@ambitresearch/genie 1.3.1

package/dist/auth/oauth/router.js

@@ -0,0 +1,159 @@
+import { OAuthStore } from "./store.js";
+import { buildAuthorizationServerMetadata } from "./metadata.js";
+import { registerDynamicClient, DcrValidationError } from "./dcr.js";
+import { renderConsentScreen, handleConsentDecision, AuthorizeError } from "./authorize.js";
+import { handleTokenRequest, TokenError } from "./token.js";
+import { verifyJwtHS256, JwtVerificationError } from "./jwt.js";
+import { resolveOAuthSigningKey, MissingOAuthKeyError } from "./config.js";
+export { MissingOAuthKeyError };
+/**
+ * Wires the OAuth 2.0 + DCR endpoints (RFC 7591 / RFC 8414) onto genie's
+ * Streamable HTTP server (DRO-273 / M5-01):
+ *   GET  /.well-known/oauth-authorization-server
+ *   POST /register
+ *   GET  /authorize   (consent screen)
+ *   POST /authorize   (consent decision)
+ *   POST /token
+ *
+ * Returns `undefined` (feature disabled) if `OAUTH_HS256_KEY` is unset or too
+ * short — callers should refuse to start OAuth-protected routes in that case
+ * per the issue's Implementation Notes, while still allowing unauthenticated
+ * MCP transport to run (OAuth is opt-in).
+ */
+export function createOAuthRouter(opts) {
+    const signingKey = resolveOAuthSigningKey(opts.env ?? process.env);
+    const store = new OAuthStore();
+    function json(res, status, body) {
+        res.writeHead(status, { "content-type": "application/json" });
+        res.end(JSON.stringify(body));
+    }
+    function readBody(req) {
+        return new Promise((resolve, reject) => {
+            const chunks = [];
+            req.on("data", (c) => chunks.push(c));
+            req.on("end", () => resolve(Buffer.concat(chunks)));
+            req.on("error", reject);
+        });
+    }
+    function handleBodyReadError(res) {
+        if (!res.headersSent)
+            json(res, 500, { error: "server_error" });
+    }
+    function parseBody(raw, contentType) {
+        const text = raw.toString("utf8");
+        if (!text)
+            return {};
+        if (contentType?.includes("application/x-www-form-urlencoded")) {
+            return Object.fromEntries(new URLSearchParams(text));
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return {};
+        }
+    }
+    function verifyBearerToken(authorizationHeader) {
+        if (!authorizationHeader?.startsWith("Bearer ")) {
+            throw new JwtVerificationError("Missing Bearer token.");
+        }
+        return verifyJwtHS256(authorizationHeader.slice("Bearer ".length), signingKey);
+    }
+    function handle(req, res, pathname) {
+        const url = new URL(req.url ?? "/", opts.issuer);
+        if (req.method === "GET" && pathname === "/.well-known/oauth-authorization-server") {
+            json(res, 200, buildAuthorizationServerMetadata({ issuer: opts.issuer }));
+            return true;
+        }
+        if (req.method === "POST" && pathname === "/register") {
+            void readBody(req)
+                .then((raw) => {
+                try {
+                    const body = JSON.parse(raw.toString("utf8") || "{}");
+                    const result = registerDynamicClient(store, body);
+                    json(res, 201, result);
+                }
+                catch (error) {
+                    if (error instanceof DcrValidationError) {
