@aooth/auth 0.1.10 → 0.1.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/auth",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "Auth method layer for aoothjs (sessions, tokens, password reset, MFA primitives)",
   "keywords": [
     "aoothjs",
@@ -26,7 +26,11 @@
   "files": [
     "dist",
     "src/atscript-db/auth-credential.as",
-    "src/atscript-db/auth-credential.as.d.ts"
+    "src/atscript-db/auth-credential.as.d.ts",
+    "src/atscript-db/pending-authorization.as",
+    "src/atscript-db/pending-authorization.as.d.ts",
+    "src/atscript-db/auth-code.as",
+    "src/atscript-db/auth-code.as.d.ts"
   ],
   "type": "module",
   "sideEffects": false,
@@ -67,6 +71,22 @@
       "types": "./src/atscript-db/auth-credential.as.d.ts",
       "default": "./src/atscript-db/auth-credential.as"
     },
+    "./atscript-db/pending-authorization": {
+      "types": "./src/atscript-db/pending-authorization.as.d.ts",
+      "default": "./src/atscript-db/pending-authorization.as"
+    },
+    "./atscript-db/pending-authorization.as": {
+      "types": "./src/atscript-db/pending-authorization.as.d.ts",
+      "default": "./src/atscript-db/pending-authorization.as"
+    },
+    "./atscript-db/auth-code": {
+      "types": "./src/atscript-db/auth-code.as.d.ts",
+      "default": "./src/atscript-db/auth-code.as"
+    },
+    "./atscript-db/auth-code.as": {
+      "types": "./src/atscript-db/auth-code.as.d.ts",
+      "default": "./src/atscript-db/auth-code.as"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {
@@ -74,7 +94,7 @@
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@aooth/user": "0.1.10"
+    "@aooth/user": "0.1.12"
   },
   "devDependencies": {
     "@atscript/core": "^0.1.71",

package/src/atscript-db/auth-code.as

@@ -0,0 +1,41 @@
+@db.table 'aooth_auth_codes'
+@db.depth.limit 0
+export interface AoothAuthCode {
+    /**
+     * Opaque single-use code (PK). Server-generated UUID in
+     * `AuthCodeStoreAtscriptDb.mint`. Consumed atomically at `/token`: the
+     * `deleteOne(code)` whose `deletedCount === 1` is the single-use claim, so a
+     * concurrent double-redeem (or back-button replay) yields it to one caller.
+     */
+    @meta.id
+    code: string
+
+    /** The user the login workflow authenticated. */
+    userId: string
+    /** PKCE S256 challenge from the originating authorize request. */
+    codeChallenge: string
+    /** The client's `redirect_uri` (bound; the code is meaningless elsewhere). */
+    redirectUri: string
+
+    /** Registered client id (Tier 2); absent for a public/loopback client. */
+    clientId?: string
+    /** Granted scope (space-joined). */
+    scope?: string
+    /** OIDC `nonce`, echoed into the `id_token` (Tier 2). */
+    nonce?: string
+    /** Mint an `id_token` at `/token` (Tier 2). */
+    idToken?: boolean
+    /** Mint an access token at `/token`. */
+    accessToken?: boolean
+    /** The `id_token` `aud` (the registered `client_id`). */
+    audience?: string
+
+    /**
+     * The grant's `TokenPolicy`, serialized as a JSON string — see
+     * `AoothPendingAuthorization.tokenPolicy` for why it is opaque, not `@db.json`.
+     */
+    tokenPolicy: string
+
+    /** Very short (≈ 30–60 s). Past-expiry rows are rejected on consume. */
+    expiresAt: number.timestamp
+}

package/src/atscript-db/auth-code.as.d.ts

@@ -0,0 +1,68 @@
+// prettier-ignore-start
+/* eslint-disable */
+/* oxlint-disable */
+/// <reference path="./auth-code.as" />
+/**
+ * 🪄 This file was generated by Atscript
+ * Do not edit this file!
+ */
+
+import type { TAtscriptTypeObject, TAtscriptTypeComplex, TAtscriptTypeFinal, TAtscriptTypeArray, TAtscriptAnnotatedType, TMetadataMap, Validator, TValidatorOptions } from "@atscript/typescript/utils"
+
+/**
+ * Atscript interface **AoothAuthCode**
+ * @see {@link ./auth-code.as:3:18}
+ */
+export declare class AoothAuthCode {
+  code: string
+  userId: string
+  codeChallenge: string
+  redirectUri: string
+  clientId?: string
+  scope?: string
+  nonce?: string
+  idToken?: boolean
+  accessToken?: boolean
+  audience?: string
+  tokenPolicy: string
+  expiresAt: number /* timestamp */
+  static __is_atscript_annotated_type: true
+  static type: TAtscriptTypeObject<keyof AoothAuthCode, AoothAuthCode>
+  static metadata: TMetadataMap<AtscriptMetadata>
+  static validator: (opts?: Partial<TValidatorOptions>) => Validator<typeof AoothAuthCode>
+  /** @deprecated JSON Schema support is disabled. Calling this method will throw a runtime error. To enable, set `jsonSchema: 'lazy'` or `jsonSchema: 'bundle'` in tsPlugin options, or add `@emit.jsonSchema` annotation to individual interfaces. */
+  static toJsonSchema: () => any
+  /** @deprecated Example Data support is disabled. To enable, set `exampleData: true` in tsPlugin options. */
+  static toExampleData?: () => any
+  static __flat: {
+    "code": string
+    "userId": string
+    "codeChallenge": string
+    "redirectUri": string
+    "clientId"?: string
+    "scope"?: string
+    "nonce"?: string
+    "idToken"?: boolean
+    "accessToken"?: boolean
+    "audience"?: string
+    "tokenPolicy": string
+    "expiresAt": number /* timestamp */
+  }
+  static __ownProps: {
+    "code": string
+    "userId": string
+    "codeChallenge": string
+    "redirectUri": string
+    "clientId"?: string
+    "scope"?: string
+    "nonce"?: string
+    "idToken"?: boolean
+    "accessToken"?: boolean
+    "audience"?: string
+    "tokenPolicy": string
+    "expiresAt": number /* timestamp */
+  }
+  
+  static __pk: string
+}
+// prettier-ignore-end

