@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/esm/http/handlers/token.js

@@ -0,0 +1,197 @@
+// src/http/handlers/token.ts
+import { clientCredentialsGrant } from "../../domain/client-credentials";
+import { canonicalHtu, verifyDpopProof } from "../../domain/dpop";
+import { exchangeCode } from "../../domain/token";
+import { exchangeToken } from "../../domain/token-exchange";
+import { refreshTokens } from "../../domain/refresh";
+import { isErr } from "../../types/result";
+import { authError } from "../../types/error";
+import { tokenEndpointErrorResponse } from "../errors";
+import { injectResolverHints } from "../resolver";
+import { tokenRequestSchema } from "../schemas/token";
+function makeTokenHandler(deps) {
+  return async (c) => {
+    const body = await readFormBody(c.req.raw);
+    if (!body) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("body must be application/x-www-form-urlencoded"));
+    }
+    const basic = parseBasicAuth(c.req.header("authorization") ?? null);
+    if (basic) {
+      body.set("client_id", basic.id);
+      body.set("client_secret", basic.secret);
+    }
+    const dpopHeader = c.req.header("dpop") ?? null;
+    let dpopJkt;
+    if (dpopHeader) {
+      const dpopRes = await verifyDpopProof({
+        proofJwt: dpopHeader,
+        htu: canonicalHtu(c.req.url),
+        htm: "POST",
+        nowSec: Math.floor(deps.clock() / 1000)
+      }, { tokenStore: deps.tokenStore });
+      if (isErr(dpopRes)) {
+        const errVal = dpopRes.error;
+        if (errVal.code === "invalid_dpop_proof" && errVal.replaySignal && deps.auditLog) {
+          await deps.auditLog.log({
+            kind: "dpop_replay_detected",
+            tenantId: null,
+            jtiPrefix: errVal.replaySignal.jti.slice(0, 16),
+            timestamp: deps.clock()
+          });
+        }
+        return tokenEndpointErrorResponse(errVal);
+      }
+      dpopJkt = dpopRes.value.jkt;
+    }
+    const parsed = tokenRequestSchema.safeParse(Object.fromEntries(body.entries()));
+    if (!parsed.success) {
+      const first = parsed.error.issues[0];
+      if (first?.path[0] === "grant_type") {
+        return tokenEndpointErrorResponse(authError.unsupportedGrantType(first.message ?? "unsupported grant_type"));
+      }
+      return tokenEndpointErrorResponse(authError.invalidRequest(first?.message ?? "invalid request"));
+    }
+    const req = parsed.data;
+    if (req.grant_type === "authorization_code") {
+      const result = await exchangeCode({
+        grantType: "authorization_code",
+        code: req.code,
+        redirectUri: req.redirect_uri,
+        clientId: req.client_id,
+        ...req.client_secret !== undefined ? { clientSecret: req.client_secret } : {},
+        ...req.code_verifier !== undefined ? { codeVerifier: req.code_verifier } : {},
+        ...dpopJkt !== undefined ? { dpopJkt } : {}
+      }, {
+        configStore: deps.configStore,
+        tokenStore: deps.tokenStore,
+        keyStore: deps.keyStore,
+        ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+        success: deps.success,
+        ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
+        issuerUrl: c.get("issuerUrl"),
+        clock: deps.clock,
+        ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
+      });
+      if (isErr(result))
+        return tokenEndpointErrorResponse(result.error);
+      return jsonResponse(result.value);
+    }
+    if (req.grant_type === "client_credentials") {
+      const tenantRes = await deps.resolveTenant(injectResolverHints(c.req.raw, { client_id: req.client_id }));
+      if (isErr(tenantRes)) {
+        return tokenEndpointErrorResponse(tenantRes.error);
+      }
+      const params = {};
+      for (const [k, v] of body.entries()) {
+        if (typeof v === "string")
+          params[k] = v;