+                        json(res, 400, {
+                            error: "invalid_client_metadata",
+                            error_description: error.message,
+                        });
+                    }
+                    else {
+                        json(res, 500, { error: "server_error" });
+                    }
+                }
+            })
+                .catch(() => handleBodyReadError(res));
+            return true;
+        }
+        if (req.method === "GET" && pathname === "/authorize") {
+            try {
+                const query = Object.fromEntries(url.searchParams);
+                const html = renderConsentScreen(store, query);
+                res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+                res.end(html);
+            }
+            catch (error) {
+                const status = error instanceof AuthorizeError ? error.status : 500;
+                res.writeHead(status, { "content-type": "text/plain" });
+                res.end(error instanceof Error ? error.message : "Internal error");
+            }
+            return true;
+        }
+        if (req.method === "POST" && pathname === "/authorize") {
+            void readBody(req)
+                .then((raw) => {
+                try {
+                    const form = new URLSearchParams(raw.toString("utf8"));
+                    const params = new URLSearchParams(form.get("params") ?? "");
+                    const decision = form.get("decision") ?? "deny";
+                    const redirectUrl = handleConsentDecision(store, params, decision);
+                    res.writeHead(302, { location: redirectUrl });
+                    res.end();
+                }
+                catch (error) {
+                    const status = error instanceof AuthorizeError ? error.status : 500;
+                    res.writeHead(status, { "content-type": "text/plain" });
+                    res.end(error instanceof Error ? error.message : "Internal error");
+                }
+            })
+                .catch(() => handleBodyReadError(res));
+            return true;
+        }
+        if (req.method === "POST" && pathname === "/token") {
+            void readBody(req)
+                .then((raw) => {
+                try {
+                    const body = parseBody(raw, req.headers["content-type"]);
+                    const result = handleTokenRequest(store, signingKey, body);
+                    json(res, 200, result);
+                }
+                catch (error) {
+                    if (error instanceof TokenError) {
+                        json(res, 400, { error: error.error, error_description: error.message });
+                    }
+                    else {
+                        json(res, 500, { error: "server_error" });
+                    }
+                }
+            })
+                .catch(() => handleBodyReadError(res));
+            return true;
+        }
+        return false;
+    }
+    return { signingKey, store, handle, verifyBearerToken };
+}
+export function tryCreateOAuthRouter(opts) {
+    try {
+        return createOAuthRouter(opts);
+    }
+    catch (error) {
+        if (error instanceof MissingOAuthKeyError)
+            return undefined;
+        throw error;
+    }
+}
+//# sourceMappingURL=router.js.map

