@_mustachio/openauth 0.10.0 → 0.12.0

package/dist/esm/adapters/d1/index.js

@@ -1,12 +1,21 @@
+// src/adapters/d1/index.ts
+import { D1AuditLog } from "./audit-log";
+import { D1ConfigStore } from "./config-store";
+import { D1KeyStore } from "./key-store";
+import { D1MethodStore } from "./method-store";
+import { D1SessionStore } from "./session-store";
+import { D1TokenStore } from "./token-store";
+import { INITIAL_SCHEMA_SQL, migrate } from "./migrations";
+import { isSessionsCapable, primarySession } from "./session";
 export {
-  primarySession,
-  migrate,
-  isSessionsCapable,
-  INITIAL_SCHEMA_SQL,
-  D1TokenStore,
-  D1SessionStore,
-  D1MethodStore,
-  D1KeyStore,
+  D1AuditLog,
   D1ConfigStore,
-  D1AuditLog
+  D1KeyStore,
+  D1MethodStore,
+  D1SessionStore,
+  D1TokenStore,
+  INITIAL_SCHEMA_SQL,
+  isSessionsCapable,
+  migrate,
+  primarySession
 };

package/dist/esm/adapters/d1/migrations.js

@@ -57,6 +57,11 @@ var INITIAL_SCHEMA_SQL = [
     payload TEXT NOT NULL,
     expires_at INTEGER NOT NULL
   )`,
+  `CREATE TABLE IF NOT EXISTS openauth_scratch (
+    scratch_key TEXT PRIMARY KEY,
+    value TEXT NOT NULL,
+    expires_at INTEGER NOT NULL
+  )`,
   `CREATE TABLE IF NOT EXISTS openauth_audit_events (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     ts INTEGER NOT NULL,
@@ -72,6 +77,6 @@ async function migrate(db) {
   }
 }
 export {
-  migrate,
-  INITIAL_SCHEMA_SQL
+  INITIAL_SCHEMA_SQL,
+  migrate
 };

package/dist/esm/adapters/d1/session-store.js

@@ -128,6 +128,45 @@ class D1SessionStore {
     }
     return ok(undefined);
   }
+  async saveScratch(key, value, ttlMs) {
+    if (ttlMs <= 0) {
+      return err(authError.internalError(`saveScratch: ttlMs must be positive, got ${ttlMs}`));
+    }
+    const expiresAt = this.#clock() + ttlMs;
+    try {
+      await primarySession(this.#db).prepare(`INSERT INTO openauth_scratch (scratch_key, value, expires_at) VALUES (?1, ?2, ?3)
+           ON CONFLICT(scratch_key) DO UPDATE SET value = excluded.value, expires_at = excluded.expires_at`).bind(key, value, expiresAt).run();
+    } catch (e) {
+      return err(authError.internalError("saveScratch: upsert failed", e));
+    }
+    return ok(undefined);
+  }
+  async readScratch(key) {
+    let row;
+    try {
+      row = await primarySession(this.#db).prepare(`SELECT value, expires_at FROM openauth_scratch WHERE scratch_key = ?1`).bind(key).first();
+    } catch (e) {
+      return err(authError.internalError("readScratch: query failed", e));
+    }
+    if (!row) {
+      return err(authError.unknownState(`scratch "${key}" unknown`));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      try {
+        await primarySession(this.#db).prepare(`DELETE FROM openauth_scratch WHERE scratch_key = ?1`).bind(key).run();
+      } catch {}
+      return err(authError.unknownState(`scratch "${key}" expired`));
+    }
+    return ok(row.value);
+  }
+  async deleteScratch(key) {
+    try {
+      await primarySession(this.#db).prepare(`DELETE FROM openauth_scratch WHERE scratch_key = ?1`).bind(key).run();
+    } catch (e) {
+      return err(authError.internalError("deleteScratch: delete failed", e));
+    }
+    return ok(undefined);
+  }
 }
 export {
   D1SessionStore