+      }
+      const result = await clientCredentialsGrant({
+        grantType: "client_credentials",
+        clientId: req.client_id,
+        clientSecret: req.client_secret,
+        ...req.scope !== undefined ? { scope: req.scope } : {},
+        params
+      }, {
+        configStore: deps.configStore,
+        tokenStore: deps.tokenStore,
+        keyStore: deps.keyStore,
+        ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+        methodCache: deps.methodCache,
+        success: deps.success,
+        ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
+        issuerUrl: c.get("issuerUrl"),
+        clock: deps.clock,
+        ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
+      }, tenantRes.value);
+      if (isErr(result))
+        return tokenEndpointErrorResponse(result.error);
+      return jsonResponse(result.value);
+    }
+    if (req.grant_type === "refresh_token") {
+      const refreshResult = await refreshTokens({
+        grantType: "refresh_token",
+        refreshToken: req.refresh_token,
+        ...req.scope !== undefined ? { scope: req.scope } : {},
+        ...req.client_id !== undefined ? { clientId: req.client_id } : {},
+        ...req.client_secret !== undefined ? { clientSecret: req.client_secret } : {},
+        ...dpopJkt !== undefined ? { dpopJkt } : {}
+      }, {
+        configStore: deps.configStore,
+        tokenStore: deps.tokenStore,
+        keyStore: deps.keyStore,
+        ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+        issuerUrl: c.get("issuerUrl"),
+        clock: deps.clock,
+        ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
+      });
+      if (isErr(refreshResult))
+        return tokenEndpointErrorResponse(refreshResult.error);
+      return jsonResponse(refreshResult.value);
+    }
+    if (req.actor_token !== undefined) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("actor_token (delegation) is not supported; only impersonation / audience-switch is in scope"));
+    }
+    const exchangeResult = await exchangeToken({
+      grantType: req.grant_type,
+      subjectToken: req.subject_token,
+      audience: req.audience,
+      ...req.scope !== undefined ? { scope: req.scope } : {},
+      ...req.client_id !== undefined ? { clientId: req.client_id } : {},
+      ...req.client_secret !== undefined ? { clientSecret: req.client_secret } : {}
+    }, {
+      configStore: deps.configStore,
+      tokenStore: deps.tokenStore,
+      keyStore: deps.keyStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      ...deps.exchangeAudience ? { exchangeAudience: deps.exchangeAudience } : {},
+      issuerUrl: c.get("issuerUrl"),
+      clock: deps.clock,
+      ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
+    });
+    if (isErr(exchangeResult)) {
+      return tokenEndpointErrorResponse(exchangeResult.error);
+    }
+    return jsonResponse(exchangeResult.value);
+  };
+}
+function jsonResponse(body) {
+  return new Response(JSON.stringify(body), {
+    status: 200,
+    headers: {
+      "content-type": "application/json",
+      "cache-control": "no-store",
+      pragma: "no-cache"
+    }
+  });
+}
+async function readFormBody(req) {
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+    return null;
+  }
+  const text = await req.text();
+  return new URLSearchParams(text);
+}
+function parseBasicAuth(header) {
+  if (!header)
+    return null;
+  const m = /^Basic\s+(.+)$/i.exec(header);
+  if (!m || !m[1])
+    return null;
+  try {
+    const decoded = atob(m[1]);
+    const colon = decoded.indexOf(":");
+    if (colon === -1)
+      return null;
+    return {
+      id: decodeURIComponent(decoded.slice(0, colon)),
+      secret: decodeURIComponent(decoded.slice(colon + 1))
+    };
+  } catch {
+    return null;
+  }
+}
+export {
+  makeTokenHandler
+};

