+import { setSessionCookie } from "../../../cookie/session.mjs";
+import "../../../cookie/index.mjs";
 import { IdentityType, ScopeName } from "@authup/core-kit";
 import { PermissionEvaluator } from "@authup/access";
 import { AuthHeaderError } from "@authup/errors";
 import { JWTError, OAuth2SubKind, OAuth2TokenKind, deserializeOAuth2Scope } from "@authup/specs";
 import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
+import { useRequestCookie } from "@routup/basic/cookie";
 //#region src/adapters/http/middleware/built-in/authorization/module.ts
 const runSymbol = Symbol("RAuthorizationMiddlewareRun");
 var AuthorizationMiddleware = class {
@@ -28,12 +35,16 @@ var AuthorizationMiddleware = class {
 	permissionEvaluator;
 	identityResolver;
 	sessionManager;
+	sessionRepository;
+	logger;
 	clientAuthenticator;
 	userAuthenticator;
 	constructor(ctx) {
 		this.options = ctx.options || {};
 		this.identityResolver = ctx.identityResolver;
 		this.sessionManager = ctx.sessionManager;
+		this.sessionRepository = ctx.sessionRepository;
+		this.logger = ctx.logger;
 		this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);
 		this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);
 		this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;
@@ -55,7 +66,10 @@ var AuthorizationMiddleware = class {
 		const requestAccessContext = new RequestPermissionEvaluator(event, this.permissionEvaluator);
 		setRequestPermissionEvaluator(event, requestAccessContext);
 		const headerValue = event.headers.get("authorization");
-		if (!headerValue) return;
+		if (!headerValue) {
+			await this.runCookieSession(event);
+			return;
+		}
 		const header = parseAuthorizationHeader(headerValue);
 		if (header.type === AuthorizationHeaderType.BEARER) {
 			await this.verifyBearerAuthorizationHeader(event, header);
@@ -68,6 +82,58 @@ var AuthorizationMiddleware = class {
 		throw AuthHeaderError.unsupportedType(header.type);
 	}
 	/**
+	* The console session cookie (plan 088): an opaque credential naming an
+	* `auth_sessions` row, presented instead of a bearer token by a console
+	* served from the API's own origin.
+	*
+	* It NEVER throws and never rejects a request. Anything missing, stale or
+	* refused simply leaves the request anonymous, which the route's own
+	* `ForceLoggedIn` guard then answers — the same outcome as sending no
+	* credential at all. A cookie is ambient, so a request that merely carries
+	* a bad one is not necessarily a request that meant to use it.
+	*/ async runCookieSession(event) {
+		try {
+			const { baseURL } = this.options;
+			if (!baseURL) return;
+			const secret = useRequestCookie(event, SESSION_COOKIE);
+			if (typeof secret !== "string" || secret.length === 0) return;
+			if (isOAuth2IssuancePath(event.path)) return;
+			if (!isSameOriginRequest(event, baseURL, { logger: this.logger })) return;
+			const session = await this.sessionRepository.findOneBySecret(secret);
+			if (!session) return;
+			if (session.subKind !== IdentityType.USER) return;
+			try {
+				await this.sessionManager.verify(session);
+			} catch {
+				return;
+			}
+			const identity = await this.identityResolver.resolve(IdentityType.USER, session.sub);
+			if (!identity) return;
+			setRequestIdentity(event, identity);
+			setRequestSessionId(event, session.id);
+			setRequestScopes(event, [...SYSTEM_CLIENT_SCOPE_NAMES]);
+			await this.refreshCookieSession(event, session, secret);
+		} catch {}
+	}
+	/**
+	* Slide the session's expiry, throttled.
+	*
+	* Cookie mode has no refresh grant, so without this an active console user
+	* would be signed out once the session reached its lifetime, mid-task
+	* (plan 088: a credential change must not become a session-policy change
+	* by omission).
+	*/ async refreshCookieSession(event, session, secret) {
+		const refreshedAt = session.refreshedAt || session.createdAt;
+		if (refreshedAt) {
+			if (new Date(refreshedAt).getTime() + 6e4 > Date.now()) return;
+		}
+		const current = await this.sessionManager.findOneById(session.id);
+		if (!current) return;
+		const refreshed = await this.sessionManager.refresh(current);
+		const ttl = new Date(refreshed.expiresAt).getTime() - Date.now();
+		if (ttl > 0 && this.options.baseURL) setSessionCookie(event, this.options.baseURL, secret, ttl);
+	}
+	/**
 	* @throws JWTError
 	*/ async verifyBearerAuthorizationHeader(event, header) {
 		const payload = await this.oauth2TokenVerifier.verify(header.token);