package/dist/esm/adapters/d1/session.js

@@ -13,6 +13,6 @@ function primarySession(db) {
   };
 }
 export {
-  primarySession,
-  isSessionsCapable
+  isSessionsCapable,
+  primarySession
 };

package/dist/esm/adapters/durable-object/index.js

@@ -1,3 +1,7 @@
+// src/adapters/durable-object/index.ts
+import {
+  DurableObjectSessionStore
+} from "./session-store";
 export {
   DurableObjectSessionStore
 };

package/dist/esm/adapters/durable-object/session-store.js

@@ -131,9 +131,51 @@ class DurableObjectSessionStore {
     }
     return ok(undefined);
   }
+  async saveScratch(key, value, ttlMs) {
+    if (ttlMs <= 0) {
+      return err(authError.internalError(`saveScratch: ttlMs must be positive, got ${ttlMs}`));
+    }
+    const stored = {
+      value,
+      expiresAt: this.#clock() + ttlMs
+    };
+    try {
+      await this.#storage.put(scratchKey(key), stored);
+    } catch (e) {
+      return err(authError.internalError("saveScratch: put failed", e));
+    }
+    return ok(undefined);
+  }
+  async readScratch(key) {
+    let stored;
+    try {
+      stored = await this.#storage.get(scratchKey(key));
+    } catch (e) {
+      return err(authError.internalError("readScratch: get failed", e));
+    }
+    if (!stored) {
+      return err(authError.unknownState(`scratch "${key}" unknown`));
+    }
+    if (this.#clock() >= stored.expiresAt) {
+      try {
+        await this.#storage.delete(scratchKey(key));
+      } catch {}
+      return err(authError.unknownState(`scratch "${key}" expired`));
+    }
+    return ok(stored.value);
+  }
+  async deleteScratch(key) {
+    try {
+      await this.#storage.delete(scratchKey(key));
+    } catch (e) {
+      return err(authError.internalError("deleteScratch: delete failed", e));
+    }
+    return ok(undefined);
+  }
 }
 var flowKey = (flowId) => `flow:${flowId}`;
 var sessionKey = (sessionId) => `session:${sessionId}`;
+var scratchKey = (key) => `scratch:${key}`;
 export {
   DurableObjectSessionStore
 };

package/dist/esm/adapters/dynamo/index.js

@@ -1,10 +1,27 @@
+// src/adapters/dynamo/index.ts
+import { DynamoAuditLog } from "./audit-log";
+import {
+  DynamoConfigStore
+} from "./config-store";
+import { DynamoKeyStore } from "./key-store";
+import {
+  DynamoMethodStore
+} from "./method-store";
+import {
+  DynamoSessionStore
+} from "./session-store";
+import { DynamoTokenStore } from "./token-store";
+import {
+  DynamoPasskeyCredentialStore
+} from "./passkey-credential-store";
+import { fromDynamoDBClient } from "./sdk";
 export {
-  fromDynamoDBClient,
-  DynamoTokenStore,
-  DynamoSessionStore,
-  DynamoPasskeyCredentialStore,
-  DynamoMethodStore,
-  DynamoKeyStore,
+  DynamoAuditLog,
   DynamoConfigStore,
-  DynamoAuditLog
+  DynamoKeyStore,
+  DynamoMethodStore,
+  DynamoPasskeyCredentialStore,
+  DynamoSessionStore,
+  DynamoTokenStore,
+  fromDynamoDBClient
 };