package/dist/auth/oauth/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../../src/auth/oauth/router.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,gCAAgC,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAmB,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAQhC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA4B;IAM5D,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;IAE/B,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;QAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,SAAS,QAAQ,CAAC,GAAoB;QACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC,CAAC;YAChD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,mBAAmB,CAAC,GAAmB;QAC9C,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,SAAS,SAAS,CAAC,GAAW,EAAE,WAA+B;QAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,IAAI,WAAW,EAAE,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;YAC/D,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,SAAS,iBAAiB,CAAC,mBAAuC;QAChE,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,cAAc,CAAC,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IACjF,CAAC;IAED,SAAS,MAAM,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAgB;QACzE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEjD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,yCAAyC,EAAE,CAAC;YACnF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,gCAAgC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YACtD,KAAK,QAAQ,CAAC,GAAG,CAAC;iBACf,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBACZ,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAA4B,CAAC;oBACjF,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBAClD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBACzB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;wBACxC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;4BACb,KAAK,EAAE,yBAAyB;4BAChC,iBAAiB,EAAE,KAAK,CAAC,OAAO;yBACjC,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,KAAK,YAAY,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;gBACpE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;gBACxD,GAAG,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YACvD,KAAK,QAAQ,CAAC,GAAG,CAAC;iBACf,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBACZ,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;oBACvD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;oBAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC;oBAChD,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;oBACnE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;oBAC9C,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,MAAM,GAAG,KAAK,YAAY,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;oBACpE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;oBACxD,GAAG,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnD,KAAK,QAAQ,CAAC,GAAG,CAAC;iBACf,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBACZ,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;oBACzD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;oBAC3D,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBACzB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;wBAChC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC3E,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAA4B;IAE5B,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,oBAAoB;YAAE,OAAO,SAAS,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/auth/oauth/store.d.ts