package/dist/adapters/http/middleware/built-in/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2SubKind","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","UserAuthenticator","assertClientCertificateEvidenceValidForBinding","RequestIdentity","RequestPermissionEvaluator","extractClientCertificateEvidence","setRequestIdentity","setRequestMfaLoginTicket","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","runSymbol","Symbol","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","pending","store","promise","runInner","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","verifyCertificateBinding","kind","MFA","verifyMfaLoginTicket","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","cnf","expectedThumbprint","length","invalid","evidence","certificateSource","thumbprint","USER","subKind","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWTError,\n    OAuth2SubKind,\n    OAuth2TokenKind,\n    deserializeOAuth2Scope,\n} from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n    AuthorizationHeaderType,\n    type BasicAuthorizationHeader,\n    type BearerAuthorizationHeader,\n    parseAuthorizationHeader,\n} from 'hapic';\nimport {\n    ClientAuthenticator,\n    PolicyEngine,\n    UserAuthenticator,\n    assertClientCertificateEvidenceValidForBinding,\n} from '../../../../../core/index.ts';\nimport type {\n    ICredentialsAuthenticator,\n    IIdentityResolver,\n    IOAuth2TokenVerifier,\n    ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n    RequestIdentity,\n    RequestPermissionEvaluator,\n    extractClientCertificateEvidence,\n    setRequestIdentity,\n    setRequestMfaLoginTicket,\n    setRequestPermissionEvaluator,\n    setRequestScopes,\n    setRequestSessionId,\n    setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nconst runSymbol = Symbol('RAuthorizationMiddlewareRun');\n\nexport class AuthorizationMiddleware {\n    protected options: HTTPAuthorizationMiddlewareOptions;\n\n    // --------------------------------------\n\n    protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n    protected permissionEvaluator: IPermissionEvaluator;\n\n    // --------------------------------------\n\n    protected identityResolver: IIdentityResolver;\n\n    protected sessionManager : ISessionManager;\n\n    // --------------------------------------\n\n    protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n    protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n    // --------------------------------------\n\n    constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n        this.options = ctx.options || {};\n\n        this.identityResolver = ctx.identityResolver;\n        this.sessionManager = ctx.sessionManager;\n\n        this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n        this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n        this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n        this.permissionEvaluator = new PermissionEvaluator({\n            provider: ctx.permissionProvider,\n            policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n            realmId: null,\n            clientId: null,\n        });\n    }\n\n    // --------------------------------------\n\n    async run(event: IAppEvent): Promise<void> {\n        // routup's dispatch walk re-enters earlier middlewares once per\n        // remaining match when no handler produces a response — exponentially\n        // (routup/routup#946), so an unmatched authenticated request re-ran\n        // this middleware ~100+ times, re-verifying Basic credentials (bcrypt)\n        // on every re-entry (~4s per 404). Authorization is a pure function of\n        // the request: the first run's settlement — including a rejection —\n        // is authoritative, so memoize the promise on the request store (the\n        // store is shared by every re-entry of the same request).\n        const pending = event.store[runSymbol] as Promise<void> | undefined;\n        if (pending) {\n            return pending;\n        }\n\n        const promise = this.runInner(event);\n        event.store[runSymbol] = promise;\n        return promise;\n    }\n\n    protected async runInner(event: IAppEvent): Promise<void> {\n        const requestAccessContext = new RequestPermissionEvaluator(\n            event,\n            this.permissionEvaluator,\n        );\n        setRequestPermissionEvaluator(event, requestAccessContext);\n\n        const headerValue = event.headers.get('authorization');\n        if (!headerValue) {\n            return;\n        }\n\n        const header = parseAuthorizationHeader(headerValue);\n\n        if (header.type === AuthorizationHeaderType.BEARER) {\n            await this.verifyBearerAuthorizationHeader(event, header);\n            return;\n        }\n\n        if (header.type === AuthorizationHeaderType.BASIC) {\n            await this.verifyBasicAuthorizationHeader(event, header);\n            return;\n        }\n\n        throw AuthHeaderError.unsupportedType(header.type);\n    }\n\n    /**\n     * @throws JWTError\n     */\n    protected async verifyBearerAuthorizationHeader(\n        event: IAppEvent,\n        header: BearerAuthorizationHeader,\n    ) {\n        const payload = await this.oauth2TokenVerifier.verify(header.token);\n        await this.verifyCertificateBinding(event, payload);\n        if (payload.kind === OAuth2TokenKind.MFA) {\n            await this.verifyMfaLoginTicket(event, payload);\n            return;\n        }\n\n        if (payload.kind !== OAuth2TokenKind.ACCESS) {\n            throw JWTError.payloadPropertyInvalid('kind');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        setRequestToken(event, header.token);\n\n        if (payload.scope) {\n            setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n        }\n\n        // -------------------------------------------------------\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        setRequestSessionId(event, payload.session_id);\n\n        // -------------------------------------------------------\n\n        if (!payload.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n\n        if (identity) {\n            setRequestIdentity(event, identity);\n        }\n    }\n\n    protected async verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void> {\n        if (!payload.cnf) {\n            return;\n        }\n\n        const expectedThumbprint = payload.cnf['x5t#S256'];\n        if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n            throw JWTError.invalid();\n        }\n\n        try {\n            const evidence = await extractClientCertificateEvidence(\n                event,\n                this.options.certificateSource ?? 'disabled',\n            );\n            if (!evidence || evidence.thumbprint !== expectedThumbprint) {\n                throw JWTError.invalid();\n            }\n\n            assertClientCertificateEvidenceValidForBinding(evidence);\n        } catch {\n            throw JWTError.invalid();\n        }\n    }\n\n    /**\n     * An \"MFA-pending\" login ticket (issue #3242). Verified with the same\n     * rigor as an access token (session existence + subject match), but\n     * stashed on a DEDICATED request slot — the main identity / scope /\n     * session slots stay empty, so every identity-gated route rejects a\n     * ticket bearer (default-deny); only the challenge routes opt in via\n     * useRequestMfaLoginTicket.\n     *\n     * @throws JWTError\n     */\n    protected async verifyMfaLoginTicket(\n        event: IAppEvent,\n        payload: OAuth2TokenPayload,\n    ) {\n        if (payload.sub_kind !== OAuth2SubKind.USER) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        // defense in depth — the pending session must still belong to the\n        // ticket subject.\n        if (\n            session.sub !== payload.sub ||\n            session.subKind !== IdentityType.USER\n        ) {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n        if (!identity) {\n            throw JWTError.expired();\n        }\n\n        setRequestMfaLoginTicket(event, {\n            identity: new RequestIdentity(identity),\n            payload,\n        });\n    }\n\n    protected async verifyBasicAuthorizationHeader(\n        event: IAppEvent,\n        header: BasicAuthorizationHeader,\n    ) {\n        if (this.options.clientAuthBasic) {\n            const authenticator = await this.clientAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticator.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.CLIENT,\n                    data: authenticator.data,\n                });\n            }\n        }\n\n        if (this.options.userAuthBasic) {\n            const authenticated = await this.userAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.USER,\n                    data: authenticated.data,\n                });\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsDA,MAAMuB,YAAYC,OAAO,6BAAA;AAEzB,IAAaC,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKP,UAAUO,IAAIP,WAAW,CAAC;EAE/B,KAAKG,mBAAmBI,IAAIJ;EAC5B,KAAKC,iBAAiBG,IAAIH;EAE1B,KAAKC,sBAAsB,IAAIrB,oBAAoBuB,IAAIJ,gBAAgB;EACvE,KAAKG,oBAAoB,IAAIpB,kBAAkBqB,IAAIJ,gBAAgB;EAEnE,KAAKF,sBAAsBM,IAAIN;EAE/B,KAAKC,sBAAsB,IAAI5B,oBAAoB;GAC/CkC,UAAUD,IAAIE;GACdC,cAAc,IAAIzB,eAAasB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAiC;EASvC,MAAMC,UAAUD,MAAME,MAAMpB;EAC5B,IAAImB,SACA,OAAOA;EAGX,MAAME,UAAU,KAAKC,SAASJ,KAAAA;EAC9BA,MAAME,MAAMpB,aAAaqB;EACzB,OAAOA;CACX;CAEA,MAAgBC,SAASJ,OAAiC;EACtD,MAAMK,uBAAuB,IAAI/B,2BAC7B0B,OACA,KAAKb,mBAAmB;EAE5BT,8BAA8BsB,OAAOK,oBAAAA;EAErC,MAAMC,cAAcN,MAAMO,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAASzC,yBAAyBsC,WAAAA;EAExC,IAAIG,OAAOC,SAAS3C,wBAAwB4C,QAAQ;GAChD,MAAM,KAAKC,gCAAgCZ,OAAOS,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAAS3C,wBAAwB8C,OAAO;GAC/C,MAAM,KAAKC,+BAA+Bd,OAAOS,MAAAA;GACjD;EACJ;EAEA,MAAM/C,gBAAgBqD,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZZ,OACAS,QACF;EACE,MAAMO,UAAU,MAAM,KAAK9B,oBAAoB+B,OAAOR,OAAOS,KAAK;EAClE,MAAM,KAAKC,yBAAyBnB,OAAOgB,OAAAA;EAC3C,IAAIA,QAAQI,SAASvD,gBAAgBwD,KAAK;GACtC,MAAM,KAAKC,qBAAqBtB,OAAOgB,OAAAA;GACvC;EACJ;EAEA,IAAIA,QAAQI,SAASvD,gBAAgB0D,QACjC,MAAM5D,SAAS6D,uBAAuB,MAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAM9D,SAAS6D,uBAAuB,UAAA;EAG1C3C,gBAAgBmB,OAAOS,OAAOS,KAAK;EAEnC,IAAIF,QAAQU,OACR/C,iBAAiBqB,OAAOlC,uBAAuBkD,QAAQU,KAAK,CAAA;EAKhE,IAAI,CAACV,QAAQW,YACT,MAAMhE,SAAS6D,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKvC,eAAewC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAMjE,SAASmE,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKzC,eAAe4B,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAMjE,SAASmE,QAAO;EAC1B;EAEA,MAAM,KAAKzC,eAAe0C,KAAKH,OAAAA;EAE/BhD,oBAAoBoB,OAAOgB,QAAQW,UAAU;EAI7C,IAAI,CAACX,QAAQgB,UACT,MAAMrE,SAAS6D,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMtE,SAAS6D,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAK9C,iBAAiB+C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAGf,IAAIC,UACA1D,mBAAmBwB,OAAOkC,QAAAA;CAElC;CAEA,MAAgBf,yBAAyBnB,OAAkBgB,SAA4C;EACnG,IAAI,CAACA,QAAQoB,KACT;EAGJ,MAAMC,qBAAqBrB,QAAQoB,IAAI;EACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBC,WAAW,GACxE,MAAM3E,SAAS4E,QAAO;EAG1B,IAAI;GACA,MAAMC,WAAW,MAAMjE,iCACnByB,OACA,KAAKf,QAAQwD,qBAAqB,UAAA;GAEtC,IAAI,CAACD,YAAYA,SAASE,eAAeL,oBACrC,MAAM1E,SAAS4E,QAAO;GAG1BnE,+CAA+CoE,QAAAA;EACnD,QAAQ;GACJ,MAAM7E,SAAS4E,QAAO;EAC1B;CACJ;;;;;;;;;;IAYA,MAAgBjB,qBACZtB,OACAgB,SACF;EACE,IAAIA,QAAQgB,aAAapE,cAAc+E,MACnC,MAAMhF,SAAS6D,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMtE,SAAS6D,uBAAuB,KAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAM9D,SAAS6D,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQW,YACT,MAAMhE,SAAS6D,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKvC,eAAewC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAMjE,SAASmE,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKzC,eAAe4B,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAMjE,SAASmE,QAAO;EAC1B;EAIA,IACIF,QAAQK,QAAQjB,QAAQiB,OACxBL,QAAQgB,YAAYpF,aAAamF,MAEjC,MAAMhF,SAASmE,QAAO;EAG1B,MAAM,KAAKzC,eAAe0C,KAAKH,OAAAA;EAE/B,MAAMM,WAAW,MAAM,KAAK9C,iBAAiB+C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAEf,IAAI,CAACC,UACD,MAAMvE,SAASmE,QAAO;EAG1BrD,yBAAyBuB,OAAO;GAC5BkC,UAAU,IAAI7D,gBAAgB6D,QAAAA;GAC9BlB;EACJ,CAAA;CACJ;CAEA,MAAgBF,+BACZd,OACAS,QACF;EACE,IAAI,KAAKxB,QAAQ4D,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKxD,oBAAoByD,iBACjDtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBvE,iBAAiBqB,OAAO,CAACvC,UAAU0F,MAAO,CAAA;IAC1C3E,mBAAmBwB,OAAO;KACtBU,MAAMlD,aAAa4F;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKpE,QAAQqE,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAKhE,kBAAkBwD,iBAC/CtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBvE,iBAAiBqB,OAAO,CAACvC,UAAU0F,MAAO,CAAA;IAC1C3E,mBAAmBwB,OAAO;KACtBU,MAAMlD,aAAamF;KACnBU,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","useRequestCookie","JWTError","OAuth2SubKind","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","setSessionCookie","ClientAuthenticator","PolicyEngine","SESSION_COOKIE","SESSION_REFRESH_THROTTLE","SYSTEM_CLIENT_SCOPE_NAMES","UserAuthenticator","assertClientCertificateEvidenceValidForBinding","RequestIdentity","RequestPermissionEvaluator","extractClientCertificateEvidence","isSameOriginRequest","setRequestIdentity","setRequestMfaLoginTicket","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","isOAuth2IssuancePath","runSymbol","Symbol","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","sessionRepository","logger","clientAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","pending","store","promise","runInner","requestAccessContext","headerValue","headers","get","runCookieSession","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","baseURL","secret","length","path","session","findOneBySecret","subKind","USER","verify","identity","resolve","sub","id","refreshCookieSession","refreshedAt","createdAt","threshold","Date","getTime","now","current","findOneById","refreshed","refresh","ttl","expiresAt","payload","token","verifyCertificateBinding","kind","MFA","verifyMfaLoginTicket","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","expired","ping","sub_kind","cnf","expectedThumbprint","invalid","evidence","certificateSource","thumbprint","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, Session, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport type { Logger } from '@authup/server-kit';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWTError,\n    OAuth2SubKind,\n    OAuth2TokenKind,\n    deserializeOAuth2Scope,\n} from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n    AuthorizationHeaderType,\n    type BasicAuthorizationHeader,\n    type BearerAuthorizationHeader,\n    parseAuthorizationHeader,\n} from 'hapic';\nimport { setSessionCookie } from '../../../cookie/index.ts';\nimport {\n    ClientAuthenticator,\n    PolicyEngine,\n    SESSION_COOKIE,\n    SESSION_REFRESH_THROTTLE,\n    SYSTEM_CLIENT_SCOPE_NAMES,\n    UserAuthenticator,\n    assertClientCertificateEvidenceValidForBinding,\n} from '../../../../../core/index.ts';\nimport type {\n    ICredentialsAuthenticator,\n    IIdentityResolver,\n    IOAuth2TokenVerifier,\n    ISessionManager,\n    ISessionRepository,\n} from '../../../../../core/index.ts';\nimport {\n    RequestIdentity,\n    RequestPermissionEvaluator,\n    extractClientCertificateEvidence,\n    isSameOriginRequest,\n    setRequestIdentity,\n    setRequestMfaLoginTicket,\n    setRequestPermissionEvaluator,\n    setRequestScopes,\n    setRequestSessionId,\n    setRequestToken,\n} from '../../../request/index.ts';\nimport { isOAuth2IssuancePath } from './issuance.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nconst runSymbol = Symbol('RAuthorizationMiddlewareRun');\n\nexport class AuthorizationMiddleware {\n    protected options: HTTPAuthorizationMiddlewareOptions;\n\n    // --------------------------------------\n\n    protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n    protected permissionEvaluator: IPermissionEvaluator;\n\n    // --------------------------------------\n\n    protected identityResolver: IIdentityResolver;\n\n    protected sessionManager : ISessionManager;\n\n    protected sessionRepository : ISessionRepository;\n\n    protected logger? : Logger;\n\n    // --------------------------------------\n\n    protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n    protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n    // --------------------------------------\n\n    constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n        this.options = ctx.options || {};\n\n        this.identityResolver = ctx.identityResolver;\n        this.sessionManager = ctx.sessionManager;\n        this.sessionRepository = ctx.sessionRepository;\n        this.logger = ctx.logger;\n\n        this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n        this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n        this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n        this.permissionEvaluator = new PermissionEvaluator({\n            provider: ctx.permissionProvider,\n            policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n            realmId: null,\n            clientId: null,\n        });\n    }\n\n    // --------------------------------------\n\n    async run(event: IAppEvent): Promise<void> {\n        // routup's dispatch walk re-enters earlier middlewares once per\n        // remaining match when no handler produces a response — exponentially\n        // (routup/routup#946), so an unmatched authenticated request re-ran\n        // this middleware ~100+ times, re-verifying Basic credentials (bcrypt)\n        // on every re-entry (~4s per 404). Authorization is a pure function of\n        // the request: the first run's settlement — including a rejection —\n        // is authoritative, so memoize the promise on the request store (the\n        // store is shared by every re-entry of the same request).