@absolutejs/auth 0.56.9 → 0.56.11

package/dist/oidc/operator.d.ts

@@ -0,0 +1,14 @@
+import type { AuthorizationCodeStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, OidcRefreshTokenStore } from './types';
+type OAuthClientCredentialStores = {
+    authorizationCodeStore: AuthorizationCodeStore;
+    clientRegistrationTokenStore: ClientRegistrationTokenStore;
+    deviceAuthorizationStore: DeviceAuthorizationStore;
+    refreshTokenStore: OidcRefreshTokenStore;
+};
+export declare const revokeOAuthClientCredentials: (clientId: string, stores: OAuthClientCredentialStores) => Promise<{
+    revokedAuthorizationCodes: number;
+    revokedDeviceAuthorizations: number;
+    revokedRefreshTokens: number;
+    revokedRegistrationTokens: number;
+}>;
+export {};

package/dist/oidc/types.d.ts

@@ -42,6 +42,7 @@ export type ClientRegistrationToken = {
 };
 export type ClientRegistrationTokenStore = {
     deleteByClientId: (clientId: string) => Promise<void>;
+    deleteForClient?: (clientId: string) => Promise<number>;
     findByTokenHash: (tokenHash: string) => Promise<ClientRegistrationToken | undefined>;
     saveToken: (token: ClientRegistrationToken) => Promise<void>;
 };
@@ -65,6 +66,7 @@ export type AuthorizationCode = {
 };
 export type AuthorizationCodeStore = {
     consumeCode: (codeHash: string) => Promise<AuthorizationCode | undefined>;
+    deleteForClient?: (clientId: string) => Promise<number>;
     deleteForUserClient: (userId: string, clientId: string) => Promise<number>;
     saveCode: (code: AuthorizationCode) => Promise<void>;
 };
@@ -87,6 +89,7 @@ export type OidcRefreshTokenConnection = {
 export type OidcRefreshTokenStore = {
     consumeToken: (tokenHash: string) => Promise<OidcRefreshToken | undefined>;
     deleteForUser: (userId: string) => Promise<void>;
+    deleteForClient?: (clientId: string) => Promise<number>;
     deleteForUserClient: (userId: string, clientId: string) => Promise<number>;
     getToken: (tokenHash: string) => Promise<OidcRefreshToken | undefined>;
     listClientIdsForUser: (userId: string) => Promise<string[]>;
@@ -123,6 +126,7 @@ export type LogoutDeliveryStore = {
 };
 export type DeviceAuthorizationStore = {
     deleteByDeviceCodeHash: (deviceCodeHash: string) => Promise<void>;
+    deleteForClient?: (clientId: string) => Promise<number>;
     deleteForUserClient: (userId: string, clientId: string) => Promise<number>;
     findByDeviceCodeHash: (deviceCodeHash: string) => Promise<DeviceAuthorization | undefined>;
     findByUserCode: (userCode: string) => Promise<DeviceAuthorization | undefined>;