@@ -0,0 +1,55 @@
+/**
+ * In-memory OAuth state store (DRO-273 / M5-01).
+ *
+ * Scope: a single running genie process. Clients, auth codes, and refresh
+ * tokens do not survive a restart — acceptable for the MCP-server-per-launch
+ * model (each `claude mcp add` / `codex mcp login` re-runs DCR against a
+ * freshly started server). Not shared across processes; do not point two
+ * server instances at the same client_id.
+ */
+export interface RegisteredClient {
+    client_id: string;
+    client_secret: string;
+    client_secret_expires_at: 0;
+    redirect_uris: string[];
+    client_name?: string;
+}
+export interface AuthorizationCode {
+    code: string;
+    client_id: string;
+    redirect_uri: string;
+    scope: string;
+    code_challenge: string;
+    code_challenge_method: "S256";
+    expiresAt: number;
+    consumed: boolean;
+}
+export interface RefreshTokenRecord {
+    token: string;
+    client_id: string;
+    scope: string;
+}
+export declare class OAuthStore {
+    private readonly clients;
+    private readonly codes;
+    private readonly refreshTokens;
+    registerClient(redirectUris: string[], clientName?: string): RegisteredClient;
+    getClient(clientId: string): RegisteredClient | undefined;
+    issueAuthorizationCode(input: {
+        client_id: string;
+        redirect_uri: string;
+        scope: string;
+        code_challenge: string;
+        code_challenge_method: "S256";
+    }): string;
+    /** Consume (single-use) an authorization code, verifying PKCE. Returns undefined if invalid. */
+    consumeAuthorizationCode(input: {
+        code: string;
+        client_id: string;
+        redirect_uri: string;
+        code_verifier: string;
+    }): AuthorizationCode | undefined;
+    issueRefreshToken(clientId: string, scope: string): string;
+    consumeRefreshToken(token: string, clientId: string): RefreshTokenRecord | undefined;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/auth/oauth/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/store.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,wBAAwB,EAAE,CAAC,CAAC;IAC5B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAID,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwC;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyC;IAEvE,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,gBAAgB;IAY7E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAIzD,sBAAsB,CAAC,KAAK,EAAE;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,cAAc,EAAE,MAAM,CAAC;QACvB,qBAAqB,EAAE,MAAM,CAAC;KAC/B,GAAG,MAAM;IAWV,gGAAgG;IAChG,wBAAwB,CAAC,KAAK,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;KACvB,GAAG,iBAAiB,GAAG,SAAS;IAejC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAM1D,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;CAMrF"}

package/dist/auth/oauth/store.js

@@ -0,0 +1,63 @@
+import { randomBytes, createHash, randomUUID } from "node:crypto";
+const AUTH_CODE_TTL_MS = 60_000;
+export class OAuthStore {
+    clients = new Map();
+    codes = new Map();
+    refreshTokens = new Map();
+    registerClient(redirectUris, clientName) {
+        const client = {
+            client_id: randomUUID(),
+            client_secret: randomBytes(32).toString("base64url"),
+            client_secret_expires_at: 0,
+            redirect_uris: redirectUris,
+            client_name: clientName,
+        };
+        this.clients.set(client.client_id, client);
+        return client;
+    }
+    getClient(clientId) {
+        return this.clients.get(clientId);
+    }
+    issueAuthorizationCode(input) {
+        const code = randomBytes(32).toString("base64url");
+        this.codes.set(code, {
+            code,
+            ...input,
+            expiresAt: Date.now() + AUTH_CODE_TTL_MS,
+            consumed: false,
+        });
+        return code;
+    }
+    /** Consume (single-use) an authorization code, verifying PKCE. Returns undefined if invalid. */
+    consumeAuthorizationCode(input) {
+        const record = this.codes.get(input.code);
+        if (record === undefined)
+            return undefined;
+        this.codes.delete(input.code);
+        if (record.consumed)
+            return undefined;
+        if (record.expiresAt < Date.now())
+            return undefined;
+        if (record.client_id !== input.client_id)
+            return undefined;
+        if (record.redirect_uri !== input.redirect_uri)
+            return undefined;
+        const expectedChallenge = createHash("sha256").update(input.code_verifier).digest("base64url");
+        if (expectedChallenge !== record.code_challenge)
+            return undefined;
+        return record;
+    }
+    issueRefreshToken(clientId, scope) {
+        const token = randomBytes(32).toString("base64url");
+        this.refreshTokens.set(token, { token, client_id: clientId, scope });
+        return token;
+    }
+    consumeRefreshToken(token, clientId) {
+        const record = this.refreshTokens.get(token);
+        if (record === undefined || record.client_id !== clientId)
+            return undefined;
+        this.refreshTokens.delete(token);
+        return record;
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/auth/oauth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/auth/oauth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqClE,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,MAAM,OAAO,UAAU;IACJ,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC9C,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC7C,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEvE,cAAc,CAAC,YAAsB,EAAE,UAAmB;QACxD,MAAM,MAAM,GAAqB;YAC/B,SAAS,EAAE,UAAU,EAAE;YACvB,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YACpD,wBAAwB,EAAE,CAAC;YAC3B,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;SACxB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,sBAAsB,CAAC,KAMtB;QACC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACnB,IAAI;YACJ,GAAG,KAAK;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB;YACxC,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gGAAgG;IAChG,wBAAwB,CAAC,KAKxB;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtC,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QACpD,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3D,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QAEjE,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/F,IAAI,iBAAiB,KAAK,MAAM,CAAC,cAAc;YAAE,OAAO,SAAS,CAAC;QAElE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iBAAiB,CAAC,QAAgB,EAAE,KAAa;QAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mBAAmB,CAAC,KAAa,EAAE,QAAgB;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5E,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/auth/oauth/token.d.ts