package/dist/esm/adapters/dynamo/session-store.js

@@ -152,6 +152,55 @@ class DynamoSessionStore {
     }
     return ok(undefined);
   }
+  async saveScratch(key, value, ttlMs) {
+    if (ttlMs <= 0) {
+      return err(authError.internalError(`saveScratch: ttlMs must be positive, got ${ttlMs}`));
+    }
+    const expiresAtMs = this.#clock() + ttlMs;
+    try {
+      await this.#exec.put({
+        item: {
+          pk: "scratch",
+          sk: key,
+          value,
+          expires_at: expiresAtMs,
+          ttl: Math.floor(expiresAtMs / 1000)
+        }
+      });
+    } catch (e) {
+      return err(authError.internalError("saveScratch: put failed", e));
+    }
+    return ok(undefined);
+  }
+  async readScratch(key) {
+    let row;
+    try {
+      row = await this.#exec.get({
+        key: { pk: "scratch", sk: key },
+        consistentRead: true
+      });
+    } catch (e) {
+      return err(authError.internalError("readScratch: get failed", e));
+    }
+    if (!row) {
+      return err(authError.unknownState(`scratch "${key}" unknown`));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      try {
+        await this.#exec.delete({ key: { pk: "scratch", sk: key } });
+      } catch {}
+      return err(authError.unknownState(`scratch "${key}" expired`));
+    }
+    return ok(String(row.value));
+  }
+  async deleteScratch(key) {
+    try {
+      await this.#exec.delete({ key: { pk: "scratch", sk: key } });
+    } catch (e) {
+      return err(authError.internalError("deleteScratch: delete failed", e));
+    }
+    return ok(undefined);
+  }
 }
 function parseFlowPayload(raw) {
   if (typeof raw === "string")

package/dist/esm/adapters/kms/index.js

@@ -1,5 +1,9 @@
+// src/adapters/kms/index.ts
+import { inMemoryKmsBackingStore } from "./in-memory-backing";
+import { KmsKeyStore } from "./key-store";
+import { fromKmsClient } from "./sdk";
 export {
-  inMemoryKmsBackingStore,
+  KmsKeyStore,
   fromKmsClient,
-  KmsKeyStore
+  inMemoryKmsBackingStore
 };

package/dist/esm/adapters/kv/index.js

@@ -1,5 +1,9 @@
+// src/adapters/kv/index.ts
+import { KvAuditLog } from "./audit-log";
+import { KvConfigStore } from "./config-store";
+import { KvMethodStore } from "./method-store";
 export {
-  KvMethodStore,
+  KvAuditLog,
   KvConfigStore,
-  KvAuditLog
+  KvMethodStore
 };

package/dist/esm/adapters/memory/index.js

@@ -1,10 +1,27 @@
+// src/adapters/memory/index.ts
+import { MemoryAuditLog } from "./audit-log";
+import {
+  MemoryConfigStore
+} from "./config-store";
+import { MemoryKeyStore } from "./key-store";
+import {
+  MemoryMethodStore
+} from "./method-store";
+import {
+  MemorySessionStore
+} from "./session-store";
+import { MemoryTokenStore } from "./token-store";
+import {
+  MemoryPasskeyCredentialStore
+} from "./passkey-credential-store";
+import { realClock } from "./clock";
 export {
-  realClock,
-  MemoryTokenStore,
-  MemorySessionStore,
-  MemoryPasskeyCredentialStore,
-  MemoryMethodStore,
-  MemoryKeyStore,
+  MemoryAuditLog,
   MemoryConfigStore,
-  MemoryAuditLog
+  MemoryKeyStore,
+  MemoryMethodStore,
+  MemoryPasskeyCredentialStore,
+  MemorySessionStore,
+  MemoryTokenStore,
+  realClock
 };