\n        const pending = event.store[runSymbol] as Promise<void> | undefined;\n        if (pending) {\n            return pending;\n        }\n\n        const promise = this.runInner(event);\n        event.store[runSymbol] = promise;\n        return promise;\n    }\n\n    protected async runInner(event: IAppEvent): Promise<void> {\n        const requestAccessContext = new RequestPermissionEvaluator(\n            event,\n            this.permissionEvaluator,\n        );\n        setRequestPermissionEvaluator(event, requestAccessContext);\n\n        const headerValue = event.headers.get('authorization');\n        if (!headerValue) {\n            // The bearer/Basic path is untouched, and the header keeps\n            // winning: the cookie is only consulted when the request presents\n            // no credential of its own.\n            await this.runCookieSession(event);\n            return;\n        }\n\n        const header = parseAuthorizationHeader(headerValue);\n\n        if (header.type === AuthorizationHeaderType.BEARER) {\n            await this.verifyBearerAuthorizationHeader(event, header);\n            return;\n        }\n\n        if (header.type === AuthorizationHeaderType.BASIC) {\n            await this.verifyBasicAuthorizationHeader(event, header);\n            return;\n        }\n\n        throw AuthHeaderError.unsupportedType(header.type);\n    }\n\n    /**\n     * The console session cookie (plan 088): an opaque credential naming an\n     * `auth_sessions` row, presented instead of a bearer token by a console\n     * served from the API's own origin.\n     *\n     * It NEVER throws and never rejects a request. Anything missing, stale or\n     * refused simply leaves the request anonymous, which the route's own\n     * `ForceLoggedIn` guard then answers — the same outcome as sending no\n     * credential at all. A cookie is ambient, so a request that merely carries\n     * a bad one is not necessarily a request that meant to use it.\n     */\n    protected async runCookieSession(event: IAppEvent): Promise<void> {\n        try {\n            const { baseURL } = this.options;\n            if (!baseURL) {\n                // The origin gate cannot be evaluated without publicUrl, so\n                // the cookie is not honoured at all.\n                return;\n            }\n\n            const secret = useRequestCookie(event, SESSION_COOKIE);\n            if (typeof secret !== 'string' || secret.length === 0) {\n                return;\n            }\n\n            // Finding 2 of plan 088, and an invariant rather than a detail:\n            // an ambient cookie must never reach the OAuth2 issuance surface,\n            // or one script execution on this origin turns it back into a\n            // portable token pair.\n            if (isOAuth2IssuancePath(event.path)) {\n                return;\n            }\n\n            if (!isSameOriginRequest(event, baseURL, { logger: this.logger })) {\n                return;\n            }\n\n            const session = await this.sessionRepository.findOneBySecret(secret);\n            if (!session) {\n                return;\n            }\n\n            // The consoles are user surfaces. A client-subject session would\n            // otherwise authenticate here and then produce a sign-in loop in a\n            // console that can only render a user.\n            if (session.subKind !== IdentityType.USER) {\n                return;\n            }\n\n            try {\n                // Same expiry contract as the bearer path (it also drops the\n                // expired row), minus the rejection.\n                await this.sessionManager.verify(session);\n            } catch {\n                return;\n            }\n\n            const identity = await this.identityResolver.resolve(\n                IdentityType.USER,\n                session.sub,\n            );\n            if (!identity) {\n                return;\n            }\n\n            setRequestIdentity(event, identity);\n            // Named explicitly: createRequestEventContextMiddleware reads it\n            // for audit attribution, so omitting it would regress plan 093's\n            // session attribution to null on every cookie-mode write.\n            setRequestSessionId(event, session.id);\n            // The console's granted scope set is a constant — the cookie\n            // belongs to a console session, and the console client is\n            // provisioned with exactly these (SYSTEM_CLIENT_SCOPE_NAMES).\n            setRequestScopes(event, [...SYSTEM_CLIENT_SCOPE_NAMES]);\n\n            await this.refreshCookieSession(event, session, secret);\n        } catch {\n            // Defense in depth around everything above: an anonymous request\n            // is always a valid outcome here, an error page never is.\n        }\n    }\n\n    /**\n     * Slide the session's expiry, throttled.\n     *\n     * Cookie mode has no refresh grant, so without this an active console user\n     * would be signed out once the session reached its lifetime, mid-task\n     * (plan 088: a credential change must not become a session-policy change\n     * by omission).\n     */\n    protected async refreshCookieSession(\n        event: IAppEvent,\n        session: Session,\n        secret: string,\n    ): Promise<void> {\n        const refreshedAt = session.refreshedAt || session.createdAt;\n        if (refreshedAt) {\n            const threshold = new Date(refreshedAt).getTime() + SESSION_REFRESH_THROTTLE;\n            if (threshold > Date.now()) {\n                return;\n            }\n        }\n\n        // `repository.save` upserts by primary key, so writing the row read at\n        // the top of this request would RESURRECT a session a concurrent\n        // sign-out deleted in between. Re-read first: the sign-out drops both\n        // the row and its cache entry, so a miss here means the session is\n        // gone and there is nothing to slide.\n        const current = await this.sessionManager.findOneById(session.id);\n        if (!current) {\n            return;\n        }\n\n        const refreshed = await this.sessionManager.refresh(current);\n\n        // Re-arm the cookie, or the slide is invisible to the browser. A\n        // cookie's `Max-Age` is fixed by the response that set it, so leaving\n        // it at the value the callback computed would have the browser discard\n        // the credential at login + one lifetime no matter how recently the\n        // session was used — the hard cap the sliding decision rejected, with\n        // the server-side slide happening and never being observable.\n        const ttl = new Date(refreshed.expiresAt).getTime() - Date.now();\n        if (ttl > 0 && this.options.baseURL) {\n            setSessionCookie(event, this.options.baseURL, secret, ttl);\n        }\n    }\n\n    /**\n     * @throws JWTError\n     */\n    protected async verifyBearerAuthorizationHeader(\n        event: IAppEvent,\n        header: BearerAuthorizationHeader,\n    ) {\n        const payload = await this.oauth2TokenVerifier.verify(header.token);\n        await this.verifyCertificateBinding(event, payload);\n        if (payload.kind === OAuth2TokenKind.MFA) {\n            await this.verifyMfaLoginTicket(event, payload);\n            return;\n        }\n\n        if (payload.kind !== OAuth2TokenKind.ACCESS) {\n            throw JWTError.payloadPropertyInvalid('kind');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        setRequestToken(event, header.token);\n\n        if (payload.scope) {\n            setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n        }\n\n        // -------------------------------------------------------\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        setRequestSessionId(event, payload.session_id);\n\n        // -------------------------------------------------------\n\n        if (!payload.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n\n        if (identity) {\n            setRequestIdentity(event, identity);\n        }\n    }\n\n    protected async verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void> {\n        if (!payload.cnf) {\n            return;\n        }\n\n        const expectedThumbprint = payload.cnf['x5t#S256'];\n        if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n            throw JWTError.invalid();\n        }\n\n        try {\n            const evidence = await extractClientCertificateEvidence(\n                event,\n                this.options.certificateSource ?? 'disabled',\n            );\n            if (!evidence || evidence.thumbprint !== expectedThumbprint) {\n                throw JWTError.invalid();\n            }\n\n            assertClientCertificateEvidenceValidForBinding(evidence);\n        } catch {\n            throw JWTError.invalid();\n        }\n    }\n\n    /**\n     * An \"MFA-pending\" login ticket (issue #3242). Verified with the same\n     * rigor as an access token (session existence + subject match), but\n     * stashed on a DEDICATED request slot — the main identity / scope /\n     * session slots stay empty, so every identity-gated route rejects a\n     * ticket bearer (default-deny); only the challenge routes opt in via\n     * useRequestMfaLoginTicket.\n     *\n     * @throws JWTError\n     */\n    protected async verifyMfaLoginTicket(\n        event: IAppEvent,\n        payload: OAuth2TokenPayload,\n    ) {\n        if (payload.sub_kind !== OAuth2SubKind.USER) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        // defense in depth — the pending session must still belong to the\n        // ticket subject.\n        if (\n            session.sub !== payload.sub ||\n            session.subKind !== IdentityType.USER\n        ) {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n        if (!identity) {\n            throw JWTError.expired();\n        }\n\n        setRequestMfaLoginTicket(event, {\n            identity: new RequestIdentity(identity),\n            payload,\n        });\n    }\n\n    protected async verifyBasicAuthorizationHeader(\n        event: IAppEvent,\n        header: BasicAuthorizationHeader,\n    ) {\n        if (this.options.clientAuthBasic) {\n            const authenticator = await this.clientAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticator.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.CLIENT,\n                    data: authenticator.data,\n                });\n            }\n        }\n\n        if (this.options.userAuthBasic) {\n            const authenticated = await this.userAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.USER,\n                    data: authenticated.data,\n                });\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DA,MAAM8B,YAAYC,OAAO,6BAAA;AAEzB,IAAaC,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAEAC;CAEAC;CAIAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKT,UAAUS,IAAIT,WAAW,CAAC;EAE/B,KAAKG,mBAAmBM,IAAIN;EAC5B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,oBAAoBI,IAAIJ;EAC7B,KAAKC,SAASG,IAAIH;EAElB,KAAKC,sBAAsB,IAAI5B,oBAAoB8B,IAAIN,gBAAgB;EACvE,KAAKK,oBAAoB,IAAIxB,kBAAkByB,IAAIN,gBAAgB;EAEnE,KAAKF,sBAAsBQ,IAAIR;EAE/B,KAAKC,sBAAsB,IAAInC,oBAAoB;GAC/C2C,UAAUD,IAAIE;GACdC,cAAc,IAAIhC,eAAa6B,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAiC;EASvC,MAAMC,UAAUD,MAAME,MAAMtB;EAC5B,IAAIqB,SACA,OAAOA;EAGX,MAAME,UAAU,KAAKC,SAASJ,KAAAA;EAC9BA,MAAME,MAAMtB,aAAauB;EACzB,OAAOA;CACX;CAEA,MAAgBC,SAASJ,OAAiC;EACtD,MAAMK,uBAAuB,IAAInC,2BAC7B8B,OACA,KAAKf,mBAAmB;EAE5BV,8BAA8ByB,OAAOK,oBAAAA;EAErC,MAAMC,cAAcN,MAAMO,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aAAa;GAId,MAAM,KAAKG,iBAAiBT,KAAAA;GAC5B;EACJ;EAEA,MAAMU,SAASlD,yBAAyB8C,WAAAA;EAExC,IAAII,OAAOC,SAASpD,wBAAwBqD,QAAQ;GAChD,MAAM,KAAKC,gCAAgCb,OAAOU,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAASpD,wBAAwBuD,OAAO;GAC/C,MAAM,KAAKC,+BAA+Bf,OAAOU,MAAAA;GACjD;EACJ;EAEA,MAAMzD,gBAAgB+D,gBAAgBN,OAAOC,IAAI;CACrD;;;;;;;;;;;IAaA,MAAgBF,iBAAiBT,OAAiC;EAC9D,IAAI;GACA,MAAM,EAAEiB,YAAY,KAAKlC;GACzB,IAAI,CAACkC,SAGD;GAGJ,MAAMC,SAAShE,iBAAiB8C,OAAOpC,cAAAA;GACvC,IAAI,OAAOsD,WAAW,YAAYA,OAAOC,WAAW,GAChD;GAOJ,IAAIxC,qBAAqBqB,MAAMoB,IAAI,GAC/B;GAGJ,IAAI,CAAChD,oBAAoB4B,OAAOiB,SAAS,EAAE5B,QAAQ,KAAKA,OAAO,CAAA,GAC3D;GAGJ,MAAMgC,UAAU,MAAM,KAAKjC,kBAAkBkC,gBAAgBJ,MAAAA;GAC7D,IAAI,CAACG,SACD;GAMJ,IAAIA,QAAQE,YAAYxE,aAAayE,MACjC;GAGJ,IAAI;IAGA,MAAM,KAAKrC,eAAesC,OAAOJ,OAAAA;GACrC,QAAQ;IACJ;GACJ;GAEA,MAAMK,WAAW,MAAM,KAAKxC,iBAAiByC,QACzC5E,aAAayE,MACbH,QAAQO,GAAG;GAEf,IAAI,CAACF,UACD;GAGJrD,mBAAmB2B,OAAO0B,QAAAA;GAI1BjD,oBAAoBuB,OAAOqB,QAAQQ,EAAE;GAIrCrD,iBAAiBwB,OAAO,CAAIlC,GAAAA,yBAA0B,CAAA;GAEtD,MAAM,KAAKgE,qBAAqB9B,OAAOqB,SAASH,MAAAA;EACpD,QAAQ,CAGR;CACJ;;;;;;;;IAUA,MAAgBY,qBACZ9B,OACAqB,SACAH,QACa;EACb,MAAMa,cAAcV,QAAQU,eAAeV,QAAQW;EACnD,IAAID,aACkB;OAAA,IAAIG,KAAKH,WAAAA,CAAAA,CAAaI,QAAO,IAAA,MAC/BD,KAAKE,IAAG,GACpB;EAAA;EASR,MAAMC,UAAU,MAAM,KAAKlD,eAAemD,YAAYjB,QAAQQ,EAAE;EAChE,IAAI,CAACQ,SACD;EAGJ,MAAME,YAAY,MAAM,KAAKpD,eAAeqD,QAAQH,OAAAA;EAQpD,MAAMI,MAAM,IAAIP,KAAKK,UAAUG,SAAS,CAAA,CAAEP,QAAO,IAAKD,KAAKE,IAAG;EAC9D,IAAIK,MAAM,KAAK,KAAK1D,QAAQkC,SACxBxD,iBAAiBuC,OAAO,KAAKjB,QAAQkC,SAASC,QAAQuB,GAAAA;CAE9D;;;IAKA,MAAgB5B,gCACZb,OACAU,QACF;EACE,MAAMiC,UAAU,MAAM,KAAK3D,oBAAoByC,OAAOf,OAAOkC,KAAK;EAClE,MAAM,KAAKC,yBAAyB7C,OAAO2C,OAAAA;EAC3C,IAAIA,QAAQG,SAASzF,gBAAgB0F,KAAK;GACtC,MAAM,KAAKC,qBAAqBhD,OAAO2C,OAAAA;GACvC;EACJ;EAEA,IAAIA,QAAQG,SAASzF,gBAAgB4F,QACjC,MAAM9F,SAAS+F,uBAAuB,MAAA;EAG1C,IAAI,CAACP,QAAQQ,UACT,MAAMhG,SAAS+F,uBAAuB,UAAA;EAG1CxE,gBAAgBsB,OAAOU,OAAOkC,KAAK;EAEnC,IAAID,QAAQS,OACR5E,iBAAiBwB,OAAO1C,uBAAuBqF,QAAQS,KAAK,CAAA;EAKhE,IAAI,CAACT,QAAQU,YACT,MAAMlG,SAAS+F,uBAAuB,YAAA;EAG1C,MAAM7B,UAAU,MAAM,KAAKlC,eAAemD,YAAYK,QAAQU,UAAU;EACxE,IAAI,CAAChC,SACD,MAAMlE,SAASmG,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKnE,eAAesC,OAAOJ,OAAAA;EACrC,QAAQ;GACJ,MAAMlE,SAASmG,QAAO;EAC1B;EAEA,MAAM,KAAKnE,eAAeoE,KAAKlC,OAAAA;EAE/B5C,oBAAoBuB,OAAO2C,QAAQU,UAAU;EAI7C,IAAI,CAACV,QAAQa,UACT,MAAMrG,SAAS+F,uBAAuB,UAAA;EAG1C,IAAI,CAACP,QAAQf,KACT,MAAMzE,SAAS+F,uBAAuB,KAAA;EAG1C,MAAMxB,WAAW,MAAM,KAAKxC,iBAAiByC,QACzCgB,QAAQa,UACRb,QAAQf,GAAG;EAGf,IAAIF,UACArD,mBAAmB2B,OAAO0B,QAAAA;CAElC;CAEA,MAAgBmB,yBAAyB7C,OAAkB2C,SAA4C;EACnG,IAAI,CAACA,QAAQc,KACT;EAGJ,MAAMC,qBAAqBf,QAAQc,IAAI;EACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBvC,WAAW,GACxE,MAAMhE,SAASwG,QAAO;EAG1B,IAAI;GACA,MAAMC,WAAW,MAAMzF,iCACnB6B,OACA,KAAKjB,QAAQ8E,qBAAqB,UAAA;GAEtC,IAAI,CAACD,YAAYA,SAASE,eAAeJ,oBACrC,MAAMvG,SAASwG,QAAO;GAG1B3F,+CAA+C4F,QAAAA;EACnD,QAAQ;GACJ,MAAMzG,SAASwG,QAAO;EAC1B;CACJ;;;;;;;;;;IAYA,MAAgBX,qBACZhD,OACA2C,SACF;EACE,IAAIA,QAAQa,aAAapG,cAAcoE,MACnC,MAAMrE,SAAS+F,uBAAuB,UAAA;EAG1C,IAAI,CAACP,QAAQf,KACT,MAAMzE,SAAS+F,uBAAuB,KAAA;EAG1C,IAAI,CAACP,QAAQQ,UACT,MAAMhG,SAAS+F,uBAAuB,UAAA;EAG1C,IAAI,CAACP,QAAQU,YACT,MAAMlG,SAAS+F,uBAAuB,YAAA;EAG1C,MAAM7B,UAAU,MAAM,KAAKlC,eAAemD,YAAYK,QAAQU,UAAU;EACxE,IAAI,CAAChC,SACD,MAAMlE,SAASmG,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKnE,eAAesC,OAAOJ,OAAAA;EACrC,QAAQ;GACJ,MAAMlE,SAASmG,QAAO;EAC1B;EAIA,IACIjC,QAAQO,QAAQe,QAAQf,OACxBP,QAAQE,YAAYxE,aAAayE,MAEjC,MAAMrE,SAASmG,QAAO;EAG1B,MAAM,KAAKnE,eAAeoE,KAAKlC,OAAAA;EAE/B,MAAMK,WAAW,MAAM,KAAKxC,iBAAiByC,QACzCgB,QAAQa,UACRb,QAAQf,GAAG;EAEf,IAAI,CAACF,UACD,MAAMvE,SAASmG,QAAO;EAG1BhF,yBAAyB0B,OAAO;GAC5B0B,UAAU,IAAIzD,gBAAgByD,QAAAA;GAC9BiB;EACJ,CAAA;CACJ;CAEA,MAAgB5B,+BACZf,OACAU,QACF;EACE,IAAI,KAAK3B,QAAQgF,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAK1E,oBAAoB2E,iBACjDvD,OAAOwD,UACPxD,OAAOyD,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvB5F,iBAAiBwB,OAAO,CAAChD,UAAUqH,MAAO,CAAA;IAC1ChG,mBAAmB2B,OAAO;KACtBW,MAAM5D,aAAauH;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKxF,QAAQyF,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAKlF,kBAAkB0E,iBAC/CvD,OAAOwD,UACPxD,OAAOyD,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvB5F,iBAAiBwB,OAAO,CAAChD,UAAUqH,MAAO,CAAA;IAC1ChG,mBAAmB2B,OAAO;KACtBW,MAAM5D,aAAayE;KACnB+C,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}