@@ -0,0 +1,21 @@
+import type { OAuthStore } from "./store.js";
+export interface TokenRequestBody {
+    grant_type?: string;
+    code?: string;
+    redirect_uri?: string;
+    client_id?: string;
+    client_secret?: string;
+    code_verifier?: string;
+    refresh_token?: string;
+    [key: string]: unknown;
+}
+export declare class TokenError extends Error {
+    readonly error: string;
+    constructor(message: string, error?: string);
+}
+/**
+ * AC4/AC5 — `/token`. Supports `authorization_code` (with PKCE verifier) and
+ * `refresh_token` grants. Returns a signed HS256 JWT access token.
+ */
+export declare function handleTokenRequest(store: OAuthStore, signingKey: string, body: TokenRequestBody): Record<string, unknown>;
+//# sourceMappingURL=token.d.ts.map

package/dist/auth/oauth/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qBAAa,UAAW,SAAQ,KAAK;IAGjC,QAAQ,CAAC,KAAK,EAAE,MAAM;gBADtB,OAAO,EAAE,MAAM,EACN,KAAK,GAAE,MAA0B;CAI7C;AA4CD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,gBAAgB,GACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkCzB"}

package/dist/auth/oauth/token.js

@@ -0,0 +1,77 @@
+import { signJwtHS256 } from "./jwt.js";
+export class TokenError extends Error {
+    error;
+    constructor(message, error = "invalid_request") {
+        super(message);
+        this.error = error;
+    }
+}
+const ACCESS_TOKEN_TTL_SECONDS = 3600;
+function authenticateClient(store, body) {
+    if (!body.client_id)
+        throw new TokenError("client_id is required.", "invalid_client");
+    const client = store.getClient(body.client_id);
+    if (client === undefined)
+        throw new TokenError("Unknown client_id.", "invalid_client");
+    // Public clients (PKCE, no secret registered at DCR-issue time under `none` auth) may omit
+    // client_secret; confidential clients must present the one issued at registration.
+    if (body.client_secret !== undefined && body.client_secret !== client.client_secret) {
+        throw new TokenError("Invalid client_secret.", "invalid_client");
+    }
+    return client.client_id;
+}
+function issueTokenResponse(store, signingKey, clientId, scope) {
+    const now = Math.floor(Date.now() / 1000);
+    const accessToken = signJwtHS256({
+        sub: clientId,
+        client_id: clientId,
+        scope,
+        iat: now,
+        exp: now + ACCESS_TOKEN_TTL_SECONDS,
+    }, signingKey);
+    const refreshToken = store.issueRefreshToken(clientId, scope);
+    return {
+        access_token: accessToken,
+        token_type: "Bearer",
+        expires_in: ACCESS_TOKEN_TTL_SECONDS,
+        refresh_token: refreshToken,
+        scope,
+    };
+}
+/**
+ * AC4/AC5 — `/token`. Supports `authorization_code` (with PKCE verifier) and
+ * `refresh_token` grants. Returns a signed HS256 JWT access token.
+ */
+export function handleTokenRequest(store, signingKey, body) {
+    if (body.grant_type === "authorization_code") {
+        const clientId = authenticateClient(store, body);
+        if (!body.code)
+            throw new TokenError("code is required.");
+        if (!body.redirect_uri)
+            throw new TokenError("redirect_uri is required.");
+        if (!body.code_verifier)
+            throw new TokenError("code_verifier is required.");
+        const record = store.consumeAuthorizationCode({
+            code: body.code,
+            client_id: clientId,
+            redirect_uri: body.redirect_uri,
+            code_verifier: body.code_verifier,
+        });
+        if (record === undefined) {
+            throw new TokenError("Invalid or expired authorization code.", "invalid_grant");
+        }
+        return issueTokenResponse(store, signingKey, clientId, record.scope);
+    }
+    if (body.grant_type === "refresh_token") {
+        const clientId = authenticateClient(store, body);
+        if (!body.refresh_token)
+            throw new TokenError("refresh_token is required.");
+        const record = store.consumeRefreshToken(body.refresh_token, clientId);
+        if (record === undefined) {
+            throw new TokenError("Invalid refresh token.", "invalid_grant");
+        }
+        return issueTokenResponse(store, signingKey, clientId, record.scope);
+    }
+    throw new TokenError(`Unsupported grant_type '${String(body.grant_type)}'.`, "unsupported_grant_type");
+}
+//# sourceMappingURL=token.js.map

package/dist/auth/oauth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/auth/oauth/token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAaxC,MAAM,OAAO,UAAW,SAAQ,KAAK;IAGxB;IAFX,YACE,OAAe,EACN,QAAgB,iBAAiB;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,UAAK,GAAL,KAAK,CAA4B;IAG5C,CAAC;CACF;AAED,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,SAAS,kBAAkB,CAAC,KAAiB,EAAE,IAAsB;IACnE,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;IACvF,2FAA2F;IAC3F,mFAAmF;IACnF,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QACpF,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAiB,EACjB,UAAkB,EAClB,QAAgB,EAChB,KAAa;IAEb,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,YAAY,CAC9B;QACE,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,QAAQ;QACnB,KAAK;QACL,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,wBAAwB;KACpC,EACD,UAAU,CACX,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE9D,OAAO;QACL,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,wBAAwB;QACpC,aAAa,EAAE,YAAY;QAC3B,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAiB,EACjB,UAAkB,EAClB,IAAsB;IAEtB,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,UAAU,CAAC,4BAA4B,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,KAAK,CAAC,wBAAwB,CAAC;YAC5C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,UAAU,CAAC,wCAAwC,EAAE,eAAe,CAAC,CAAC;QAClF,CAAC;QAED,OAAO,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,UAAU,CAAC,4BAA4B,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACvE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,UAAU,CAClB,2BAA2B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EACtD,wBAAwB,CACzB,CAAC;AACJ,CAAC"}