package/dist/esm/adapters/memory/session-store.js

@@ -7,6 +7,8 @@ class MemorySessionStore {
   #clock;
   #flows = new Map;
   #sessions = new Map;
+  #par = new Map;
+  #scratch = new Map;
   constructor(opts = {}) {
     this.#clock = opts.clock ?? realClock;
   }
@@ -76,6 +78,49 @@ class MemorySessionStore {
     this.#sessions.delete(sessionId);
     return ok(undefined);
   }
+  async savePar(requestUri, payload, ttl) {
+    if (ttl <= 0) {
+      return err(authError.internalError(`savePar: ttl must be positive, got ${ttl}`));
+    }
+    this.#par.set(requestUri, {
+      record: payload,
+      expiresAt: this.#clock() + ttl
+    });
+    return ok(undefined);
+  }
+  async consumePar(requestUri) {
+    const stored = this.#par.get(requestUri);
+    if (!stored) {
+      return err(authError.unknownState(`par "${requestUri}" unknown or already consumed`));
+    }
+    this.#par.delete(requestUri);
+    if (this.#clock() >= stored.expiresAt) {
+      return err(authError.unknownState(`par "${requestUri}" expired`));
+    }
+    return ok(stored.record);
+  }
+  async saveScratch(key, value, ttlMs) {
+    if (ttlMs <= 0) {
+      return err(authError.internalError(`saveScratch: ttlMs must be positive, got ${ttlMs}`));
+    }
+    this.#scratch.set(key, { value, expiresAt: this.#clock() + ttlMs });
+    return ok(undefined);
+  }
+  async readScratch(key) {
+    const stored = this.#scratch.get(key);
+    if (!stored) {
+      return err(authError.unknownState(`scratch "${key}" unknown`));
+    }
+    if (this.#clock() >= stored.expiresAt) {
+      this.#scratch.delete(key);
+      return err(authError.unknownState(`scratch "${key}" expired`));
+    }
+    return ok(stored.value);
+  }
+  async deleteScratch(key) {
+    this.#scratch.delete(key);
+    return ok(undefined);
+  }
 }
 export {
   MemorySessionStore

package/dist/esm/adapters/memory/token-store.js

@@ -8,6 +8,7 @@ class MemoryTokenStore {
   #clock;
   #codes = new Map;
   #refresh = new Map;
+  #dpopJtis = new Map;
   constructor(opts = {}) {
     this.#clock = opts.clock ?? realClock;
   }
@@ -85,6 +86,18 @@ class MemoryTokenStore {
     }
     return ok(undefined);
   }
+  async recordDpopJti(jti, ttlMs) {
+    const now = this.#clock();
+    for (const [k, exp] of this.#dpopJtis) {
+      if (exp <= now)
+        this.#dpopJtis.delete(k);
+    }
+    if (this.#dpopJtis.has(jti)) {
+      return err(authError.invalidGrant(`dpop jti "${jti}" replayed`));
+    }
+    this.#dpopJtis.set(jti, now + ttlMs);
+    return ok(undefined);
+  }
 }
 export {
   MemoryTokenStore

package/dist/esm/adapters/postgres/executor.js

@@ -16,6 +16,6 @@ function fromPGlite(db) {
   };
 }
 export {
-  fromPostgresJs,
-  fromPGlite
+  fromPGlite,
+  fromPostgresJs
 };

package/dist/esm/adapters/postgres/index.js

@@ -1,13 +1,36 @@
-export {
-  migrate,
-  fromPostgresJs,
+// src/adapters/postgres/index.ts
+import {
   fromPGlite,
-  PostgresTokenStore,
-  PostgresSessionStore,
-  PostgresPasskeyCredentialStore,
-  PostgresMethodStore,
-  PostgresKeyStore,
-  PostgresConfigStore,
+  fromPostgresJs
+} from "./executor";
+import { INITIAL_SCHEMA_SQL, migrate } from "./migrations";
+import { PostgresAuditLog } from "./audit-log";
+import {
+  PostgresConfigStore
+} from "./config-store";
+import { PostgresKeyStore } from "./key-store";
+import {
+  PostgresMethodStore
+} from "./method-store";
+import {
+  PostgresSessionStore
+} from "./session-store";
+import {
+  PostgresTokenStore
+} from "./token-store";
+import {
+  PostgresPasskeyCredentialStore
+} from "./passkey-credential-store";
+export {
+  INITIAL_SCHEMA_SQL,
   PostgresAuditLog,
-  INITIAL_SCHEMA_SQL
+  PostgresConfigStore,
+  PostgresKeyStore,
+  PostgresMethodStore,
+  PostgresPasskeyCredentialStore,
+  PostgresSessionStore,
+  PostgresTokenStore,
+  fromPGlite,
+  fromPostgresJs,
+  migrate
 };

package/dist/esm/adapters/postgres/migrations.js

@@ -75,6 +75,12 @@ CREATE TABLE IF NOT EXISTS openauth_sessions (
   expires_at bigint NOT NULL
 );
 