package/dist/adapters/http/middleware/built-in/authorization/types.d.ts

@@ -1,17 +1,37 @@
 import type { IPermissionProvider } from '@authup/access';
-import type { IIdentityPermissionProvider, IIdentityResolver, IOAuth2TokenVerifier, ISessionManager } from '../../../../../core/index.ts';
+import type { Logger } from '@authup/server-kit';
+import type { IIdentityPermissionProvider, IIdentityResolver, IOAuth2TokenVerifier, ISessionManager, ISessionRepository } from '../../../../../core/index.ts';
 import type { CertificateSource } from '../../../request/index.ts';
 export type HTTPAuthorizationMiddlewareOptions = {
     clientAuthBasic?: boolean;
     userAuthBasic?: boolean;
     certificateSource?: CertificateSource;
+    /**
+     * publicUrl. The origin every cookie-authenticated request is checked
+     * against (`isSameOriginRequest`). Without it the console session cookie
+     * is ignored entirely — the gate cannot be evaluated, so it fails closed.
+     */
+    baseURL?: string;
 };
 export type HTTPAuthorizationMiddlewareContext = {
     identityResolver: IIdentityResolver;
     identityPermissionProvider: IIdentityPermissionProvider;
     sessionManager: ISessionManager;
+    /**
+     * Resolves the opaque console session credential (plan 088). The session
+     * MANAGER cannot: the credential is a `select: false` column read by a
+     * dedicated, uncached lookup.
+     */
+    sessionRepository: ISessionRepository;
     oauth2TokenVerifier: IOAuth2TokenVerifier;
     permissionProvider: IPermissionProvider;
+    /**
+     * Reports a cookie presented from an origin that is not publicUrl's, once
+     * per process. A deployment whose browser-facing host differs from
+     * `publicUrl` otherwise presents as a console that loads and then silently
+     * 401s everything.
+     */
+    logger?: Logger;
     options?: HTTPAuthorizationMiddlewareOptions;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/middleware/built-in/authorization/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAER,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,kCAAkC,GAAG;IAC7C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC7C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IACxD,cAAc,EAAE,eAAe,CAAC;IAChC,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,kBAAkB,EAAE,mBAAmB,CAAC;IAExC,OAAO,CAAC,EAAE,kCAAkC,CAAA;CAC/C,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAER,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EACrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,kCAAkC,GAAG;IAC7C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC7C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;IACxD,cAAc,EAAE,eAAe,CAAC;IAChC;;;;OAIG;IACH,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,kBAAkB,EAAE,mBAAmB,CAAC;IAExC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,OAAO,CAAC,EAAE,kCAAkC,CAAA;CAC/C,CAAC"}

