@ajna-inc/openbadges 0.1.0

package/build/http/endpoints/refresh.js

@@ -0,0 +1,134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureRefreshEndpoint = configureRefreshEndpoint;
+const auth_1 = require("../middleware/auth");
+const router_1 = require("../router");
+const OpenBadgeCredentialRepository_1 = require("../../repository/OpenBadgeCredentialRepository");
+const OpenBadgeCredentialRecord_1 = require("../../repository/OpenBadgeCredentialRecord");
+const ProofService_1 = require("../../services/ProofService");
+const KeyService_1 = require("../../services/KeyService");
+const RevocationService_1 = require("../../services/RevocationService");
+const constants_1 = require("../../constants");
+const OB_READ = 'https://purl.imsglobal.org/spec/ob/v3p0/scope/readonly';
+const OB_WRITE = 'https://purl.imsglobal.org/spec/ob/v3p0/scope/replace';
+/**
+ * Credential Refresh Endpoint
+ *
+ * Allows holders to request a refreshed (renewed) version of their credential.
+ * The issuer may update validity dates or other information.
+ *
+ * POST /ims/ob/v3p0/credentials/refresh
+ * Body: { credentialId: string } or the full credential
+ *
+ * Returns: refreshed credential with new proof and updated dates
+ */
+function configureRefreshEndpoint(router, config, module) {
+    router.post(config.refreshPath, (0, auth_1.bearerAuth)(module), (0, auth_1.requireScopes)([OB_WRITE]), async (req, res) => {
+        try {
+            const { agentContext } = (0, router_1.getRequestContext)(req);
+            const body = req.body;
+            if (!body.credentialId && !body.credential) {
+                return (0, router_1.sendError)(res, 400, 'invalid_request', 'Missing credentialId or credential in request body');
+            }
+            const repo = agentContext.dependencyManager.resolve(OpenBadgeCredentialRepository_1.OpenBadgeCredentialRepository);
+            const proofService = agentContext.dependencyManager.resolve(ProofService_1.ProofService);
+            const keyService = agentContext.dependencyManager.resolve(KeyService_1.KeyService);
+            const revocationService = agentContext.dependencyManager.resolve(RevocationService_1.RevocationService);
+            let originalCredential;
+            let recordId;
+            // Find the original credential
+            if (body.credentialId) {
+                // Look up by credential ID in stored records
+                const records = await repo.getAll(agentContext);
+                const matchingRecord = records.find((r) => {
+                    const cred = r.credential;
+                    return cred?.id === body.credentialId;
+                });
+                if (!matchingRecord) {
+                    return (0, router_1.sendError)(res, 404, 'not_found', `Credential not found: ${body.credentialId}`);
+                }
+                originalCredential = matchingRecord.credential;
+                recordId = matchingRecord.id;
+            }
+            else {
+                originalCredential = body.credential;
+            }
+            // Check if credential is revoked
+            const isRevoked = await revocationService.isRevoked(agentContext, originalCredential);
+            if (isRevoked) {
+                return (0, router_1.sendError)(res, 400, 'invalid_request', 'Cannot refresh a revoked credential');
+            }
+            // Extract issuer info for signing
+            const issuer = originalCredential.issuer;
+            const issuerId = typeof issuer === 'string' ? issuer : issuer?.id;
+            if (!issuerId) {
+                return (0, router_1.sendError)(res, 400, 'invalid_request', 'Could not determine issuer from credential');
+            }
+            // Create refreshed credential with updated dates
+            const now = new Date();
+            const refreshedCredential = {
+                ...originalCredential,
+                // Update validity dates
+                validFrom: now.toISOString(),
+                // Extend validity by 1 year if original had validUntil
+                ...(originalCredential.validUntil
+                    ? { validUntil: new Date(now.getTime() + 365 * 24 * 60 * 60 * 1000).toISOString() }
+                    : {}),
+                // Add refresh metadata
+                refreshService: {
+                    type: 'RefreshService2023',
+                    refreshedAt: now.toISOString(),
+                    previousId: originalCredential.id,
+                },
+            };
+            // Remove old proof
+            delete refreshedCredential.proof;
+            // Ensure contexts are correct
+            const contexts = Array.isArray(refreshedCredential['@context'])
+                ? refreshedCredential['@context']
+                : [refreshedCredential['@context']];
+            if (!contexts.includes(constants_1.VC_V2_CONTEXT)) {
+                refreshedCredential['@context'] = [constants_1.VC_V2_CONTEXT, ...contexts.filter((c) => c !== constants_1.VC_V2_CONTEXT)];
+            }
+            // Sign the refreshed credential
+            const verificationMethod = `${issuerId}#key-1`;
+            try {
+                await keyService.ensureBinding(agentContext, { controller: issuerId, vmId: verificationMethod });
+            }
+            catch {
+                // Key binding may already exist
+            }
+            const signedCredential = await proofService.sign(agentContext, refreshedCredential, {
+                id: verificationMethod,
+                controller: issuerId,
+            });
+            // Save the refreshed credential
+            const newRecord = new OpenBadgeCredentialRecord_1.OpenBadgeCredentialRecord({
+                credential: signedCredential,
+                derived: undefined,
+                status: 'unknown',
+            });
+            await repo.save(agentContext, newRecord);
+            // Optionally mark old credential as superseded (soft update)
+            if (recordId) {
+                try {
+                    const oldRecord = await repo.getById(agentContext, recordId);
+                    if (oldRecord) {
+                        oldRecord.status = 'superseded';
+                        await repo.update(agentContext, oldRecord);
+                    }
+                }
+                catch {
+                    // Ignore update errors
+                }
+            }
+            console.log('[OB][Refresh] Credential refreshed, new record id:', newRecord.id);
+            return (0, router_1.sendJson)(res, signedCredential, 200, 'application/vc+ld+json');
+        }
+        catch (e) {
+            console.error('[OB][Refresh] Error:', e?.message || e);
+            return (0, router_1.sendError)(res, 500, 'server_error', e?.message || 'Unexpected error');
+        }
+    });
+}
+//# sourceMappingURL=refresh.js.map