package/dist/auth/oidc/group-policy.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Group-based access policy for external-OIDC-issued tokens (DRO-276 / M5-04).
+ *
+ * genie's existing OAuth server (M5-01, `packages/server/src/auth/oauth/*`)
+ * self-issues HS256 bearer JWTs — it has no concept of an external Identity
+ * Provider or group membership. This module adds the missing seam: given the
+ * claims of a token that was actually issued by (or validated against) an
+ * external OIDC provider, decide whether the caller is authorized to reach
+ * genie's tool surface.
+ *
+ * The concrete rule (AC6 of DRO-276): callers whose token does not carry the
+ * `genie-users` group in its `groups` claim are rejected with HTTP 403. This
+ * policy is provider-independent once an IdP has mapped membership into the
+ * supported `groups` claim; token-format and discovery prerequisites remain
+ * enforced by `verifier.ts`.
+ */
+/** Claims shape this policy cares about. Extra claims are ignored. */
+export interface OidcClaims {
+    sub?: string;
+    /** Group membership, as delivered by the IdP (custom claim, e.g. Keycloak's
+     *  default groups mapper, Okta's Groups claim, etc.). Absent/empty means no
+     *  group membership was asserted at all. */
+    groups?: unknown;
+    [key: string]: unknown;
+}
+/** The single group genie's OIDC integration test enforces (AC6). Exported so
+ *  fixtures/tests can reference the same literal rather than duplicating it. */
+export declare const REQUIRED_GROUP = "genie-users";
+export declare class GroupAccessDeniedError extends Error {
+    readonly requiredGroup: string;
+    constructor(requiredGroup: string);
+}
+/**
+ * Returns true if `claims` asserts membership in `requiredGroup` (defaults to
+ * {@link REQUIRED_GROUP}).
+ */
+export declare function hasRequiredGroup(claims: OidcClaims, requiredGroup?: string): boolean;
+/**
+ * Enforce group membership. Throws {@link GroupAccessDeniedError} (callers map
+ * this to HTTP 403) when `claims` does not carry `requiredGroup`.
+ */
+export declare function enforceGroupAccess(claims: OidcClaims, requiredGroup?: string): void;
+//# sourceMappingURL=group-policy.d.ts.map

package/dist/auth/oidc/group-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-policy.d.ts","sourceRoot":"","sources":["../../../src/auth/oidc/group-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;gDAE4C;IAC5C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;gFACgF;AAChF,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAE5C,qBAAa,sBAAuB,SAAQ,KAAK;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM;gBAArB,aAAa,EAAE,MAAM;CAG3C;AAYD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,aAAa,GAAE,MAAuB,GACrC,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,UAAU,EAClB,aAAa,GAAE,MAAuB,GACrC,IAAI,CAIN"}

package/dist/auth/oidc/group-policy.js

@@ -0,0 +1,54 @@
+/**
+ * Group-based access policy for external-OIDC-issued tokens (DRO-276 / M5-04).
+ *
+ * genie's existing OAuth server (M5-01, `packages/server/src/auth/oauth/*`)
+ * self-issues HS256 bearer JWTs — it has no concept of an external Identity
+ * Provider or group membership. This module adds the missing seam: given the
+ * claims of a token that was actually issued by (or validated against) an
+ * external OIDC provider, decide whether the caller is authorized to reach
+ * genie's tool surface.
+ *
+ * The concrete rule (AC6 of DRO-276): callers whose token does not carry the
+ * `genie-users` group in its `groups` claim are rejected with HTTP 403. This
+ * policy is provider-independent once an IdP has mapped membership into the
+ * supported `groups` claim; token-format and discovery prerequisites remain
+ * enforced by `verifier.ts`.
+ */
+/** The single group genie's OIDC integration test enforces (AC6). Exported so
+ *  fixtures/tests can reference the same literal rather than duplicating it. */
+export const REQUIRED_GROUP = "genie-users";
+export class GroupAccessDeniedError extends Error {
+    requiredGroup;
+    constructor(requiredGroup) {
+        super(`Access denied: caller is not a member of the "${requiredGroup}" group.`);
+        this.requiredGroup = requiredGroup;
+    }
+}
+/** Normalize a claims `groups` value into a string array. OIDC group claims
+ *  are conventionally a JSON array of strings, but tolerate a single string
+ *  (some IdPs emit a scalar when the caller has exactly one group) and treat
+ *  anything else as "no groups". */
+function normalizeGroups(value) {
+    if (Array.isArray(value))
+        return value.filter((v) => typeof v === "string");
+    if (typeof value === "string")
+        return [value];
+    return [];
+}
+/**
+ * Returns true if `claims` asserts membership in `requiredGroup` (defaults to
+ * {@link REQUIRED_GROUP}).
+ */
+export function hasRequiredGroup(claims, requiredGroup = REQUIRED_GROUP) {
+    return normalizeGroups(claims.groups).includes(requiredGroup);
+}
+/**
+ * Enforce group membership. Throws {@link GroupAccessDeniedError} (callers map
+ * this to HTTP 403) when `claims` does not carry `requiredGroup`.
+ */
+export function enforceGroupAccess(claims, requiredGroup = REQUIRED_GROUP) {
+    if (!hasRequiredGroup(claims, requiredGroup)) {
+        throw new GroupAccessDeniedError(requiredGroup);
+    }
+}
+//# sourceMappingURL=group-policy.js.map