package/dist/esm/http/handlers/userinfo.js

@@ -0,0 +1,60 @@
+// src/http/handlers/userinfo.ts
+import { canonicalHtu } from "../../domain/dpop";
+import { userinfo } from "../../domain/userinfo";
+import { isErr } from "../../types/result";
+function makeUserinfoHandler(deps) {
+  return async (c) => {
+    const auth = extractAuthorization(c.req.header("authorization") ?? null);
+    if (!auth) {
+      return wwwAuthenticateResponse("Bearer", "invalid_token", "missing bearer / DPoP token", 401);
+    }
+    const dpopProof = c.req.header("dpop") ?? undefined;
+    const res = await userinfo({
+      accessToken: auth.token,
+      scheme: auth.scheme,
+      ...dpopProof !== undefined ? { dpopProof } : {},
+      htu: canonicalHtu(c.req.url),
+      htm: c.req.method.toUpperCase(),
+      nowSec: Math.floor(deps.clock() / 1000)
+    }, {
+      keyStore: deps.keyStore,
+      tokenStore: deps.tokenStore,
+      issuerUrl: c.get("issuerUrl"),
+      ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
+    });
+    if (isErr(res)) {
+      const error = res.error;
+      const scheme = auth.scheme;
+      const wireError = error.code === "invalid_dpop_proof" ? "invalid_dpop_proof" : "invalid_token";
+      return wwwAuthenticateResponse(scheme, wireError, error.description, 401);
+    }
+    return new Response(JSON.stringify(res.value), {
+      status: 200,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store"
+      }
+    });
+  };
+}
+function extractAuthorization(header) {
+  if (!header)
+    return null;
+  const m = /^(Bearer|DPoP)\s+(.+)$/i.exec(header);
+  if (!m || !m[1] || !m[2])
+    return null;
+  const scheme = m[1].toLowerCase() === "dpop" ? "DPoP" : "Bearer";
+  return { scheme, token: m[2] };
+}
+function wwwAuthenticateResponse(scheme, error, description, status) {
+  return new Response(JSON.stringify({ error, error_description: description }), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "www-authenticate": `${scheme} error="${error}"`
+    }
+  });
+}
+export {
+  makeUserinfoHandler
+};

package/dist/esm/http/middleware/error.js

@@ -0,0 +1,15 @@
+// src/http/middleware/error.ts
+import { authError } from "../../types/error";
+import { tokenEndpointErrorResponse } from "../errors";
+function errorMiddleware(_deps) {
+  return async (_c, next) => {
+    try {
+      await next();
+    } catch (e) {
+      return tokenEndpointErrorResponse(authError.serverError(e instanceof Error ? e.message : "unexpected error", e));
+    }
+  };
+}
+export {
+  errorMiddleware
+};