package/dist/adapters/http/middleware/built-in/basic.d.ts

@@ -1,4 +1,4 @@
 import type { Options } from '@routup/basic';
-import type { App } from 'routup';
-export declare function registerBasicMiddleware(router: App, input?: Options): void;
+import type { IApp } from 'routup';
+export declare function registerBasicMiddleware(router: IApp, input?: Options): void;
 //# sourceMappingURL=basic.d.ts.map

package/dist/adapters/http/middleware/built-in/basic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"basic.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/basic.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,QAEnE"}
+{"version":3,"file":"basic.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/basic.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEnC,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,OAAO,QAEpE"}

package/dist/adapters/http/middleware/built-in/basic.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"basic.mjs","names":["basic","registerBasicMiddleware","router","input","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/basic.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Options } from '@routup/basic';\nimport { basic } from '@routup/basic';\nimport type { App } from 'routup';\n\nexport function registerBasicMiddleware(router: App, input?: Options) {\n    router.use(basic(input));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,wBAAwBC,QAAaC,OAAe;CAChED,OAAOE,IAAIJ,MAAMG,KAAAA,CAAAA;AACrB"}
+{"version":3,"file":"basic.mjs","names":["basic","registerBasicMiddleware","router","input","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/basic.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Options } from '@routup/basic';\nimport { basic } from '@routup/basic';\nimport type { IApp } from 'routup';\n\nexport function registerBasicMiddleware(router: IApp, input?: Options) {\n    router.use(basic(input));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,wBAAwBC,QAAcC,OAAe;CACjED,OAAOE,IAAIJ,MAAMG,KAAAA,CAAAA;AACrB"}

package/dist/adapters/http/middleware/built-in/cors.d.ts

@@ -1,4 +1,10 @@
 import type { Options as CorsOptions } from '@routup/cors';
-import type { App } from 'routup';
-export declare function registerCorsMiddleware(router: App, input?: CorsOptions): void;
+import type { IApp } from 'routup';
+export type CorsMiddlewareContext = {
+    /**
+     * publicUrl. The ONE origin credentialed requests are answered for.
+     */
+    baseURL: string;
+};
+export declare function registerCorsMiddleware(router: IApp, input: CorsOptions | undefined, ctx: CorsMiddlewareContext): void;
 //# sourceMappingURL=cors.d.ts.map

package/dist/adapters/http/middleware/built-in/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,WAAW,QAmCtE"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAGnC,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,GAAG,EAAE,qBAAqB,QA6E9G"}

package/dist/adapters/http/middleware/built-in/cors.mjs

@@ -1,10 +1,11 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { cors } from "@routup/cors";
+import { defineCoreHandler, getRequestHeader } from "routup";
+import { handleCors } from "@routup/cors";
 //#region src/adapters/http/middleware/built-in/cors.ts
-function registerCorsMiddleware(router, input) {
-	router.use(cors({
+function registerCorsMiddleware(router, input, ctx) {
+	const options = {
 		origin: true,
 		credentials: true,
 		exposeHeaders: [
@@ -20,6 +21,22 @@ function registerCorsMiddleware(router, input) {
 			"www-authenticate"
 		],
 		...input ?? {}
+	};
+	let trustedOrigin;
+	try {
+		trustedOrigin = new URL(ctx.baseURL).origin;
+	} catch {
+		trustedOrigin = void 0;
+	}
+	router.use(defineCoreHandler((event) => {
+		const origin = getRequestHeader(event, "origin");
+		const credentials = !!options.credentials && !!trustedOrigin && origin === trustedOrigin;
+		const response = handleCors(event, {
+			...options,
+			credentials
+		});
+		if (response) return response;
+		return event.next();
 	}));
 }
 //#endregion

package/dist/adapters/http/middleware/built-in/cors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cors.mjs","names":["cors","registerCorsMiddleware","router","input","use","origin","credentials","exposeHeaders"],"sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Options as CorsOptions } from '@routup/cors';\nimport { cors } from '@routup/cors';\nimport type { App } from 'routup';\n\nexport function registerCorsMiddleware(router: App, input?: CorsOptions) {\n    router.use(cors({\n        // Reflect any origin by default: OAuth2 clients (and their UIs) are\n        // registered at runtime on arbitrary domains, so a startup-time\n        // allowlist cannot know them. Authentication is header-based\n        // (Bearer/Basic), so an origin allowlist would add no security here,\n        // only break dynamically registered browser clients. Operators can\n        // still pass an explicit `origin` via the middlewareCors config\n        // options.\n        //\n        // ONE endpoint authenticates on a cookie: the federated login's\n        // `POST /identity-providers/:id/login-complete` (plan 094). Reflecting\n        // an origin WITH credentials would let any same-site origin read the\n        // token pair it answers with, since `SameSite` is scoped to the\n        // registrable domain rather than the origin, so that route checks\n        // `Origin` against publicUrl itself. A second cookie-authenticated\n        // endpoint must do the same, or this default has to change.\n        origin: true,\n        credentials: true,\n        // `credentials: true` is incompatible with the `*` wildcard for\n        // exposeHeaders, so enumerate the response headers JS clients need.\n        exposeHeaders: [\n            'ratelimit-limit',\n            'ratelimit-remaining',\n            'ratelimit-reset',\n            'retry-after',\n            'etag',\n            'content-disposition',\n            'content-range',\n            'accept-ranges',\n            'location',\n            'www-authenticate',\n        ],\n        ...(input ?? {}),\n    }));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,uBAAuBC,QAAaC,OAAmB;CACnED,OAAOE,IAAIJ,KAAK;EAgBZK,QAAQ;EACRC,aAAa;EAGbC,eAAe;GACX;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACD,GAAIJ,SAAS,CAAC;CAClB,CAAA,CAAA;AACJ"}
+{"version":3,"file":"cors.mjs","names":["handleCors","defineCoreHandler","getRequestHeader","registerCorsMiddleware","router","input","ctx","options","origin","credentials","exposeHeaders","trustedOrigin","URL","baseURL","undefined","use","event","response","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Options as CorsOptions } from '@routup/cors';\nimport { handleCors } from '@routup/cors';\nimport type { IApp } from 'routup';\nimport { defineCoreHandler, getRequestHeader } from 'routup';\n\nexport type CorsMiddlewareContext = {\n    /**\n     * publicUrl. The ONE origin credentialed requests are answered for.\n     */\n    baseURL: string,\n};\n\nexport function registerCorsMiddleware(router: IApp, input: CorsOptions | undefined, ctx: CorsMiddlewareContext) {\n    const options : CorsOptions = {\n        // Reflect any origin by default: OAuth2 clients (and their UIs) are\n        // registered at runtime on arbitrary domains, so a startup-time\n        // allowlist cannot know them. Bearer/Basic authentication is carried\n        // in a header a cross-origin page cannot make the browser attach on\n        // its own, so reflecting the origin adds no exposure for it. Operators\n        // can still pass an explicit `origin` via the middlewareCors config\n        // options.\n        origin: true,\n        credentials: true,\n        // `credentials: true` is incompatible with the `*` wildcard for\n        // exposeHeaders, so enumerate the response headers JS clients need.\n        exposeHeaders: [\n            'ratelimit-limit',\n            'ratelimit-remaining',\n            'ratelimit-reset',\n            'retry-after',\n            'etag',\n            'content-disposition',\n            'content-range',\n            'accept-ranges',\n            'location',\n            'www-authenticate',\n        ],\n        ...(input ?? {}),\n    };\n\n    let trustedOrigin : string | undefined;\n    try {\n        trustedOrigin = new URL(ctx.baseURL).origin;\n    } catch {\n        trustedOrigin = undefined;\n    }\n\n    // `access-control-allow-credentials` is emitted ONLY for publicUrl's own\n    // origin (plan 088).\n    //\n    // Cookie-authenticated surfaces exist now (the federated login's\n    // `POST /identity-providers/:id/login-complete` (plan 094) and, since\n    // plan 088, every route the console session cookie reaches), so\n    // \"reflect any origin\" and \"answer credentialed requests\" can no longer\n    // both hold. `SameSite` does not save it: the attribute is scoped to the\n    // registrable domain, so a sibling subdomain is same-SITE, its\n    // `fetch(credentials: 'include')` carries the cookie, and a reflected\n    // `Allow-Origin` plus `Allow-Credentials` would let it read the reply.\n    //\n    // `Allow-Origin` keeps reflecting, so every non-credentialed\n    // cross-origin caller is unaffected. No authup consumer sets\n    // `credentials: 'include'` (neither core-http-kit nor the web kit), and\n    // the same-origin console needs no credentials mode, so nothing of\n    // authup's own breaks. The narrowing applies to an explicit\n    // `middlewareCors` config too: while an ambient cookie is accepted here,\n    // there is no supported way to hand another origin the user's session.\n    //\n    // This narrowing does NOT relieve a cookie-authenticated route of its own\n    // origin check (`isSameOriginRequest`). CORS governs what a browser lets\n    // a foreign page READ, never what this server ACTS on: a credentialed\n    // request whose reply the browser will discard still arrives, and still\n    // carries the cookie. Every such surface repeats the check: plan 088's\n    // console session and plan 094's login completion both do.\n    //\n    // A per-request decision, because @routup/cors takes `credentials` as a\n    // plain boolean, hence `handleCors` rather than the `cors()` plugin.\n    router.use(defineCoreHandler((event) => {\n        const origin = getRequestHeader(event, 'origin');\n        const credentials = !!options.credentials &&\n            !!trustedOrigin &&\n            origin === trustedOrigin;\n\n        const response = handleCors(event, { ...options, credentials });\n        if (response) {\n            return response;\n        }\n\n        return event.next();\n    }));\n}\n"],"mappings":";;;;;;AAmBA,SAAgBG,uBAAuBC,QAAcC,OAAgCC,KAA0B;CAC3G,MAAMC,UAAwB;EAQ1BC,QAAQ;EACRC,aAAa;EAGbC,eAAe;GACX;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACD,GAAIL,SAAS,CAAC;CAClB;CAEA,IAAIM;CACJ,IAAI;EACAA,gBAAgB,IAAIC,IAAIN,IAAIO,OAAO,CAAA,CAAEL;CACzC,QAAQ;EACJG,gBAAgBG,KAAAA;CACpB;CA+BAV,OAAOW,IAAId,mBAAmBe,UAAAA;EAC1B,MAAMR,SAASN,iBAAiBc,OAAO,QAAA;EACvC,MAAMP,cAAc,CAAC,CAACF,QAAQE,eAC1B,CAAC,CAACE,iBACFH,WAAWG;EAEf,MAAMM,WAAWjB,WAAWgB,OAAO;GAAE,GAAGT;GAASE;EAAY,CAAA;EAC7D,IAAIQ,UACA,OAAOA;EAGX,OAAOD,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}