package/src/atscript-db/pending-authorization.as

@@ -0,0 +1,42 @@
+@db.table 'aooth_pending_authorizations'
+@db.depth.limit 0
+export interface AoothPendingAuthorization {
+    /**
+     * Opaque server-side handle (PK) — the only thing that rides the URL / wf
+     * state. Server-generated UUID in `PendingAuthorizationStoreAtscriptDb.create`.
+     */
+    @meta.id
+    handle: string
+
+    /** The client's validated `redirect_uri` — where the auth code is delivered. */
+    redirectUri: string
+    /** PKCE S256 challenge; verified against the verifier at `/token`. */
+    codeChallenge: string
+
+    /** Registered client id (Tier 2); absent for a public/loopback client. */
+    clientId?: string
+    /** The client's `state`, echoed back on the redirect so it can correlate. */
+    clientState?: string
+    /** Granted scope (space-joined). */
+    scope?: string
+    /** OIDC `nonce`, echoed into the `id_token` (Tier 2). */
+    nonce?: string
+    /** Mint an `id_token` at `/token` (Tier 2). */
+    idToken?: boolean
+    /** Mint an access token at `/token`. */
+    accessToken?: boolean
+    /** The `id_token` `aud` (the registered `client_id`). */
+    audience?: string
+
+    /**
+     * The grant's `TokenPolicy`, serialized as a JSON string. `TokenPolicy.payload`
+     * is an OPEN `Record<string, unknown>` (consumer attenuation), which a closed
+     * `@db.json` schema would reject — so the whole policy is stored opaque and
+     * (de)serialized at the adapter boundary (`PendingAuthorizationStoreAtscriptDb`).
+     */
+    tokenPolicy: string
+
+    createdAt: number.timestamp
+    /** Lazy-GC'd on read once past. */
+    expiresAt: number.timestamp
+}

package/src/atscript-db/pending-authorization.as.d.ts

@@ -0,0 +1,71 @@
+// prettier-ignore-start
+/* eslint-disable */
+/* oxlint-disable */
+/// <reference path="./pending-authorization.as" />
+/**
+ * 🪄 This file was generated by Atscript
+ * Do not edit this file!
+ */
+
+import type { TAtscriptTypeObject, TAtscriptTypeComplex, TAtscriptTypeFinal, TAtscriptTypeArray, TAtscriptAnnotatedType, TMetadataMap, Validator, TValidatorOptions } from "@atscript/typescript/utils"
+
+/**
+ * Atscript interface **AoothPendingAuthorization**
+ * @see {@link ./pending-authorization.as:3:18}
+ */
+export declare class AoothPendingAuthorization {
+  handle: string
+  redirectUri: string
+  codeChallenge: string
+  clientId?: string
+  clientState?: string
+  scope?: string
+  nonce?: string
+  idToken?: boolean
+  accessToken?: boolean
+  audience?: string
+  tokenPolicy: string
+  createdAt: number /* timestamp */
+  expiresAt: number /* timestamp */
+  static __is_atscript_annotated_type: true
+  static type: TAtscriptTypeObject<keyof AoothPendingAuthorization, AoothPendingAuthorization>
+  static metadata: TMetadataMap<AtscriptMetadata>
+  static validator: (opts?: Partial<TValidatorOptions>) => Validator<typeof AoothPendingAuthorization>
+  /** @deprecated JSON Schema support is disabled. Calling this method will throw a runtime error. To enable, set `jsonSchema: 'lazy'` or `jsonSchema: 'bundle'` in tsPlugin options, or add `@emit.jsonSchema` annotation to individual interfaces. */
+  static toJsonSchema: () => any
+  /** @deprecated Example Data support is disabled. To enable, set `exampleData: true` in tsPlugin options. */
+  static toExampleData?: () => any
+  static __flat: {
+    "handle": string
+    "redirectUri": string
+    "codeChallenge": string
+    "clientId"?: string
+    "clientState"?: string
+    "scope"?: string
+    "nonce"?: string
+    "idToken"?: boolean
+    "accessToken"?: boolean
+    "audience"?: string
+    "tokenPolicy": string
+    "createdAt": number /* timestamp */
+    "expiresAt": number /* timestamp */
+  }
+  static __ownProps: {
+    "handle": string
+    "redirectUri": string
+    "codeChallenge": string
+    "clientId"?: string
+    "clientState"?: string
+    "scope"?: string
+    "nonce"?: string
+    "idToken"?: boolean
+    "accessToken"?: boolean
+    "audience"?: string
+    "tokenPolicy": string
+    "createdAt": number /* timestamp */
+    "expiresAt": number /* timestamp */
+  }
+  
+  static __pk: string
+}
+// prettier-ignore-end