+CREATE TABLE IF NOT EXISTS openauth_scratch (
+  scratch_key text PRIMARY KEY,
+  value text NOT NULL,
+  expires_at bigint NOT NULL
+);
+
 CREATE TABLE IF NOT EXISTS openauth_audit_events (
   id bigserial PRIMARY KEY,
   ts bigint NOT NULL,
@@ -106,6 +112,6 @@ async function migrate(exec) {
   }
 }
 export {
-  migrate,
-  INITIAL_SCHEMA_SQL
+  INITIAL_SCHEMA_SQL,
+  migrate
 };

package/dist/esm/adapters/postgres/session-store.js

@@ -119,6 +119,48 @@ class PostgresSessionStore {
     }
     return ok(undefined);
   }
+  async saveScratch(key, value, ttlMs) {
+    if (ttlMs <= 0) {
+      return err(authError.internalError(`saveScratch: ttlMs must be positive, got ${ttlMs}`));
+    }
+    const expiresAt = this.#clock() + ttlMs;
+    try {
+      await this.#exec.query(`INSERT INTO openauth_scratch (scratch_key, value, expires_at)
+         VALUES ($1, $2, $3)
+         ON CONFLICT (scratch_key)
+         DO UPDATE SET value = EXCLUDED.value, expires_at = EXCLUDED.expires_at`, [key, value, expiresAt]);
+    } catch (e) {
+      return err(authError.internalError("saveScratch: upsert failed", e));
+    }
+    return ok(undefined);
+  }
+  async readScratch(key) {
+    let row;
+    try {
+      const result = await this.#exec.query(`SELECT value, expires_at FROM openauth_scratch WHERE scratch_key = $1`, [key]);
+      row = result.rows[0];
+    } catch (e) {
+      return err(authError.internalError("readScratch: query failed", e));
+    }
+    if (!row) {
+      return err(authError.unknownState(`scratch "${key}" unknown`));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      try {
+        await this.#exec.query(`DELETE FROM openauth_scratch WHERE scratch_key = $1`, [key]);
+      } catch {}
+      return err(authError.unknownState(`scratch "${key}" expired`));
+    }
+    return ok(row.value);
+  }
+  async deleteScratch(key) {
+    try {
+      await this.#exec.query(`DELETE FROM openauth_scratch WHERE scratch_key = $1`, [key]);
+    } catch (e) {
+      return err(authError.internalError("deleteScratch: delete failed", e));
+    }
+    return ok(undefined);
+  }
 }
 function parseFlowRecord(raw) {
   if (typeof raw === "string")