package/build/http/endpoints/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../src/http/endpoints/refresh.ts"],"names":[],"mappings":";;AA4BA,4DAqIC;AA5JD,6CAA8D;AAC9D,sCAAkE;AAClE,kGAA8F;AAC9F,0FAAsF;AACtF,8DAA0D;AAC1D,0DAAsD;AACtD,wEAAoE;AACpE,+CAA6D;AAE7D,MAAM,OAAO,GAAG,wDAAwD,CAAA;AACxE,MAAM,QAAQ,GAAG,uDAAuD,CAAA;AAExE;;;;;;;;;;GAUG;AACH,SAAgB,wBAAwB,CACtC,MAAc,EACd,MAAkC,EAClC,MAA4B;IAE5B,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,WAAW,EAClB,IAAA,iBAAU,EAAC,MAAM,CAAC,EAClB,IAAA,oBAAa,EAAC,CAAC,QAAQ,CAAC,CAAC,EACzB,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;YAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,IAGhB,CAAA;YAED,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC3C,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,oDAAoD,CAAC,CAAA;YACrG,CAAC;YAED,MAAM,IAAI,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,6DAA6B,CAAC,CAAA;YAClF,MAAM,YAAY,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,2BAAY,CAAC,CAAA;YACzE,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,uBAAU,CAAC,CAAA;YACrE,MAAM,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,qCAAiB,CAAC,CAAA;YAEnF,IAAI,kBAA2C,CAAA;YAC/C,IAAI,QAA4B,CAAA;YAEhC,+BAA+B;YAC/B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,6CAA6C;gBAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;gBAC/C,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAA4B,EAAE,EAAE;oBACnE,MAAM,IAAI,GAAG,CAAC,CAAC,UAAqC,CAAA;oBACpD,OAAO,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,YAAY,CAAA;gBACvC,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,yBAAyB,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;gBACvF,CAAC;gBAED,kBAAkB,GAAG,cAAc,CAAC,UAAqC,CAAA;gBACzE,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAA;YAC9B,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,IAAI,CAAC,UAAW,CAAA;YACvC,CAAC;YAED,iCAAiC;YACjC,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAA;YACrF,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,qCAAqC,CAAC,CAAA;YACtF,CAAC;YAED,kCAAkC;YAClC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAA;YACxC,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,MAAc,EAAE,EAAE,CAAA;YAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,4CAA4C,CAAC,CAAA;YAC7F,CAAC;YAED,iDAAiD;YACjD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;YACtB,MAAM,mBAAmB,GAA4B;gBACnD,GAAG,kBAAkB;gBACrB,wBAAwB;gBACxB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,uDAAuD;gBACvD,GAAG,CAAC,kBAAkB,CAAC,UAAU;oBAC/B,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;oBACnF,CAAC,CAAC,EAAE,CAAC;gBACP,uBAAuB;gBACvB,cAAc,EAAE;oBACd,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;oBAC9B,UAAU,EAAE,kBAAkB,CAAC,EAAE;iBAClC;aACF,CAAA;YAED,mBAAmB;YACnB,OAAO,mBAAmB,CAAC,KAAK,CAAA;YAEhC,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;gBAC7D,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC;gBACjC,CAAC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAA;YACrC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,yBAAa,CAAC,EAAE,CAAC;gBACtC,mBAAmB,CAAC,UAAU,CAAC,GAAG,CAAC,yBAAa,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,KAAK,yBAAa,CAAC,CAAC,CAAA;YACxG,CAAC;YAED,gCAAgC;YAChC,MAAM,kBAAkB,GAAG,GAAG,QAAQ,QAAQ,CAAA;YAC9C,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAClG,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;YAED,MAAM,gBAAgB,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,EAAE;gBAClF,EAAE,EAAE,kBAAkB;gBACtB,UAAU,EAAE,QAAQ;aACrB,CAAC,CAAA;YAEF,gCAAgC;YAChC,MAAM,SAAS,GAAG,IAAI,qDAAyB,CAAC;gBAC9C,UAAU,EAAE,gBAAgB;gBAC5B,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAA;YACF,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;YAExC,6DAA6D;YAC7D,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;oBAC5D,IAAI,SAAS,EAAE,CAAC;wBACd,SAAS,CAAC,MAAM,GAAG,YAAY,CAAA;wBAC/B,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;oBAC5C,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;YACH,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,oDAAoD,EAAE,SAAS,CAAC,EAAE,CAAC,CAAA;YAE/E,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAA;QACvE,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAA;YACtD,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,IAAI,kBAAkB,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

package/build/http/endpoints/registration.d.ts

@@ -0,0 +1,3 @@
+import type { Router } from 'express';
+import type { OpenBadgesHttpModuleConfig } from '../OpenBadgesHttpModuleConfig';
+export declare function configureRegistrationEndpoint(router: Router, config: OpenBadgesHttpModuleConfig): void;