package/dist/adapters/http/middleware/built-in/error.d.ts

@@ -1,8 +1,8 @@
-import type { App } from 'routup';
+import type { IApp } from 'routup';
 import type { Logger } from '@authup/server-kit';
 type ErrorMiddlewareOptions = {
     logger?: Logger;
 };
-export declare function registerErrorMiddleware(router: App, options?: ErrorMiddlewareOptions): void;
+export declare function registerErrorMiddleware(router: IApp, options?: ErrorMiddlewareOptions): void;
 export {};
 //# sourceMappingURL=error.d.ts.map

package/dist/adapters/http/middleware/built-in/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAKjD,KAAK,sBAAsB,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,GAAE,sBAA2B,QAyDxF"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAKjD,KAAK,sBAAsB,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,GAAE,sBAA2B,QAyDzF"}

package/dist/adapters/http/middleware/built-in/error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error.mjs","names":["defineErrorHandler","ErrorCode","httpStatusFromCode","serializeError","isJWTErrorCode","describeError","sanitizeError","registerErrorMiddleware","router","options","use","error","event","original","cause","next","status","code","payload","logger","message","authorization","headers","get","toLowerCase","startsWith","description","String","replace","response","set","IDENTITY_UNAUTHORIZED"],"sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App } from 'routup';\nimport { defineErrorHandler } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { ErrorCode, httpStatusFromCode, serializeError } from '@authup/errors';\nimport { isJWTErrorCode } from '@authup/specs';\nimport { describeError, sanitizeError } from '../../../../utils/index.ts';\n\ntype ErrorMiddlewareOptions = {\n    logger?: Logger\n};\n\nexport function registerErrorMiddleware(router: App, options: ErrorMiddlewareOptions = {}) {\n    router.use(defineErrorHandler((error, event) => {\n        // routup wraps whatever a handler threw into an AppError carrying it\n        // as `cause`, so this is the error as it was actually raised.\n        const original = error.cause ?? error;\n\n        const next = sanitizeError(original);\n        const status = httpStatusFromCode(next.code);\n\n        const payload = serializeError(next);\n\n        if (status >= 500) {\n            if (options.logger) {\n                // The ORIGINAL error, never the sanitized copy. Sanitizing\n                // discards the transport reason and the upstream response\n                // body on purpose, and those are the only things that make\n                // an outbound failure diagnosable.\n                options.logger.error(describeError(original));\n            }\n            payload.message = 'An internal server error occurred.';\n        }\n\n        // RFC 6750 §3: a 401 from a protected resource carries the Bearer\n        // challenge, which nothing here emitted. Gated on the request actually\n        // being one - the token endpoint answers 401 for a bad client secret\n        // (RFC 6749 §5.2) and that is not a bearer failure, so it must not be\n        // stamped.\n        if (status === 401) {\n            const authorization = event.headers.get('authorization');\n\n            if (typeof authorization === 'string' && authorization.toLowerCase().startsWith('bearer ')) {\n                // RFC 6750 §3 defines the value as a quoted-string over\n                // `%x20-21 / %x23-5B / %x5D-7E`, so everything outside that set\n                // goes: a quote or a backslash would break out of the\n                // quoting, and a control character (a CR or LF in a\n                // third-party JWT library's\n                // message, which `JWTError.payloadInvalid` forwards verbatim)\n                // makes the header assignment itself throw, turning a 401\n                // into a 500.\n                const description = String(payload.message ?? '')\n                    .replace(/[^\\x20-\\x21\\x23-\\x5B\\x5D-\\x7E]/g, '');\n                const code = isJWTErrorCode(next.code) ? 'invalid_token' : 'invalid_request';\n\n                event.response.headers.set(\n                    'www-authenticate',\n                    `Bearer error=\"${code}\", error_description=\"${description}\"`,\n                );\n            } else if (!authorization && next.code === ErrorCode.IDENTITY_UNAUTHORIZED) {\n                // §3 again: a request that presented no credentials at all gets\n                // the bare challenge, with no error code to report.\n                event.response.headers.set('www-authenticate', 'Bearer');\n            }\n        }\n\n        event.response.status = status;\n        return payload;\n    }));\n}\n"],"mappings":";;;;;;;;;AAkBA,SAAgBO,wBAAwBC,QAAaC,UAAkC,CAAC,GAAC;CACrFD,OAAOE,IAAIV,oBAAoBW,OAAOC,UAAAA;EAGlC,MAAMC,WAAWF,MAAMG,SAASH;EAEhC,MAAMI,OAAOT,cAAcO,QAAAA;EAC3B,MAAMG,SAASd,mBAAmBa,KAAKE,IAAI;EAE3C,MAAMC,UAAUf,eAAeY,IAAAA;EAE/B,IAAIC,UAAU,KAAK;GACf,IAAIP,QAAQU,QAKRV,QAAQU,OAAOR,MAAMN,cAAcQ,QAAAA,CAAAA;GAEvCK,QAAQE,UAAU;EACtB;EAOA,IAAIJ,WAAW,KAAK;GAChB,MAAMK,gBAAgBT,MAAMU,QAAQC,IAAI,eAAA;GAExC,IAAI,OAAOF,kBAAkB,YAAYA,cAAcG,YAAW,CAAA,CAAGC,WAAW,SAAA,GAAY;IASxF,MAAMC,cAAcC,OAAOT,QAAQE,WAAW,EAAA,CAAA,CACzCQ,QAAQ,mCAAmC,EAAA;IAChD,MAAMX,OAAOb,eAAeW,KAAKE,IAAI,IAAI,kBAAkB;IAE3DL,MAAMiB,SAASP,QAAQQ,IACnB,oBACA,iBAAiBb,KAAK,wBAAwBS,YAAY,EAAE;GAEpE,OAAO,IAAI,CAACL,iBAAiBN,KAAKE,SAAShB,UAAU8B,uBAGjDnB,MAAMiB,SAASP,QAAQQ,IAAI,oBAAoB,QAAA;EAEvD;EAEAlB,MAAMiB,SAASb,SAASA;EACxB,OAAOE;CACX,CAAA,CAAA;AACJ"}
+{"version":3,"file":"error.mjs","names":["defineErrorHandler","ErrorCode","httpStatusFromCode","serializeError","isJWTErrorCode","describeError","sanitizeError","registerErrorMiddleware","router","options","use","error","event","original","cause","next","status","code","payload","logger","message","authorization","headers","get","toLowerCase","startsWith","description","String","replace","response","set","IDENTITY_UNAUTHORIZED"],"sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IApp } from 'routup';\nimport { defineErrorHandler } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { ErrorCode, httpStatusFromCode, serializeError } from '@authup/errors';\nimport { isJWTErrorCode } from '@authup/specs';\nimport { describeError, sanitizeError } from '../../../../utils/index.ts';\n\ntype ErrorMiddlewareOptions = {\n    logger?: Logger\n};\n\nexport function registerErrorMiddleware(router: IApp, options: ErrorMiddlewareOptions = {}) {\n    router.use(defineErrorHandler((error, event) => {\n        // routup wraps whatever a handler threw into an AppError carrying it\n        // as `cause`, so this is the error as it was actually raised.\n        const original = error.cause ?? error;\n\n        const next = sanitizeError(original);\n        const status = httpStatusFromCode(next.code);\n\n        const payload = serializeError(next);\n\n        if (status >= 500) {\n            if (options.logger) {\n                // The ORIGINAL error, never the sanitized copy. Sanitizing\n                // discards the transport reason and the upstream response\n                // body on purpose, and those are the only things that make\n                // an outbound failure diagnosable.\n                options.logger.error(describeError(original));\n            }\n            payload.message = 'An internal server error occurred.';\n        }\n\n        // RFC 6750 §3: a 401 from a protected resource carries the Bearer\n        // challenge, which nothing here emitted. Gated on the request actually\n        // being one - the token endpoint answers 401 for a bad client secret\n        // (RFC 6749 §5.2) and that is not a bearer failure, so it must not be\n        // stamped.\n        if (status === 401) {\n            const authorization = event.headers.get('authorization');\n\n            if (typeof authorization === 'string' && authorization.toLowerCase().startsWith('bearer ')) {\n                // RFC 6750 §3 defines the value as a quoted-string over\n                // `%x20-21 / %x23-5B / %x5D-7E`, so everything outside that set\n                // goes: a quote or a backslash would break out of the\n                // quoting, and a control character (a CR or LF in a\n                // third-party JWT library's\n                // message, which `JWTError.payloadInvalid` forwards verbatim)\n                // makes the header assignment itself throw, turning a 401\n                // into a 500.\n                const description = String(payload.message ?? '')\n                    .replace(/[^\\x20-\\x21\\x23-\\x5B\\x5D-\\x7E]/g, '');\n                const code = isJWTErrorCode(next.code) ? 'invalid_token' : 'invalid_request';\n\n                event.response.headers.set(\n                    'www-authenticate',\n                    `Bearer error=\"${code}\", error_description=\"${description}\"`,\n                );\n            } else if (!authorization && next.code === ErrorCode.IDENTITY_UNAUTHORIZED) {\n                // §3 again: a request that presented no credentials at all gets\n                // the bare challenge, with no error code to report.\n                event.response.headers.set('www-authenticate', 'Bearer');\n            }\n        }\n\n        event.response.status = status;\n        return payload;\n    }));\n}\n"],"mappings":";;;;;;;;;AAkBA,SAAgBO,wBAAwBC,QAAcC,UAAkC,CAAC,GAAC;CACtFD,OAAOE,IAAIV,oBAAoBW,OAAOC,UAAAA;EAGlC,MAAMC,WAAWF,MAAMG,SAASH;EAEhC,MAAMI,OAAOT,cAAcO,QAAAA;EAC3B,MAAMG,SAASd,mBAAmBa,KAAKE,IAAI;EAE3C,MAAMC,UAAUf,eAAeY,IAAAA;EAE/B,IAAIC,UAAU,KAAK;GACf,IAAIP,QAAQU,QAKRV,QAAQU,OAAOR,MAAMN,cAAcQ,QAAAA,CAAAA;GAEvCK,QAAQE,UAAU;EACtB;EAOA,IAAIJ,WAAW,KAAK;GAChB,MAAMK,gBAAgBT,MAAMU,QAAQC,IAAI,eAAA;GAExC,IAAI,OAAOF,kBAAkB,YAAYA,cAAcG,YAAW,CAAA,CAAGC,WAAW,SAAA,GAAY;IASxF,MAAMC,cAAcC,OAAOT,QAAQE,WAAW,EAAA,CAAA,CACzCQ,QAAQ,mCAAmC,EAAA;IAChD,MAAMX,OAAOb,eAAeW,KAAKE,IAAI,IAAI,kBAAkB;IAE3DL,MAAMiB,SAASP,QAAQQ,IACnB,oBACA,iBAAiBb,KAAK,wBAAwBS,YAAY,EAAE;GAEpE,OAAO,IAAI,CAACL,iBAAiBN,KAAKE,SAAShB,UAAU8B,uBAGjDnB,MAAMiB,SAASP,QAAQQ,IAAI,oBAAoB,QAAA;EAEvD;EAEAlB,MAAMiB,SAASb,SAASA;EACxB,OAAOE;CACX,CAAA,CAAA;AACJ"}