package/dist/esm/client.js

@@ -33,44 +33,49 @@ function createClient(input) {
     if (cached)
       return cached;
     const keyset = await (f || fetch)(wk.jwks_uri).then((r) => r.json());
-    const result2 = createLocalJWKSet(keyset);
-    jwksCache.set(issuer, result2);
-    return result2;
+    const result = createLocalJWKSet(keyset);
+    jwksCache.set(issuer, result);
+    return result;
   }
   const result = {
     async authorize(redirectURI, response, opts) {
-      const result2 = new URL(issuer + "/authorize");
+      const result = new URL(issuer + "/authorize");
       const challenge = {
         state: crypto.randomUUID()
       };
-      result2.searchParams.set("client_id", input.clientID);
-      result2.searchParams.set("redirect_uri", redirectURI);
-      result2.searchParams.set("response_type", response);
-      result2.searchParams.set("state", challenge.state);
+      result.searchParams.set("client_id", input.clientID);
+      result.searchParams.set("redirect_uri", redirectURI);
+      result.searchParams.set("response_type", response);
+      result.searchParams.set("state", challenge.state);
       if (opts?.provider)
-        result2.searchParams.set("provider", opts.provider);
+        result.searchParams.set("provider", opts.provider);
+      if (opts?.scope !== undefined) {
+        const scope = Array.isArray(opts.scope) ? opts.scope.join(" ") : opts.scope;
+        if (scope)
+          result.searchParams.set("scope", scope);
+      }
       if (opts?.pkce && response === "code") {
         const pkce = await generatePKCE();
-        result2.searchParams.set("code_challenge_method", "S256");
-        result2.searchParams.set("code_challenge", pkce.challenge);
+        result.searchParams.set("code_challenge_method", "S256");
+        result.searchParams.set("code_challenge", pkce.challenge);
         challenge.verifier = pkce.verifier;
       }
       return {
         challenge,
-        url: result2.toString()
+        url: result.toString()
       };
     },
     async pkce(redirectURI, opts) {
-      const result2 = new URL(issuer + "/authorize");
+      const result = new URL(issuer + "/authorize");
       if (opts?.provider)
-        result2.searchParams.set("provider", opts.provider);
-      result2.searchParams.set("client_id", input.clientID);
-      result2.searchParams.set("redirect_uri", redirectURI);
-      result2.searchParams.set("response_type", "code");
+        result.searchParams.set("provider", opts.provider);
+      result.searchParams.set("client_id", input.clientID);
+      result.searchParams.set("redirect_uri", redirectURI);
+      result.searchParams.set("response_type", "code");
       const pkce = await generatePKCE();
-      result2.searchParams.set("code_challenge_method", "S256");
-      result2.searchParams.set("code_challenge", pkce.challenge);
-      return [pkce.verifier, result2.toString()];
+      result.searchParams.set("code_challenge_method", "S256");
+      result.searchParams.set("code_challenge", pkce.challenge);
+      return [pkce.verifier, result.toString()];
     },
     async exchange(code, redirectURI, verifier) {
       const tokens = await f(issuer + "/token", {
@@ -97,7 +102,8 @@ function createClient(input) {
         tokens: {
           access: json.access_token,
           refresh: json.refresh_token,
-          expiresIn: json.expires_in
+          expiresIn: json.expires_in,
+          ...typeof json.id_token === "string" ? { idToken: json.id_token } : {}
         }
       };
     },
@@ -136,25 +142,26 @@ function createClient(input) {
         tokens: {
           access: json.access_token,
           refresh: json.refresh_token,
-          expiresIn: json.expires_in
+          expiresIn: json.expires_in,
+          ...typeof json.id_token === "string" ? { idToken: json.id_token } : {}
         }
       };
     },
     async verify(subjects, token, options) {
       const jwks = await getJWKS();
       try {
-        const result2 = await jwtVerify(token, jwks, {
+        const result = await jwtVerify(token, jwks, {
           issuer
         });
-        const claim = result2.payload.claim;
+        const claim = result.payload.claim;
         let subjectType;
         let subjectProperties;
         if (claim && typeof claim.type === "string") {
           subjectType = claim.type;
           subjectProperties = claim.properties;
-        } else if (result2.payload.mode === "access" && typeof result2.payload.type === "string") {
-          subjectType = result2.payload.type;
-          subjectProperties = result2.payload.properties;
+        } else if (result.payload.mode === "access" && typeof result.payload.type === "string") {
+          subjectType = result.payload.type;
+          subjectProperties = result.payload.properties;
         }
         if (subjectType === undefined) {
           return { err: new InvalidSubjectError };
@@ -168,7 +175,7 @@ function createClient(input) {
           return { err: new InvalidSubjectError };
         }
         return {
-          aud: result2.payload.aud,
+          aud: result.payload.aud,
           subject: {
             type: subjectType,
             properties: validated.value