package/dist/auth/oidc/group-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-policy.js","sourceRoot":"","sources":["../../../src/auth/oidc/group-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAYH;gFACgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;AAE5C,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC1B;IAArB,YAAqB,aAAqB;QACxC,KAAK,CAAC,iDAAiD,aAAa,UAAU,CAAC,CAAC;QAD7D,kBAAa,GAAb,aAAa,CAAQ;IAE1C,CAAC;CACF;AAED;;;oCAGoC;AACpC,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAkB,EAClB,gBAAwB,cAAc;IAEtC,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAkB,EAClB,gBAAwB,cAAc;IAEtC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAClD,CAAC;AACH,CAAC"}

package/dist/auth/oidc/verifier.d.ts

@@ -0,0 +1,42 @@
+import type { OidcClaims } from "./group-policy.js";
+export declare class MissingOidcConfigError extends Error {
+}
+export interface OidcVerifierConfig {
+    /** Provider issuer URL, e.g. `http://localhost:9944`. */
+    issuer: string;
+    /** Expected access-token `aud` claim for the genie resource/API. */
+    audience: string;
+    /** Group required for access (AC6). Defaults to `genie-users`. */
+    requiredGroup?: string;
+    /** OIDC discovery request timeout. Defaults to 10 seconds. */
+    discoveryTimeoutMs?: number;
+}
+export interface OidcVerifier {
+    readonly issuer: string;
+    readonly audience: string;
+    readonly requiredGroup: string;
+    /**
+     * Verify `token`'s signature (against the provider's live JWKS), `typ:
+     * at+jwt`, `iss`, `aud`, and mandatory RFC 9068 claims, THEN enforce group
+     * membership (AC6). Returns the decoded claims on success. Throws on any
+     * failure — signature failure, token-type/`iss`/`aud` mismatch, expiry, or
+     * {@link GroupAccessDeniedError} (403) for a valid-but-ungrouped token.
+     */
+    verify(token: string): Promise<OidcClaims>;
+}
+/** Read {@link OidcVerifierConfig} from env. A missing or empty issuer or
+ *  audience is invalid once either OIDC variable is present. */
+export declare function resolveOidcConfig(env?: NodeJS.ProcessEnv): OidcVerifierConfig;
+/**
+ * Build a verifier bound to a live provider's JWKS. The provider's `jwks_uri`
+ * is resolved once via OIDC discovery; the returned JWK set is fetched lazily
+ * and cached across calls by `jose`'s `createRemoteJWKSet` (in-flight
+ * de-duplication + background re-fetch on unknown `kid` — no manual caching
+ * needed here).
+ */
+export declare function createOidcVerifier(config: OidcVerifierConfig): Promise<OidcVerifier>;
+/** Same as {@link createOidcVerifier}, but returns `undefined` only when both
+ *  OIDC variables are absent. Partial or explicitly empty configuration is a
+ *  startup error. */
+export declare function tryCreateOidcVerifier(env?: NodeJS.ProcessEnv): Promise<OidcVerifier | undefined>;
+//# sourceMappingURL=verifier.d.ts.map

package/dist/auth/oidc/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/auth/oidc/verifier.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,qBAAa,sBAAuB,SAAQ,KAAK;CAAG;AAEpD,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC5C;AAED;gEACgE;AAChE,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAS1F;AAqFD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CAmC1F;AAED;;qBAEqB;AACrB,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAKnC"}