package/dist/esm/http/middleware/tenant.js

@@ -0,0 +1,102 @@
+// src/http/middleware/tenant.ts
+import { verifyStateEnvelope } from "../../domain/state-envelope";
+import { isErr } from "../../types/result";
+import { parseCookieHeader } from "../cookies";
+import {
+  authorizeDirectErrorResponse,
+  tokenEndpointErrorResponse
+} from "../errors";
+import { authError } from "../../types/error";
+function isCallbackPath(pathname) {
+  return pathname.startsWith("/cb/");
+}
+function bootstrapMiddleware(deps) {
+  return async (c, next) => {
+    const cookies = parseCookieHeader(c.req.header("cookie") ?? null);
+    c.set("cookies", cookies);
+    c.set("issuerUrl", deps.resolveIssuer(c.req.raw));
+    c.set("tenant", null);
+    c.set("recovery", null);
+    await next();
+  };
+}
+function tenantMiddleware(deps) {
+  return async (c, next) => {
+    const url = new URL(c.req.url);
+    if (isCallbackPath(url.pathname)) {
+      const recovery = await runCallbackRecovery(c.req.raw, deps);
+      c.set("recovery", recovery);
+      if (recovery.kind !== "fresh-request") {
+        const cfg2 = await deps.configStore.getTenantConfig(recovery.tenantId);
+        if (isErr(cfg2)) {
+          return tokenEndpointErrorResponse(cfg2.error);
+        }
+        const customCb = deps.buildCustomContext ? await deps.buildCustomContext(c.req.raw) : {};
+        c.set("tenant", buildTenantContext(c.req.raw, recovery.tenantId, cfg2.value, customCb));
+        return next();
+      }
+    }
+    const resolved = await deps.resolveTenant(c.req.raw);
+    if (isErr(resolved)) {
+      if (url.pathname === "/authorize") {
+        return authorizeDirectErrorResponse(resolved.error);
+      }
+      return tokenEndpointErrorResponse(resolved.error);
+    }
+    const tenantId = resolved.value;
+    const cfg = await deps.configStore.getTenantConfig(tenantId);
+    if (isErr(cfg)) {
+      const err = cfg.error.code === "tenant_not_found" ? authError.invalidRequest(cfg.error.description, "tenant") : cfg.error;
+      if (url.pathname === "/authorize") {
+        return authorizeDirectErrorResponse(err);
+      }
+      return tokenEndpointErrorResponse(err);
+    }
+    const custom = deps.buildCustomContext ? await deps.buildCustomContext(c.req.raw) : {};
+    c.set("tenant", buildTenantContext(c.req.raw, tenantId, cfg.value, custom));
+    await next();
+  };
+}
+function buildTenantContext(req, id, config, custom) {
+  return {
+    id,
+    config,
+    request: { raw: req, custom }
+  };
+}
+async function runCallbackRecovery(req, deps) {
+  const state = await extractStateParam(req);
+  if (state) {
+    const env = await verifyStateEnvelope(state, deps.stateKeys);
+    if (env.ok) {
+      return {
+        kind: "mac-state",
+        tenantId: env.value.tenantId,
+        flowId: env.value.flowId
+      };
+    }
+  }
+  return { kind: "fresh-request" };
+}
+async function extractStateParam(req) {
+  const url = new URL(req.url);
+  const fromQuery = url.searchParams.get("state");
+  if (fromQuery)
+    return fromQuery;
+  if (req.method !== "POST")
+    return null;
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+    return null;
+  }
+  try {
+    const text = await req.clone().text();
+    return new URLSearchParams(text).get("state");
+  } catch {
+    return null;
+  }
+}
+export {
+  tenantMiddleware,
+  bootstrapMiddleware
+};

package/dist/esm/http/resolver.js

@@ -0,0 +1,15 @@
+// src/http/resolver.ts
+function injectResolverHints(original, hints) {
+  const url = new URL(original.url);
+  for (const [k, v] of Object.entries(hints)) {
+    if (!url.searchParams.has(k))
+      url.searchParams.set(k, v);
+  }
+  return new Request(url.toString(), {
+    method: original.method,
+    headers: original.headers
+  });
+}
+export {
+  injectResolverHints
+};

package/dist/esm/http/router.js

@@ -0,0 +1,45 @@
+// src/http/router.ts
+import { Hono } from "hono";
+import { makeAuthorizeHandler } from "./handlers/authorize";
+import { makeCallbackHandler } from "./handlers/callback";
+import { makeEndSessionHandler } from "./handlers/end-session";
+import { makeDiscoveryHandler, makeJwksHandler } from "./handlers/metadata";
+import { makeMethodRouteHandler } from "./handlers/method-route";
+import { makeParHandler } from "./handlers/par";
+import { makeRegisterHandler } from "./handlers/register";
+import { makeIntrospectHandler, makeRevokeHandler } from "./handlers/revocation";
+import { makeTokenHandler } from "./handlers/token";
+import { makeUserinfoHandler } from "./handlers/userinfo";
+import { errorMiddleware } from "./middleware/error";
+import { bootstrapMiddleware, tenantMiddleware } from "./middleware/tenant";
+function buildRouter(deps) {
+  const app = new Hono;
+  app.use("*", errorMiddleware(deps));
+  app.use("*", bootstrapMiddleware(deps));
+  app.get("/.well-known/openid-configuration", makeDiscoveryHandler(deps));
+  app.get("/.well-known/oauth-authorization-server", makeDiscoveryHandler(deps));
+  app.get("/.well-known/jwks.json", makeJwksHandler(deps));
+  app.use("/authorize", tenantMiddleware(deps));
+  app.get("/authorize", makeAuthorizeHandler(deps));
+  app.use("/cb/*", tenantMiddleware(deps));
+  app.get("/cb/*", makeCallbackHandler(deps));
+  app.post("/cb/*", makeCallbackHandler(deps));
+  app.use("/m/*", tenantMiddleware(deps));
+  app.all("/m/*", makeMethodRouteHandler(deps));
+  app.post("/token", makeTokenHandler(deps));
+  app.get("/userinfo", makeUserinfoHandler(deps));
+  app.post("/userinfo", makeUserinfoHandler(deps));
+  app.post("/revoke", makeRevokeHandler(deps));
+  app.post("/introspect", makeIntrospectHandler(deps));
+  app.use("/end_session", tenantMiddleware(deps));
+  app.get("/end_session", makeEndSessionHandler(deps));
+  app.post("/end_session", makeEndSessionHandler(deps));
+  app.use("/par", tenantMiddleware(deps));
+  app.post("/par", makeParHandler(deps));
+  app.use("/register", tenantMiddleware(deps));
+  app.post("/register", makeRegisterHandler(deps));
+  return app;
+}
+export {
+  buildRouter
+};