package/build/http/endpoints/registration.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureRegistrationEndpoint = configureRegistrationEndpoint;
+const router_1 = require("../router");
+const OpenBadgesOAuthRepository_1 = require("../../repository/OpenBadgesOAuthRepository");
+const OpenBadgesOAuthRecord_1 = require("../../repository/OpenBadgesOAuthRecord");
+function randomId(prefix = '') {
+    return prefix + Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2);
+}
+function configureRegistrationEndpoint(router, config) {
+    router.post(config.registrationPath, async (req, res) => {
+        const { agentContext } = (0, router_1.getRequestContext)(req);
+        const oauthRepo = agentContext.dependencyManager.resolve(OpenBadgesOAuthRepository_1.OpenBadgesOAuthRepository);
+        const body = req.body || {};
+        if (!body.client_name) {
+            return (0, router_1.sendError)(res, 400, 'invalid_client_metadata', 'client_name is required');
+        }
+        const client_id = randomId('ob_');
+        const client_secret = randomId('sec_');
+        const registration = {
+            client_id,
+            client_secret,
+            client_id_issued_at: Math.floor(Date.now() / 1000),
+            client_secret_expires_at: 0,
+            token_endpoint_auth_method: 'client_secret_basic',
+            client_name: body.client_name,
+            redirect_uris: body.redirect_uris ?? [],
+            scope: body.scope ?? '',
+            grant_types: body.grant_types ?? ['authorization_code', 'refresh_token'],
+            response_types: body.response_types ?? ['code'],
+            application_type: body.application_type ?? 'web',
+        };
+        const rec = new OpenBadgesOAuthRecord_1.OpenBadgesOAuthRecord({
+            host: new URL(config.baseUrl).origin,
+            clientRegistration: registration,
+            tokens: {},
+        });
+        await oauthRepo.save(agentContext, rec);
+        (0, router_1.sendJson)(res, registration, 201);
+    });
+}
+//# sourceMappingURL=registration.js.map

package/build/http/endpoints/registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.js","sourceRoot":"","sources":["../../../src/http/endpoints/registration.ts"],"names":[],"mappings":";;AAYA,sEAoCC;AA5CD,sCAAkE;AAClE,0FAAsF;AACtF,kFAA8E;AAE9E,SAAS,QAAQ,CAAC,MAAM,GAAG,EAAE;IAC3B,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC3F,CAAC;AAED,SAAgB,6BAA6B,CAAC,MAAc,EAAE,MAAkC;IAC9F,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QAC3E,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;QAC/C,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,qDAAyB,CAAC,CAAA;QAEnF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,yBAAyB,CAAC,CAAA;QAClF,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QACjC,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;QAEtC,MAAM,YAAY,GAAG;YACnB,SAAS;YACT,aAAa;YACb,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClD,wBAAwB,EAAE,CAAC;YAC3B,0BAA0B,EAAE,qBAAqB;YACjD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE;YACvC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACxE,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC;YAC/C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,KAAK;SACjD,CAAA;QAED,MAAM,GAAG,GAAG,IAAI,6CAAqB,CAAC;YACpC,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM;YACpC,kBAAkB,EAAE,YAAY;YAChC,MAAM,EAAE,EAAE;SACX,CAAC,CAAA;QACF,MAAM,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;QAEvC,IAAA,iBAAQ,EAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/build/http/endpoints/revoke.d.ts

@@ -0,0 +1,3 @@
+import type { Router } from 'express';
+import type { OpenBadgesHttpModule } from '../OpenBadgesHttpModule';
+export declare function configureRevokeEndpoint(router: Router, module: OpenBadgesHttpModule): void;

package/build/http/endpoints/revoke.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureRevokeEndpoint = configureRevokeEndpoint;
+const router_1 = require("../router");
+const OpenBadgesTokenRepository_1 = require("../../repository/OpenBadgesTokenRepository");
+const OpenBadgesOAuthRepository_1 = require("../../repository/OpenBadgesOAuthRepository");
+const auth_1 = require("../util/auth");
+function configureRevokeEndpoint(router, module) {
+    router.post(module.config.revokePath, async (req, res) => {
+        const { agentContext } = (0, router_1.getRequestContext)(req);
+        // Client auth required
+        const basic = (0, auth_1.parseBasicAuth)(req) ?? (0, auth_1.parseBodyClientAuth)(req);
+        if (!basic)
+            return (0, router_1.sendError)(res, 401, 'invalid_client', 'Client authentication required');
+        const oauthRepo = agentContext.dependencyManager.resolve(OpenBadgesOAuthRepository_1.OpenBadgesOAuthRepository);
+        const clientRec = await oauthRepo.findByClientId(agentContext, basic.clientId);
+        const reg = clientRec?.clientRegistration || {};
+        if (!clientRec || reg.client_secret !== basic.clientSecret)
+            return (0, router_1.sendError)(res, 401, 'invalid_client', 'Invalid client credentials');
+        const token = String(req.body?.token ?? '');
+        if (!token)
+            return (0, router_1.sendError)(res, 400, 'invalid_request', 'token is required');
+        const tokenRepo = agentContext.dependencyManager.resolve(OpenBadgesTokenRepository_1.OpenBadgesTokenRepository);
+        const tokenRec = await tokenRepo.findByToken(agentContext, token);
+        if (tokenRec) {
+            if (tokenRec.clientId !== basic.clientId)
+                return (0, router_1.sendError)(res, 400, 'invalid_request', 'client mismatch');
+            // delete all tokens in the pair
+            const pair = await tokenRepo.findByPairId(agentContext, tokenRec.pairId);
+            for (const t of pair) {
+                await tokenRepo.deleteById(agentContext, t.id);
+            }
+        }
+        // Per RFC7009, successful revocation returns 200 even if token was unknown
+        return (0, router_1.sendJson)(res, { revoked: true });
+    });
+}
+//# sourceMappingURL=revoke.js.map