package/dist/adapters/http/middleware/built-in/index.d.ts

@@ -1,7 +1,6 @@
 export * from './authorization/index.ts';
 export * from './loggedin/index.ts';
 export * from './realm-resolver/index.ts';
-export * from './assets.ts';
 export * from './basic.ts';
 export * from './cors.ts';
 export * from './error.ts';
@@ -9,7 +8,5 @@ export * from './logger.ts';
 export * from './prometheus.ts';
 export * from './rate-limit.ts';
 export * from './swagger.ts';
-export * from './theme.ts';
-export * from './types.ts';
-export * from './ui-http-client.ts';
+export * from './internal-http-client.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/middleware/built-in/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAE1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAE1C,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,2BAA2B,CAAC"}

package/dist/adapters/http/middleware/built-in/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { OAUTH2_ISSUANCE_PATHS, isOAuth2IssuancePath, normalizeRequestPath } from "./authorization/issuance.mjs";
 import { AuthorizationMiddleware } from "./authorization/module.mjs";
 import { createAuthorizationMiddleware } from "./authorization/factory.mjs";
 import "./authorization/index.mjs";
@@ -10,8 +11,6 @@ import "./loggedin/index.mjs";
 import { RealmResolverMiddleware } from "./realm-resolver/module.mjs";
 import { createRealmResolverMiddleware } from "./realm-resolver/factory.mjs";
 import "./realm-resolver/index.mjs";
-import { THEME_STORE_KEY, registerThemeMiddleware, useRequestTheme } from "./theme.mjs";
-import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./assets.mjs";
 import { registerBasicMiddleware } from "./basic.mjs";
 import { registerCorsMiddleware } from "./cors.mjs";
 import { registerErrorMiddleware } from "./error.mjs";
@@ -19,5 +18,5 @@ import { createLoggerMiddleware, redactSensitiveURLParams } from "./logger.mjs";
 import { createRouteTemplateNormalizePath, registerPrometheusMiddleware } from "./prometheus.mjs";
 import { registerRateLimitMiddleware } from "./rate-limit.mjs";
 import { createSwaggerMiddleware } from "./swagger.mjs";
-import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./ui-http-client.mjs";
-export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, THEME_STORE_KEY, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, useRequestTheme };
+import { INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY, registerInternalHttpClientMiddleware } from "./internal-http-client.mjs";
+export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY, OAUTH2_ISSUANCE_PATHS, RealmResolverMiddleware, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, isOAuth2IssuancePath, normalizeRequestPath, redactSensitiveURLParams, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerInternalHttpClientMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware };

package/dist/adapters/http/middleware/built-in/internal-http-client.d.ts

@@ -0,0 +1,17 @@
+import type { IClient } from '@authup/core-http-kit';
+import type { IApp } from 'routup';
+/**
+ * Per-request handoff of an HTTP-client factory to the routes that call this
+ * server's own API. Since the consoles left, that is the console login's
+ * token exchange alone.
+ *
+ * The wiring passes a thunk over the DI container
+ * (`() => container.resolve(InternalHttpClient)`) whose registration carries
+ * `lifetime: 'transient'`, so every request resolves a fresh client. Never
+ * share one instance: the authentication hook writes per-user state onto it.
+ * Production binds the internal loopback client by default
+ * (`HTTPModule.registerInternalHttpClient`); tests may pre-register a fake.
+ */
+export declare const INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY: unique symbol;
+export declare function registerInternalHttpClientMiddleware(router: IApp, httpClientFactory: () => IClient): void;
+//# sourceMappingURL=internal-http-client.d.ts.map

package/dist/adapters/http/middleware/built-in/internal-http-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-http-client.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/internal-http-client.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAGnC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sCAAsC,eAAsC,CAAC;AAE1F,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,OAAO,QAKlG"}

package/dist/adapters/http/middleware/built-in/internal-http-client.mjs

@@ -0,0 +1,27 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { defineCoreHandler } from "routup";
+//#region src/adapters/http/middleware/built-in/internal-http-client.ts
+/**
+* Per-request handoff of an HTTP-client factory to the routes that call this
+* server's own API. Since the consoles left, that is the console login's
+* token exchange alone.
+*
+* The wiring passes a thunk over the DI container
+* (`() => container.resolve(InternalHttpClient)`) whose registration carries
+* `lifetime: 'transient'`, so every request resolves a fresh client. Never
+* share one instance: the authentication hook writes per-user state onto it.
+* Production binds the internal loopback client by default
+* (`HTTPModule.registerInternalHttpClient`); tests may pre-register a fake.
+*/ const INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY = Symbol("InternalHttpClientFactory");
+function registerInternalHttpClientMiddleware(router, httpClientFactory) {
+	router.use(defineCoreHandler((event) => {
+		event.store[INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY] = httpClientFactory;
+		return event.next();
+	}));
+}
+//#endregion
+export { INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY, registerInternalHttpClientMiddleware };
+
+//# sourceMappingURL=internal-http-client.mjs.map

package/dist/adapters/http/middleware/built-in/internal-http-client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-http-client.mjs","names":["defineCoreHandler","INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY","Symbol","registerInternalHttpClientMiddleware","router","httpClientFactory","use","event","store","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/internal-http-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IClient } from '@authup/core-http-kit';\nimport type { IApp } from 'routup';\nimport { defineCoreHandler } from 'routup';\n\n/**\n * Per-request handoff of an HTTP-client factory to the routes that call this\n * server's own API. Since the consoles left, that is the console login's\n * token exchange alone.\n *\n * The wiring passes a thunk over the DI container\n * (`() => container.resolve(InternalHttpClient)`) whose registration carries\n * `lifetime: 'transient'`, so every request resolves a fresh client. Never\n * share one instance: the authentication hook writes per-user state onto it.\n * Production binds the internal loopback client by default\n * (`HTTPModule.registerInternalHttpClient`); tests may pre-register a fake.\n */\nexport const INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY = Symbol('InternalHttpClientFactory');\n\nexport function registerInternalHttpClientMiddleware(router: IApp, httpClientFactory: () => IClient) {\n    router.use(defineCoreHandler((event) => {\n        event.store[INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY] = httpClientFactory;\n        return event.next();\n    }));\n}\n"],"mappings":";;;;;;;;;;;;;;;;GAuBA,MAAaC,yCAAyCC,OAAO,2BAAA;AAE7D,SAAgBC,qCAAqCC,QAAcC,mBAAgC;CAC/FD,OAAOE,IAAIN,mBAAmBO,UAAAA;EAC1BA,MAAMC,MAAMP,0CAA0CI;EACtD,OAAOE,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}

package/dist/adapters/http/middleware/built-in/logger.mjs

@@ -42,7 +42,7 @@ function createLoggerMiddleware(options) {
 		},
 		skip(event, response) {
 			const path = event.path || "";
-			if (path.length === 0 || path === "/") return true;
+			if (path === "/" || path.length === 0) return true;
 			if (options.env === EnvironmentName.PRODUCTION) return (response?.status ?? 0) < 400;
 			return false;
 		}