package/dist/esm/http/schemas/authorize.js

@@ -0,0 +1,30 @@
+// src/http/schemas/authorize.ts
+import { z } from "zod";
+var SCOPE_TOKEN = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
+var csv = z.string().min(1).transform((s) => s.split(/\s+/).map((part) => part.trim()).filter((part) => part.length > 0));
+var scopeParam = z.string().transform((s) => s.split(/\s+/).map((part) => part.trim()).filter((part) => part.length > 0)).pipe(z.array(z.string().regex(SCOPE_TOKEN, "invalid scope token")));
+var authorizeQuerySchema = z.object({
+  response_type: z.string({
+    required_error: "missing response_type"
+  }),
+  client_id: z.string({ required_error: "missing client_id" }).min(1, "empty client_id"),
+  redirect_uri: z.string({ required_error: "missing redirect_uri" }).url("redirect_uri must be a valid URL"),
+  scope: scopeParam.optional(),
+  state: z.string().optional(),
+  audience: z.string().optional(),
+  method_id: z.string().optional(),
+  code_challenge: z.string().optional(),
+  code_challenge_method: z.literal("S256").optional(),
+  prompt: csv.optional(),
+  ui_locales: csv.optional(),
+  nonce: z.string().optional(),
+  claims: z.string().min(1).optional()
+}).passthrough();
+var authorizeRequestUriQuerySchema = z.object({
+  client_id: z.string({ required_error: "missing client_id" }).min(1, "empty client_id"),
+  request_uri: z.string({ required_error: "missing request_uri" }).min(1)
+}).passthrough();
+export {
+  authorizeRequestUriQuerySchema,
+  authorizeQuerySchema
+};

package/dist/esm/http/schemas/end-session.js

@@ -0,0 +1,13 @@
+// src/http/schemas/end-session.ts
+import { z } from "zod";
+var endSessionParamsSchema = z.object({
+  id_token_hint: z.string().optional(),
+  client_id: z.string().min(1).optional(),
+  post_logout_redirect_uri: z.string().url("post_logout_redirect_uri must be a valid URL").optional(),
+  state: z.string().optional(),
+  logout_hint: z.string().optional(),
+  ui_locales: z.string().optional()
+}).passthrough();
+export {
+  endSessionParamsSchema
+};

package/dist/esm/http/schemas/par.js

@@ -0,0 +1,9 @@
+// src/http/schemas/par.ts
+import { z } from "zod";
+var parBodySchema = z.object({
+  client_id: z.string({ required_error: "missing client_id" }).min(1, "empty client_id"),
+  client_secret: z.string().optional()
+}).catchall(z.string());
+export {
+  parBodySchema
+};