package/build/http/endpoints/revoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../../../src/http/endpoints/revoke.ts"],"names":[],"mappings":";;AASA,0DA4BC;AAjCD,sCAAkE;AAClE,0FAAsF;AACtF,0FAAsF;AACtF,uCAAkE;AAElE,SAAgB,uBAAuB,CAAC,MAAc,EAAE,MAA4B;IAClF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QAC5E,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;QAC/C,uBAAuB;QACvB,MAAM,KAAK,GAAG,IAAA,qBAAc,EAAC,GAAG,CAAC,IAAI,IAAA,0BAAmB,EAAC,GAAG,CAAC,CAAA;QAC7D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,gCAAgC,CAAC,CAAA;QAC1F,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,qDAAyB,CAAC,CAAA;QACnF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC9E,MAAM,GAAG,GAAI,SAAS,EAAE,kBAA0B,IAAI,EAAE,CAAA;QACxD,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa,KAAK,KAAK,CAAC,YAAY;YACxD,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,4BAA4B,CAAC,CAAA;QAE5E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAA;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;QAE9E,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,qDAAyB,CAAC,CAAA;QACnF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QACjE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;gBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAA;YAC1G,gCAAgC;YAChC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;YACxE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,SAAS,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;YAChD,CAAC;QACH,CAAC;QACD,2EAA2E;QAC3E,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/build/http/endpoints/serviceDescription.d.ts

@@ -0,0 +1,3 @@
+import type { Router } from 'express';
+import type { OpenBadgesHttpModuleConfig } from '../OpenBadgesHttpModuleConfig';
+export declare function configureServiceDescriptionEndpoint(router: Router, config: OpenBadgesHttpModuleConfig): void;

package/build/http/endpoints/serviceDescription.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureServiceDescriptionEndpoint = configureServiceDescriptionEndpoint;
+const router_1 = require("../router");
+function configureServiceDescriptionEndpoint(router, config) {
+    router.get(config.discoveryPath, async (req, res) => {
+        const { agentContext } = (0, router_1.getRequestContext)(req);
+        const base = new URL(config.baseUrl);
+        const authUrl = new URL(config.authorizePath, config.baseUrl).toString();
+        const tokenUrl = new URL(config.tokenPath, config.baseUrl).toString();
+        const registrationUrl = new URL(config.registrationPath, config.baseUrl).toString();
+        const response = {
+            openapi: '3.0.0',
+            info: {
+                title: 'Open Badges 3.0 / CLR 2.0 API',
+                version: '1.0.0',
+            },
+            servers: [{ url: `${base.origin}` }],
+            components: {
+                securitySchemes: {
+                    OAuth2ACG: {
+                        type: 'oauth2',
+                        description: 'OAuth 2.0 Authorization Code Grant authorization',
+                        'x-imssf-name': config.providerName ?? agentContext.config.label ?? 'Provider',
+                        'x-imssf-privacyPolicyUrl': config.privacyPolicyUrl,
+                        'x-imssf-termsOfServiceUrl': config.termsOfServiceUrl,
+                        'x-imssf-registrationUrl': registrationUrl,
+                        'x-oauth-revocationUrl': new URL(config.revokePath, config.baseUrl).toString(),
+                        'x-oauth-introspectionUrl': new URL(config.introspectPath, config.baseUrl).toString(),
+                        'x-oauth-jwksUrl': new URL(config.jwksPath, config.baseUrl).toString(),
+                        flows: {
+                            authorizationCode: {
+                                authorizationUrl: authUrl,
+                                tokenUrl: tokenUrl,
+                                refreshUrl: tokenUrl,
+                                scopes: {
+                                    'https://purl.imsglobal.org/spec/ob/v3p0/scope/readonly': 'Read-only access to credentials and profile',
+                                    'https://purl.imsglobal.org/spec/ob/v3p0/scope/replace': 'Write/update access to credentials and profile',
+                                    'https://purl.imsglobal.org/spec/ob/v3p0/scope/delete': 'Delete access to credentials and profile',
+                                    'https://purl.imsglobal.org/spec/clr/v2p0/scope/readonly': 'Read-only CLR scope',
+                                    'https://purl.imsglobal.org/spec/clr/v2p0/scope/replace': 'Write/replace CLR scope',
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        };
+        (0, router_1.sendJson)(res, response);
+    });
+}
+//# sourceMappingURL=serviceDescription.js.map

package/build/http/endpoints/serviceDescription.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceDescription.js","sourceRoot":"","sources":["../../../src/http/endpoints/serviceDescription.ts"],"names":[],"mappings":";;AAMA,kFAiDC;AAnDD,sCAAuD;AAEvD,SAAgB,mCAAmC,CAAC,MAAc,EAAE,MAAkC;IACpG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QACvE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;QAE/C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;QACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;QACrE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;QAEnF,MAAM,QAAQ,GAAG;YACf,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE;gBACJ,KAAK,EAAE,+BAA+B;gBACtC,OAAO,EAAE,OAAO;aACjB;YACD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,UAAU,EAAE;gBACV,eAAe,EAAE;oBACf,SAAS,EAAE;wBACT,IAAI,EAAE,QAAQ;wBACd,WAAW,EAAE,kDAAkD;wBAC/D,cAAc,EAAE,MAAM,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,IAAI,UAAU;wBAC9E,0BAA0B,EAAE,MAAM,CAAC,gBAAgB;wBACnD,2BAA2B,EAAE,MAAM,CAAC,iBAAiB;wBACrD,yBAAyB,EAAE,eAAe;wBAC1C,uBAAuB,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;wBAC9E,0BAA0B,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;wBACrF,iBAAiB,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;wBACtE,KAAK,EAAE;4BACL,iBAAiB,EAAE;gCACjB,gBAAgB,EAAE,OAAO;gCACzB,QAAQ,EAAE,QAAQ;gCAClB,UAAU,EAAE,QAAQ;gCACpB,MAAM,EAAE;oCACN,wDAAwD,EAAE,6CAA6C;oCACvG,uDAAuD,EAAE,gDAAgD;oCACzG,sDAAsD,EAAE,0CAA0C;oCAClG,yDAAyD,EAAE,qBAAqB;oCAChF,wDAAwD,EAAE,yBAAyB;iCACpF;6BACF;yBACF;qBACF;iBACF;aACF;SACF,CAAA;QAED,IAAA,iBAAQ,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/build/http/endpoints/statusList.d.ts