package/dist/adapters/http/middleware/built-in/logger.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"logger.mjs","names":["logger","getRequestIP","EnvironmentName","SENSITIVE_QUERY_PARAMS","redactSensitiveURLParams","url","queryIndex","indexOf","params","URLSearchParams","substring","redacted","name","has","set","toString","createLoggerMiddleware","options","format","tokens","event","response","method","status","join","write","line","env","TEST","http","skip","path","length","PRODUCTION"],"sources":["../../../../../src/adapters/http/middleware/built-in/logger.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { logger } from '@routup/logger';\nimport type { Handler } from 'routup';\nimport { getRequestIP } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { EnvironmentName } from '@authup/kit';\n\ntype LoggerMiddlewareOptions = {\n    env: string,\n    logger: Logger\n};\n\n// Query params whose values are credentials/tokens — the access log must never\n// persist them (a GET /logout?id_token_hint=<jwt> would otherwise write a\n// signature-valid token into the log).\nconst SENSITIVE_QUERY_PARAMS = [\n    'id_token_hint',\n    'id_token',\n    'access_token',\n    'refresh_token',\n    'token',\n    'code',\n    'client_secret',\n];\n\nexport function redactSensitiveURLParams(url: string): string {\n    const queryIndex = url.indexOf('?');\n    if (queryIndex === -1) {\n        return url;\n    }\n\n    const params = new URLSearchParams(url.substring(queryIndex + 1));\n    let redacted = false;\n    for (const name of SENSITIVE_QUERY_PARAMS) {\n        if (params.has(name)) {\n            params.set(name, '***');\n            redacted = true;\n        }\n    }\n\n    if (!redacted) {\n        return url;\n    }\n\n    return `${url.substring(0, queryIndex)}?${params.toString()}`;\n}\n\nexport function createLoggerMiddleware(options: LoggerMiddlewareOptions) : Handler {\n    return logger({\n        format: (tokens, event, response) => [\n            getRequestIP(event) || '-',\n            '-',\n            tokens.method(event, response) ?? '-',\n            redactSensitiveURLParams(tokens.url(event, response) ?? '-'),\n            tokens.status(event, response) ?? '-',\n            '-',\n            tokens['response-time'](event, response) ?? '-',\n        ].join(' '),\n        write(line) {\n            if (options.env !== EnvironmentName.TEST) {\n                options.logger.http(line);\n            }\n        },\n        skip(event, response): boolean {\n            const path = event.path || '';\n            if (path.length === 0 || path === '/') {\n                return true;\n            }\n\n            if (options.env === EnvironmentName.PRODUCTION) {\n                return (response?.status ?? 0) < 400;\n            }\n\n            return false;\n        },\n    });\n}\n"],"mappings":";;;;;;;AAqBA,MAAMG,yBAAyB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;AACH;AAED,SAAgBC,yBAAyBC,KAAW;CAChD,MAAMC,aAAaD,IAAIE,QAAQ,GAAA;CAC/B,IAAID,eAAe,IACf,OAAOD;CAGX,MAAMG,SAAS,IAAIC,gBAAgBJ,IAAIK,UAAUJ,aAAa,CAAA,CAAA;CAC9D,IAAIK,WAAW;CACf,KAAK,MAAMC,QAAQT,wBACf,IAAIK,OAAOK,IAAID,IAAAA,GAAO;EAClBJ,OAAOM,IAAIF,MAAM,KAAA;EACjBD,WAAW;CACf;CAGJ,IAAI,CAACA,UACD,OAAON;CAGX,OAAO,GAAGA,IAAIK,UAAU,GAAGJ,UAAAA,EAAY,GAAGE,OAAOO,SAAQ;AAC7D;AAEA,SAAgBC,uBAAuBC,SAAgC;CACnE,OAAOjB,OAAO;EACVkB,SAASC,QAAQC,OAAOC,aAAa;GACjCpB,aAAamB,KAAAA,KAAU;GACvB;GACAD,OAAOG,OAAOF,OAAOC,QAAAA,KAAa;GAClCjB,yBAAyBe,OAAOd,IAAIe,OAAOC,QAAAA,KAAa,GAAA;GACxDF,OAAOI,OAAOH,OAAOC,QAAAA,KAAa;GAClC;GACAF,OAAO,gBAAgB,CAACC,OAAOC,QAAAA,KAAa;EAC/C,CAAA,CAACG,KAAK,GAAA;EACPC,MAAMC,MAAI;GACN,IAAIT,QAAQU,QAAQzB,gBAAgB0B,MAChCX,QAAQjB,OAAO6B,KAAKH,IAAAA;EAE5B;EACAI,KAAKV,OAAOC,UAAQ;GAChB,MAAMU,OAAOX,MAAMW,QAAQ;GAC3B,IAAIA,KAAKC,WAAW,KAAKD,SAAS,KAC9B,OAAO;GAGX,IAAId,QAAQU,QAAQzB,gBAAgB+B,YAChC,QAAQZ,UAAUE,UAAU,KAAK;GAGrC,OAAO;EACX;CACJ,CAAA;AACJ"}
+{"version":3,"file":"logger.mjs","names":["logger","getRequestIP","EnvironmentName","SENSITIVE_QUERY_PARAMS","redactSensitiveURLParams","url","queryIndex","indexOf","params","URLSearchParams","substring","redacted","name","has","set","toString","createLoggerMiddleware","options","format","tokens","event","response","method","status","join","write","line","env","TEST","http","skip","path","length","PRODUCTION"],"sources":["../../../../../src/adapters/http/middleware/built-in/logger.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { logger } from '@routup/logger';\nimport type { Handler } from 'routup';\nimport { getRequestIP } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { EnvironmentName } from '@authup/kit';\n\ntype LoggerMiddlewareOptions = {\n    env: string,\n    logger: Logger\n};\n\n// Query params whose values are credentials/tokens — the access log must never\n// persist them (a GET /logout?id_token_hint=<jwt> would otherwise write a\n// signature-valid token into the log).\nconst SENSITIVE_QUERY_PARAMS = [\n    'id_token_hint',\n    'id_token',\n    'access_token',\n    'refresh_token',\n    'token',\n    'code',\n    'client_secret',\n];\n\nexport function redactSensitiveURLParams(url: string): string {\n    const queryIndex = url.indexOf('?');\n    if (queryIndex === -1) {\n        return url;\n    }\n\n    const params = new URLSearchParams(url.substring(queryIndex + 1));\n    let redacted = false;\n    for (const name of SENSITIVE_QUERY_PARAMS) {\n        if (params.has(name)) {\n            params.set(name, '***');\n            redacted = true;\n        }\n    }\n\n    if (!redacted) {\n        return url;\n    }\n\n    return `${url.substring(0, queryIndex)}?${params.toString()}`;\n}\n\nexport function createLoggerMiddleware(options: LoggerMiddlewareOptions) : Handler {\n    return logger({\n        format: (tokens, event, response) => [\n            getRequestIP(event) || '-',\n            '-',\n            tokens.method(event, response) ?? '-',\n            redactSensitiveURLParams(tokens.url(event, response) ?? '-'),\n            tokens.status(event, response) ?? '-',\n            '-',\n            tokens['response-time'](event, response) ?? '-',\n        ].join(' '),\n        write(line) {\n            if (options.env !== EnvironmentName.TEST) {\n                options.logger.http(line);\n            }\n        },\n        skip(event, response): boolean {\n            const path = event.path || '';\n            if (path === '/' || path.length === 0) {\n                return true;\n            }\n\n            if (options.env === EnvironmentName.PRODUCTION) {\n                return (response?.status ?? 0) < 400;\n            }\n\n            return false;\n        },\n    });\n}\n"],"mappings":";;;;;;;AAqBA,MAAMG,yBAAyB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;AACH;AAED,SAAgBC,yBAAyBC,KAAW;CAChD,MAAMC,aAAaD,IAAIE,QAAQ,GAAA;CAC/B,IAAID,eAAe,IACf,OAAOD;CAGX,MAAMG,SAAS,IAAIC,gBAAgBJ,IAAIK,UAAUJ,aAAa,CAAA,CAAA;CAC9D,IAAIK,WAAW;CACf,KAAK,MAAMC,QAAQT,wBACf,IAAIK,OAAOK,IAAID,IAAAA,GAAO;EAClBJ,OAAOM,IAAIF,MAAM,KAAA;EACjBD,WAAW;CACf;CAGJ,IAAI,CAACA,UACD,OAAON;CAGX,OAAO,GAAGA,IAAIK,UAAU,GAAGJ,UAAAA,EAAY,GAAGE,OAAOO,SAAQ;AAC7D;AAEA,SAAgBC,uBAAuBC,SAAgC;CACnE,OAAOjB,OAAO;EACVkB,SAASC,QAAQC,OAAOC,aAAa;GACjCpB,aAAamB,KAAAA,KAAU;GACvB;GACAD,OAAOG,OAAOF,OAAOC,QAAAA,KAAa;GAClCjB,yBAAyBe,OAAOd,IAAIe,OAAOC,QAAAA,KAAa,GAAA;GACxDF,OAAOI,OAAOH,OAAOC,QAAAA,KAAa;GAClC;GACAF,OAAO,gBAAgB,CAACC,OAAOC,QAAAA,KAAa;EAC/C,CAAA,CAACG,KAAK,GAAA;EACPC,MAAMC,MAAI;GACN,IAAIT,QAAQU,QAAQzB,gBAAgB0B,MAChCX,QAAQjB,OAAO6B,KAAKH,IAAAA;EAE5B;EACAI,KAAKV,OAAOC,UAAQ;GAChB,MAAMU,OAAOX,MAAMW,QAAQ;GAC3B,IAAIA,SAAS,OAAOA,KAAKC,WAAW,GAChC,OAAO;GAGX,IAAIf,QAAQU,QAAQzB,gBAAgB+B,YAChC,QAAQZ,UAAUE,UAAU,KAAK;GAGrC,OAAO;EACX;CACJ,CAAA;AACJ"}

package/dist/adapters/http/middleware/built-in/prometheus.d.ts

@@ -1,5 +1,5 @@
 import type { OptionsInput } from '@routup/prometheus';
-import type { App, IAppEvent } from 'routup';
+import type { IApp, IAppEvent } from 'routup';
 /**
  * The `path` label must stay bounded: labeling by the raw request path lets
  * every probed id (`/users/<random-uuid>`, even on 401/404) mint a new
@@ -7,9 +7,10 @@ import type { App, IAppEvent } from 'routup';
  * labeled by the registered route template (`/users/:id`), read from the
  * router's own route table (child apps are flattened into the root with full
  * patterns, and all routes are registered before `listen`, so a snapshot at
- * first request is complete). Method-agnostic mounts (`/docs`, `/public`)
- * label as `<mount>/**`; anything else collapses into one unmatched bucket.
+ * first request is complete). Method-agnostic mounts (`/docs`,
+ * `/console/auth/assets`) label as `<mount>/**`; anything else collapses into
+ * one unmatched bucket.
  */
-export declare function createRouteTemplateNormalizePath(router: App): (path: string, event: IAppEvent) => string;
-export declare function registerPrometheusMiddleware(router: App, input?: OptionsInput): void;
+export declare function createRouteTemplateNormalizePath(router: IApp): (path: string, event: IAppEvent) => string;
+export declare function registerPrometheusMiddleware(router: IApp, input?: OptionsInput): void;
 //# sourceMappingURL=prometheus.d.ts.map

package/dist/adapters/http/middleware/built-in/prometheus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prometheus.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/prometheus.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAmF7C;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC5C,MAAM,EAAE,GAAG,GACZ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,KAAK,MAAM,CAsC5C;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,QAsB7E"}
+{"version":3,"file":"prometheus.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/prometheus.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAmF9C;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAC5C,MAAM,EAAE,IAAI,GACb,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,KAAK,MAAM,CAsC5C;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,YAAY,QAsB9E"}