package/dist/esm/http/schemas/register.js

@@ -0,0 +1,16 @@
+// src/http/schemas/register.ts
+import { z } from "zod";
+var registerBodySchema = z.object({
+  client_name: z.string().min(1).optional(),
+  redirect_uris: z.array(z.string().url("redirect_uri must be a valid URL")).min(1, "redirect_uris must be a non-empty array"),
+  grant_types: z.array(z.string()).optional(),
+  response_types: z.array(z.string()).optional(),
+  token_endpoint_auth_method: z.enum(["none", "client_secret_basic", "client_secret_post"]).optional(),
+  scope: z.string().optional(),
+  post_logout_redirect_uris: z.array(z.string().url()).optional(),
+  sector_identifier_uri: z.string().url().optional(),
+  contacts: z.array(z.string()).optional()
+}).passthrough();
+export {
+  registerBodySchema
+};

package/dist/esm/http/schemas/revocation.js

@@ -0,0 +1,18 @@
+// src/http/schemas/revocation.ts
+import { z } from "zod";
+var revokeBodySchema = z.object({
+  token: z.string().min(1, "missing token"),
+  token_type_hint: z.enum(["access_token", "refresh_token"]).optional(),
+  client_id: z.string().optional(),
+  client_secret: z.string().optional()
+});
+var introspectBodySchema = z.object({
+  token: z.string().min(1, "missing token"),
+  token_type_hint: z.enum(["access_token", "refresh_token"]).optional(),
+  client_id: z.string().optional(),
+  client_secret: z.string().optional()
+});
+export {
+  revokeBodySchema,
+  introspectBodySchema
+};

package/dist/esm/http/schemas/token.js

@@ -0,0 +1,57 @@
+// src/http/schemas/token.ts
+import { z } from "zod";
+var TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
+var ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token";
+var REFRESH_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:refresh_token";
+var authorizationCodeGrantSchema = z.object({
+  grant_type: z.literal("authorization_code"),
+  code: z.string().min(1, "missing code"),
+  redirect_uri: z.string().url("invalid redirect_uri"),
+  client_id: z.string().min(1, "missing client_id"),
+  client_secret: z.string().optional(),
+  code_verifier: z.string().optional()
+});
+var refreshTokenGrantSchema = z.object({
+  grant_type: z.literal("refresh_token"),
+  refresh_token: z.string().min(1, "missing refresh_token"),
+  scope: z.string().optional(),
+  client_id: z.string().optional(),
+  client_secret: z.string().optional()
+});
+var clientCredentialsGrantSchema = z.object({
+  grant_type: z.literal("client_credentials"),
+  client_id: z.string().min(1, "missing client_id"),
+  client_secret: z.string().min(1, "missing client_secret"),
+  scope: z.string().optional(),
+  audience: z.string().optional(),
+  resource: z.string().optional()
+}).passthrough();
+var tokenExchangeGrantSchema = z.object({
+  grant_type: z.literal(TOKEN_EXCHANGE_GRANT_TYPE),
+  subject_token: z.string().min(1, "missing subject_token"),
+  subject_token_type: z.literal(ACCESS_TOKEN_TYPE),
+  audience: z.string().min(1, "missing audience"),
+  requested_token_type: z.literal(ACCESS_TOKEN_TYPE).optional(),
+  scope: z.string().optional(),
+  client_id: z.string().optional(),
+  client_secret: z.string().optional(),
+  actor_token: z.string().optional(),
+  actor_token_type: z.string().optional(),
+  resource: z.string().optional()
+}).passthrough();
+var tokenRequestSchema = z.discriminatedUnion("grant_type", [
+  authorizationCodeGrantSchema,
+  refreshTokenGrantSchema,
+  clientCredentialsGrantSchema,
+  tokenExchangeGrantSchema
+]);
+export {
+  tokenRequestSchema,
+  tokenExchangeGrantSchema,
+  refreshTokenGrantSchema,
+  clientCredentialsGrantSchema,
+  authorizationCodeGrantSchema,
+  TOKEN_EXCHANGE_GRANT_TYPE,
+  REFRESH_TOKEN_TYPE,
+  ACCESS_TOKEN_TYPE
+};