@@ -0,0 +1,10 @@
+import type { Router } from 'express';
+import type { OpenBadgesHttpModuleConfig } from '../OpenBadgesHttpModuleConfig';
+import type { OpenBadgesHttpModule } from '../OpenBadgesHttpModule';
+/**
+ * Configure the StatusList2021 endpoint
+ *
+ * GET /status-list/:id - Returns a signed StatusList2021Credential
+ * POST /status-list/:id/status - Update status for a credential index (issuer only)
+ */
+export declare function configureStatusListEndpoint(router: Router, config: OpenBadgesHttpModuleConfig, _module: OpenBadgesHttpModule): void;

package/build/http/endpoints/statusList.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureStatusListEndpoint = configureStatusListEndpoint;
+const router_1 = require("../router");
+const RevocationService_1 = require("../../services/RevocationService");
+const ProofService_1 = require("../../services/ProofService");
+/**
+ * Configure the StatusList2021 endpoint
+ *
+ * GET /status-list/:id - Returns a signed StatusList2021Credential
+ * POST /status-list/:id/status - Update status for a credential index (issuer only)
+ */
+function configureStatusListEndpoint(router, config, _module) {
+    const basePath = config.statusListPath;
+    // GET /status-list/:id - Return signed StatusList2021Credential
+    router.get(`${basePath}/:id`, async (req, res) => {
+        try {
+            const { agentContext } = (0, router_1.getRequestContext)(req);
+            const listId = String(req.params.id);
+            const revocationService = agentContext.dependencyManager.resolve(RevocationService_1.RevocationService);
+            const proofService = agentContext.dependencyManager.resolve(ProofService_1.ProofService);
+            // Get the status list record
+            const record = await revocationService.getStatusList(agentContext, listId);
+            if (!record) {
+                return (0, router_1.sendError)(res, 404, 'not_found', `Status list not found: ${listId}`);
+            }
+            // Build the unsigned StatusList2021Credential
+            const unsignedCredential = revocationService.buildStatusListCredential(record);
+            // Sign the credential
+            const verificationMethod = `${record.issuerDid}#key-1`;
+            const signedCredential = await proofService.sign(agentContext, unsignedCredential, {
+                id: verificationMethod,
+                controller: record.issuerDid,
+            });
+            // Return with proper content type
+            return (0, router_1.sendJson)(res, signedCredential, 200, 'application/vc+ld+json');
+        }
+        catch (e) {
+            console.error('[OB][StatusList] GET error:', e?.message || e);
+            return (0, router_1.sendError)(res, 500, 'server_error', e?.message || 'Unexpected error');
+        }
+    });
+    // POST /status-list/:id/status - Update status for an index (issuer operation)
+    router.post(`${basePath}/:id/status`, async (req, res) => {
+        try {
+            const { agentContext } = (0, router_1.getRequestContext)(req);
+            const listId = String(req.params.id);
+            const { index, status } = req.body;
+            if (typeof index !== 'number' || typeof status !== 'boolean') {
+                return (0, router_1.sendError)(res, 400, 'invalid_request', 'Missing required fields: index (number), status (boolean)');
+            }
+            const revocationService = agentContext.dependencyManager.resolve(RevocationService_1.RevocationService);
+            // Update the status
+            await revocationService.setStatus(agentContext, { listId, index, status });
+            return (0, router_1.sendJson)(res, { success: true, listId, index, status: status ? 'revoked' : 'active' });
+        }
+        catch (e) {
+            console.error('[OB][StatusList] POST error:', e?.message || e);
+            if (e?.message?.includes('not found')) {
+                return (0, router_1.sendError)(res, 404, 'not_found', e.message);
+            }
+            return (0, router_1.sendError)(res, 500, 'server_error', e?.message || 'Unexpected error');
+        }
+    });
+    // POST /status-list - Create a new status list
+    router.post(basePath, async (req, res) => {
+        try {
+            const { agentContext } = (0, router_1.getRequestContext)(req);
+            const { listId, issuerDid, purpose, capacity } = req.body;
+            if (!listId || !issuerDid) {
+                return (0, router_1.sendError)(res, 400, 'invalid_request', 'Missing required fields: listId, issuerDid');
+            }
+            const revocationService = agentContext.dependencyManager.resolve(RevocationService_1.RevocationService);
+            const record = await revocationService.createStatusList(agentContext, {
+                listId,
+                issuerDid,
+                purpose: purpose || 'revocation',
+                capacity,
+                baseUrl: config.baseUrl,
+            });
+            return (0, router_1.sendJson)(res, {
+                success: true,
+                listId: record.listId,
+                purpose: record.purpose,
+                capacity: record.capacity,
+                statusListCredentialUrl: `${config.baseUrl}${basePath}/${listId}`,
+            }, 201);
+        }
+        catch (e) {
+            console.error('[OB][StatusList] POST create error:', e?.message || e);
+            return (0, router_1.sendError)(res, 500, 'server_error', e?.message || 'Unexpected error');
+        }
+    });
+}
+//# sourceMappingURL=statusList.js.map