package/dist/server.js

@@ -27708,6 +27708,16 @@ var createInMemoryAuthorizationCodeStore = () => {
       codes.delete(codeHash);
       return record;
     },
+    deleteForClient: async (clientId) => {
+      let deleted = 0;
+      for (const [hash, code] of codes) {
+        if (code.clientId !== clientId)
+          continue;
+        codes.delete(hash);
+        deleted += 1;
+      }
+      return deleted;
+    },
     deleteForUserClient: async (userId, clientId) => {
       let deleted = 0;
       for (const [hash, code] of codes) {
@@ -27773,6 +27783,16 @@ var createInMemoryClientRegistrationTokenStore = () => {
           byHash.delete(hash);
       }
     },
+    deleteForClient: async (clientId) => {
+      let deleted = 0;
+      for (const [hash, token] of byHash) {
+        if (token.clientId !== clientId)
+          continue;
+        byHash.delete(hash);
+        deleted += 1;
+      }
+      return deleted;
+    },
     findByTokenHash: async (tokenHash) => byHash.get(tokenHash),
     saveToken: async (token) => {
       for (const [hash, existing] of byHash) {
@@ -27789,6 +27809,16 @@ var createInMemoryDeviceAuthorizationStore = () => {
     deleteByDeviceCodeHash: async (deviceCodeHash) => {
       byDeviceCode.delete(deviceCodeHash);
     },
+    deleteForClient: async (clientId) => {
+      let deleted = 0;
+      for (const [hash, authorization] of byDeviceCode) {
+        if (authorization.clientId !== clientId)
+          continue;
+        byDeviceCode.delete(hash);
+        deleted += 1;
+      }
+      return deleted;
+    },
     deleteForUserClient: async (userId, clientId) => {
       let deleted = 0;
       for (const [hash, authorization] of byDeviceCode) {
@@ -27870,6 +27900,16 @@ var createInMemoryOidcRefreshTokenStore = () => {
       tokens.delete(tokenHash);
       return record;
     },
+    deleteForClient: async (clientId) => {
+      let deleted = 0;
+      for (const [hash, token] of tokens) {
+        if (token.clientId !== clientId)
+          continue;
+        tokens.delete(hash);
+        deleted += 1;
+      }
+      return deleted;
+    },
     deleteForUser: async (userId) => {
       for (const [hash, token] of tokens) {
         if (token.userId === userId)
@@ -28164,6 +28204,10 @@ var createPostgresAuthorizationCodeStore = (db) => ({
     const [row] = await db.delete(oauthCodesTable).where(eq(oauthCodesTable.code_hash, codeHash)).returning();
     return row ? toCode(row) : undefined;
   },
+  deleteForClient: async (clientId) => {
+    const deleted = await db.delete(oauthCodesTable).where(eq(oauthCodesTable.client_id, clientId)).returning({ codeHash: oauthCodesTable.code_hash });
+    return deleted.length;
+  },
   deleteForUserClient: async (userId, clientId) => {
     const deleted = await db.delete(oauthCodesTable).where(and(eq(oauthCodesTable.user_id, userId), eq(oauthCodesTable.client_id, clientId))).returning({ codeHash: oauthCodesTable.code_hash });
     return deleted.length;
@@ -28193,6 +28237,12 @@ var createPostgresClientRegistrationTokenStore = (db) => ({
   deleteByClientId: async (clientId) => {
     await db.delete(oauthClientRegistrationTokensTable).where(eq(oauthClientRegistrationTokensTable.client_id, clientId));
   },
+  deleteForClient: async (clientId) => {
+    const deleted = await db.delete(oauthClientRegistrationTokensTable).where(eq(oauthClientRegistrationTokensTable.client_id, clientId)).returning({
+      tokenHash: oauthClientRegistrationTokensTable.token_hash
+    });
+    return deleted.length;
+  },
   findByTokenHash: async (tokenHash) => {
     const [row] = await db.select().from(oauthClientRegistrationTokensTable).where(eq(oauthClientRegistrationTokensTable.token_hash, tokenHash)).limit(1);
     if (!row)
@@ -28217,6 +28267,12 @@ var createPostgresDeviceAuthorizationStore = (db) => ({
   deleteByDeviceCodeHash: async (deviceCodeHash) => {
     await db.delete(oauthDeviceAuthorizationsTable).where(eq(oauthDeviceAuthorizationsTable.device_code_hash, deviceCodeHash));
   },
+  deleteForClient: async (clientId) => {
+    const deleted = await db.delete(oauthDeviceAuthorizationsTable).where(eq(oauthDeviceAuthorizationsTable.client_id, clientId)).returning({
+      deviceCodeHash: oauthDeviceAuthorizationsTable.device_code_hash
+    });
+    return deleted.length;
+  },
   deleteForUserClient: async (userId, clientId) => {
     const deleted = await db.delete(oauthDeviceAuthorizationsTable).where(and(eq(oauthDeviceAuthorizationsTable.user_sub, userId), eq(oauthDeviceAuthorizationsTable.client_id, clientId))).returning({
       deviceCodeHash: oauthDeviceAuthorizationsTable.device_code_hash
@@ -28311,6 +28367,10 @@ var createPostgresOidcRefreshTokenStore = (db) => ({
     const [row] = await db.delete(oauthRefreshTokensTable).where(eq(oauthRefreshTokensTable.token_hash, tokenHash)).returning();
     return row ? toRefresh(row) : undefined;
   },
+  deleteForClient: async (clientId) => {
+    const deleted = await db.delete(oauthRefreshTokensTable).where(eq(oauthRefreshTokensTable.client_id, clientId)).returning({ tokenHash: oauthRefreshTokensTable.token_hash });
+    return deleted.length;
+  },
   deleteForUser: async (userId) => {
     await db.delete(oauthRefreshTokensTable).where(eq(oauthRefreshTokensTable.user_id, userId));
   },
@@ -30188,11 +30248,12 @@ var delegateAgentAuthorization = async (agentAuth, context, auditEmit) => {
     now,
     userId: context.userSub
   });
+  const grantedScopes2 = context.scopes.filter((scope) => registration2.allowedScopes.includes(scope) && agentAuth.scopes.includes(scope));
   await agentAuth.delegationStore.saveDelegation({
     agentId: registration2.agentId,
     createdAt: existing?.createdAt ?? now,
     delegationId: existing?.delegationId ?? `agd_${crypto.randomUUID()}`,
-    scopes: context.scopes.filter((scope) => registration2.allowedScopes.includes(scope) && agentAuth.scopes.includes(scope)),
+    scopes: [...new Set([...existing?.scopes ?? [], ...grantedScopes2])],
     status: "active",
     updatedAt: now,
     userId: context.userSub
@@ -30526,5 +30587,5 @@ export {
   auth2 as auth
 };
 
-//# debugId=93AC61559A0D9C9764756E2164756E21
+//# debugId=DC157A619FC3907564756E2164756E21
 //# sourceMappingURL=server.js.map