package/build/http/endpoints/statusList.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statusList.js","sourceRoot":"","sources":["../../../src/http/endpoints/statusList.ts"],"names":[],"mappings":";;AAeA,kEAuGC;AAjHD,sCAAkE;AAClE,wEAAoE;AACpE,8DAA0D;AAE1D;;;;;GAKG;AACH,SAAgB,2BAA2B,CACzC,MAAc,EACd,MAAkC,EAClC,OAA6B;IAE7B,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAA;IAEtC,gEAAgE;IAChE,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,MAAM,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QACpE,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;YAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAEpC,MAAM,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,qCAAiB,CAAC,CAAA;YACnF,MAAM,YAAY,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,2BAAY,CAAC,CAAA;YAEzE,6BAA6B;YAC7B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;YAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,0BAA0B,MAAM,EAAE,CAAC,CAAA;YAC7E,CAAC;YAED,8CAA8C;YAC9C,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAA;YAE9E,sBAAsB;YACtB,MAAM,kBAAkB,GAAG,GAAG,MAAM,CAAC,SAAS,QAAQ,CAAA;YACtD,MAAM,gBAAgB,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,EAAE;gBACjF,EAAE,EAAE,kBAAkB;gBACtB,UAAU,EAAE,MAAM,CAAC,SAAS;aAC7B,CAAC,CAAA;YAEF,kCAAkC;YAClC,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAA;QACvE,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAA;YAC7D,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,IAAI,kBAAkB,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,+EAA+E;IAC/E,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,aAAa,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QAC5E,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;YAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACpC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAA4C,CAAA;YAE1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7D,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,2DAA2D,CAAC,CAAA;YAC5G,CAAC;YAED,MAAM,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,qCAAiB,CAAC,CAAA;YAEnF,oBAAoB;YACpB,MAAM,iBAAiB,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YAE1E,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC/F,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAA;YAC9D,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;YACpD,CAAC;YACD,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,IAAI,kBAAkB,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,+CAA+C;IAC/C,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;YAC/C,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAKpD,CAAA;YAED,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC1B,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,4CAA4C,CAAC,CAAA;YAC7F,CAAC;YAED,MAAM,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,qCAAiB,CAAC,CAAA;YAEnF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,YAAY,EAAE;gBACpE,MAAM;gBACN,SAAS;gBACT,OAAO,EAAE,OAAO,IAAI,YAAY;gBAChC,QAAQ;gBACR,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAA;YAEF,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE;gBACnB,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,uBAAuB,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,IAAI,MAAM,EAAE;aAClE,EAAE,GAAG,CAAC,CAAA;QACT,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAA;YACrE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,IAAI,kBAAkB,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/build/http/endpoints/token.d.ts

@@ -0,0 +1,3 @@
+import type { Router } from 'express';
+import type { OpenBadgesHttpModule } from '../OpenBadgesHttpModule';
+export declare function configureTokenEndpoint(router: Router, module: OpenBadgesHttpModule): void;

package/build/http/endpoints/token.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureTokenEndpoint = configureTokenEndpoint;
+const router_1 = require("../router");
+const OpenBadgesAuthCodeRepository_1 = require("../../repository/OpenBadgesAuthCodeRepository");
+const OpenBadgesTokenRepository_1 = require("../../repository/OpenBadgesTokenRepository");
+const OpenBadgesTokenRecord_1 = require("../../repository/OpenBadgesTokenRecord");
+const OpenBadgesOAuthRepository_1 = require("../../repository/OpenBadgesOAuthRepository");
+const auth_1 = require("../util/auth");
+function randomToken(prefix = '') {
+    return prefix + Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2);
+}
+function configureTokenEndpoint(router, module) {
+    router.post(module.config.tokenPath, async (req, res) => {
+        const { agentContext } = (0, router_1.getRequestContext)(req);
+        const grant_type = String(req.body?.grant_type ?? '');
+        if (grant_type === 'authorization_code') {
+            // Client auth
+            const basic = (0, auth_1.parseBasicAuth)(req) ?? (0, auth_1.parseBodyClientAuth)(req);
+            if (!basic)
+                return (0, router_1.sendError)(res, 401, 'invalid_client', 'Client authentication required');
+            const oauthRepo = agentContext.dependencyManager.resolve(OpenBadgesOAuthRepository_1.OpenBadgesOAuthRepository);
+            const clientRec = await oauthRepo.findByClientId(agentContext, basic.clientId);
+            const reg = clientRec?.clientRegistration || {};
+            if (!clientRec || reg.client_secret !== basic.clientSecret)
+                return (0, router_1.sendError)(res, 401, 'invalid_client', 'Invalid client credentials');
+            const code = String(req.body?.code ?? '');
+            const redirect_uri = String(req.body?.redirect_uri ?? '');
+            const code_verifier = req.body?.code_verifier ? String(req.body.code_verifier) : undefined;
+            if (!code || !redirect_uri)
+                return (0, router_1.sendError)(res, 400, 'invalid_request', 'code and redirect_uri required');
+            const codeRepo = agentContext.dependencyManager.resolve(OpenBadgesAuthCodeRepository_1.OpenBadgesAuthCodeRepository);
+            const entry = await codeRepo.findByCode(agentContext, code);
+            if (!entry || entry.expiresAt.getTime() < Date.now())
+                return (0, router_1.sendError)(res, 400, 'invalid_grant', 'Invalid or expired code');
+            if (entry.redirectUri !== redirect_uri)
+                return (0, router_1.sendError)(res, 400, 'invalid_grant', 'redirect_uri mismatch');
+            if (entry.clientId !== basic.clientId)
+                return (0, router_1.sendError)(res, 400, 'invalid_grant', 'client mismatch');
+            // PKCE check when a code_challenge was provided
+            if (entry.codeChallenge) {
+                if (!code_verifier)
+                    return (0, router_1.sendError)(res, 400, 'invalid_request', 'code_verifier required');
+                const { createHash } = require('crypto');
+                const b64url = (buf) => buf
+                    .toString('base64')
+                    .replace(/=/g, '')
+                    .replace(/\+/g, '-')
+                    .replace(/\//g, '_');
+                if (entry.codeChallengeMethod === 'S256') {
+                    const expected = b64url(createHash('sha256').update(code_verifier).digest());
+                    if (expected !== entry.codeChallenge)
+                        return (0, router_1.sendError)(res, 400, 'invalid_grant', 'PKCE verification failed');
+                }
+                else {
+                    // plain
+                    if (code_verifier !== entry.codeChallenge)
+                        return (0, router_1.sendError)(res, 400, 'invalid_grant', 'PKCE verification failed');
+                }
+            }
+            const accessToken = randomToken('at_');
+            const refreshToken = randomToken('rt_');
+            const expiresIn = 3 * 60;
+            const pairId = randomToken('pair_');
+            const tokenRepo = agentContext.dependencyManager.resolve(OpenBadgesTokenRepository_1.OpenBadgesTokenRepository);
+            await tokenRepo.save(agentContext, new OpenBadgesTokenRecord_1.OpenBadgesTokenRecord({
+                token: accessToken,
+                tokenType: 'access',
+                clientId: entry.clientId,
+                subject: entry.subject,
+                scope: entry.scope,
+                expiresAt: new Date(Date.now() + expiresIn * 1000),
+                pairId,
+                host: new URL(module.config.baseUrl).origin,
+            }));
+            await tokenRepo.save(agentContext, new OpenBadgesTokenRecord_1.OpenBadgesTokenRecord({
+                token: refreshToken,
+                tokenType: 'refresh',
+                clientId: entry.clientId,
+                subject: entry.subject,
+                scope: entry.scope,
+                expiresAt: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000),
+                pairId,
+                host: new URL(module.config.baseUrl).origin,
+            }));
+            await codeRepo.deleteById(agentContext, entry.id);
+            return (0, router_1.sendJson)(res, {
+                access_token: accessToken,
+                token_type: 'Bearer',
+                expires_in: expiresIn,
+                refresh_token: refreshToken,
+                scope: entry.scope,
+            });
+        }
+        if (grant_type === 'refresh_token') {
+            const basic = (0, auth_1.parseBasicAuth)(req) ?? (0, auth_1.parseBodyClientAuth)(req);
+            if (!basic)
+                return (0, router_1.sendError)(res, 401, 'invalid_client', 'Client authentication required');
+            const oauthRepo = agentContext.dependencyManager.resolve(OpenBadgesOAuthRepository_1.OpenBadgesOAuthRepository);
+            const clientRec = await oauthRepo.findByClientId(agentContext, basic.clientId);
+            const reg = clientRec?.clientRegistration || {};
+            if (!clientRec || reg.client_secret !== basic.clientSecret)
+                return (0, router_1.sendError)(res, 401, 'invalid_client', 'Invalid client credentials');
+            const refresh_token = String(req.body?.refresh_token ?? '');
+            const tokenRepo = agentContext.dependencyManager.resolve(OpenBadgesTokenRepository_1.OpenBadgesTokenRepository);
+            const stored = await tokenRepo.findByToken(agentContext, refresh_token);
+            if (!stored || stored.tokenType !== 'refresh' || stored.expiresAt.getTime() < Date.now())
+                return (0, router_1.sendError)(res, 400, 'invalid_grant', 'Invalid or expired refresh token');
+            if (stored.clientId !== basic.clientId)
+                return (0, router_1.sendError)(res, 400, 'invalid_grant', 'client mismatch');
+            const accessToken = randomToken('at_');
+            const newRefreshToken = randomToken('rt_');
+            const expiresIn = 3 * 60;
+            await tokenRepo.save(agentContext, new OpenBadgesTokenRecord_1.OpenBadgesTokenRecord({
+                token: accessToken,
+                tokenType: 'access',
+                clientId: stored.clientId,
+                subject: stored.subject,
+                scope: stored.scope,
+                expiresAt: new Date(Date.now() + expiresIn * 1000),
+                pairId: stored.pairId,
+                host: stored.host,
+            }));
+            // Rotate refresh token: delete old, create new one
+            await tokenRepo.deleteById(agentContext, stored.id);
+            await tokenRepo.save(agentContext, new OpenBadgesTokenRecord_1.OpenBadgesTokenRecord({
+                token: newRefreshToken,
+                tokenType: 'refresh',
+                clientId: stored.clientId,
+                subject: stored.subject,
+                scope: stored.scope,
+                expiresAt: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000),
+                pairId: stored.pairId,
+                host: stored.host,
+            }));
+            return (0, router_1.sendJson)(res, {
+                access_token: accessToken,
+                token_type: 'Bearer',
+                expires_in: expiresIn,
+                refresh_token: newRefreshToken,
+                scope: stored.scope,
+            });
+        }
+        return (0, router_1.sendError)(res, 400, 'unsupported_grant_type', 'Only authorization_code and refresh_token supported');
+    });
+}
+//# sourceMappingURL=token.js.map

package/build/http/endpoints/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/http/endpoints/token.ts"],"names":[],"mappings":";;AAeA,wDAkJC;AA7JD,sCAAkE;AAClE,gGAA4F;AAC5F,0FAAsF;AACtF,kFAA8E;AAC9E,0FAAsF;AACtF,uCAAkE;AAElE,SAAS,WAAW,CAAC,MAAM,GAAG,EAAE;IAC9B,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC3F,CAAC;AAED,SAAgB,sBAAsB,CAAC,MAAc,EAAE,MAA4B;IACjF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QAC3E,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;QAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAA;QAErD,IAAI,UAAU,KAAK,oBAAoB,EAAE,CAAC;YACxC,cAAc;YACd,MAAM,KAAK,GAAG,IAAA,qBAAc,EAAC,GAAG,CAAC,IAAI,IAAA,0BAAmB,EAAC,GAAG,CAAC,CAAA;YAC7D,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,gCAAgC,CAAC,CAAA;YAC1F,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,qDAAyB,CAAC,CAAA;YACnF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;YAC9E,MAAM,GAAG,GAAI,SAAS,EAAE,kBAA0B,IAAI,EAAE,CAAA;YACxD,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa,KAAK,KAAK,CAAC,YAAY;gBACxD,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,4BAA4B,CAAC,CAAA;YAE5E,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;YACzC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CAAA;YACzD,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC1F,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,gCAAgC,CAAC,CAAA;YAE3G,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,2DAA4B,CAAC,CAAA;YACrF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;YAC3D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,yBAAyB,CAAC,CAAA;YAC5H,IAAI,KAAK,CAAC,WAAW,KAAK,YAAY;gBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,uBAAuB,CAAC,CAAA;YAC5G,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;gBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAA;YAErG,gDAAgD;YAChD,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,IAAI,CAAC,aAAa;oBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,CAAA;gBAC3F,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,QAAQ,CAA4B,CAAA;gBACnE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,GAAG;qBACA,QAAQ,CAAC,QAAQ,CAAC;qBAClB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;qBACjB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;qBACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;gBACxB,IAAI,KAAK,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;oBACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;oBAC5E,IAAI,QAAQ,KAAK,KAAK,CAAC,aAAa;wBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,0BAA0B,CAAC,CAAA;gBAC/G,CAAC;qBAAM,CAAC;oBACN,QAAQ;oBACR,IAAI,aAAa,KAAK,KAAK,CAAC,aAAa;wBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,0BAA0B,CAAC,CAAA;gBACpH,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;YACtC,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;YACvC,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,CAAA;YACxB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;YACnC,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,qDAAyB,CAAC,CAAA;YACnF,MAAM,SAAS,CAAC,IAAI,CAClB,YAAY,EACZ,IAAI,6CAAqB,CAAC;gBACxB,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,QAAQ;gBACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;gBAClD,MAAM;gBACN,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM;aAC5C,CAAC,CACH,CAAA;YACD,MAAM,SAAS,CAAC,IAAI,CAClB,YAAY,EACZ,IAAI,6CAAqB,CAAC;gBACxB,KAAK,EAAE,YAAY;gBACnB,SAAS,EAAE,SAAS;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;gBAC1D,MAAM;gBACN,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM;aAC5C,CAAC,CACH,CAAA;YACD,MAAM,QAAQ,CAAC,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;YAEjD,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE;gBACnB,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,SAAS;gBACrB,aAAa,EAAE,YAAY;gBAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,IAAA,qBAAc,EAAC,GAAG,CAAC,IAAI,IAAA,0BAAmB,EAAC,GAAG,CAAC,CAAA;YAC7D,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,gCAAgC,CAAC,CAAA;YAC1F,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,qDAAyB,CAAC,CAAA;YACnF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;YAC9E,MAAM,GAAG,GAAI,SAAS,EAAE,kBAA0B,IAAI,EAAE,CAAA;YACxD,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa,KAAK,KAAK,CAAC,YAAY;gBACxD,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,4BAA4B,CAAC,CAAA;YAE5E,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,IAAI,EAAE,CAAC,CAAA;YAC3D,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,qDAAyB,CAAC,CAAA;YACnF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;YACvE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;gBACtF,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,kCAAkC,CAAC,CAAA;YACjF,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;gBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAA;YAEtG,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;YACtC,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;YAC1C,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,CAAA;YACxB,MAAM,SAAS,CAAC,IAAI,CAClB,YAAY,EACZ,IAAI,6CAAqB,CAAC;gBACxB,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,QAAQ;gBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;gBAClD,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CACH,CAAA;YACD,mDAAmD;YACnD,MAAM,SAAS,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;YACnD,MAAM,SAAS,CAAC,IAAI,CAClB,YAAY,EACZ,IAAI,6CAAqB,CAAC;gBACxB,KAAK,EAAE,eAAe;gBACtB,SAAS,EAAE,SAAS;gBACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;gBAC1D,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CACH,CAAA;YAED,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE;gBACnB,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,SAAS;gBACrB,aAAa,EAAE,eAAe;gBAC9B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,EAAE,qDAAqD,CAAC,CAAA;IAC7G,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/build/http/middleware/auth.d.ts

@@ -0,0 +1,5 @@
+import type { NextFunction, Response } from 'express';
+import type { ObRequest } from '../router';
+import type { OpenBadgesHttpModule } from '../OpenBadgesHttpModule';
+export declare function bearerAuth(module: OpenBadgesHttpModule): (req: ObRequest, res: Response, next: NextFunction) => Promise<void>;
+export declare function requireScopes(required: string[]): (req: ObRequest, res: Response, next: NextFunction) => void;