@aooth/auth 0.1.17 → 0.1.19

package/dist/atscript-db.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_clock = require("./clock-Bl-H3eqE.cjs");
 const require_payload = require("./payload-BJjvj8AH.cjs");
-const require_auth_code_store = require("./auth-code-store-B_m51OSB.cjs");
+const require_dynamic_client_store = require("./dynamic-client-store-DAStgv2j.cjs");
 let node_crypto = require("node:crypto");
 //#region src/atscript-db/authz-stores.ts
 /**
@@ -9,7 +9,7 @@ let node_crypto = require("node:crypto");
 * fresh opaque `handle`; `get` rejects (and lazily evicts) a past-expiry row;
 * `delete` drops it once consumed. PK is `handle`, so reads/deletes are O(1).
 */
-var PendingAuthorizationStoreAtscriptDb = class extends require_auth_code_store.PendingAuthorizationStore {
+var PendingAuthorizationStoreAtscriptDb = class extends require_dynamic_client_store.PendingAuthorizationStore {
 	table;
 	clock;
 	ttlMs;
@@ -32,7 +32,9 @@ var PendingAuthorizationStoreAtscriptDb = class extends require_auth_code_store.
 			createdAt: now,
 			expiresAt,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
+			...rec.clientName !== void 0 && { clientName: rec.clientName },
 			...rec.clientState !== void 0 && { clientState: rec.clientState },
+			...rec.resource !== void 0 && { resource: rec.resource },
 			...rec.scope !== void 0 && { scope: rec.scope },
 			...rec.nonce !== void 0 && { nonce: rec.nonce },
 			...rec.idToken !== void 0 && { idToken: rec.idToken },
@@ -69,7 +71,9 @@ function rowToPending(row) {
 		expiresAt: row.expiresAt
 	};
 	if (row.clientId != null) out.clientId = row.clientId;
+	if (row.clientName != null) out.clientName = row.clientName;
 	if (row.clientState != null) out.clientState = row.clientState;
+	if (row.resource != null) out.resource = row.resource;
 	if (row.scope != null) out.scope = row.scope;
 	if (row.nonce != null) out.nonce = row.nonce;
 	if (row.idToken != null) out.idToken = row.idToken;
@@ -86,7 +90,7 @@ function rowToPending(row) {
 * back-button replay loses the race and gets `null`. (The delete is the claim,
 * so no version column is needed — `deleteOne(PK)` is atomic per the DB engine.)
 */
-var AuthCodeStoreAtscriptDb = class extends require_auth_code_store.AuthCodeStore {
+var AuthCodeStoreAtscriptDb = class extends require_dynamic_client_store.AuthCodeStore {
 	table;
 	clock;
 	ttlMs;
@@ -107,6 +111,7 @@ var AuthCodeStoreAtscriptDb = class extends require_auth_code_store.AuthCodeStor
 			expiresAt: this.clock.now() + this.ttlMs,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
 			...rec.scope !== void 0 && { scope: rec.scope },
+			...rec.resource !== void 0 && { resource: rec.resource },
 			...rec.nonce !== void 0 && { nonce: rec.nonce },
 			...rec.idToken !== void 0 && { idToken: rec.idToken },
 			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
@@ -134,12 +139,83 @@ function rowToAuthCode(row) {
 	};
 	if (row.clientId != null) out.clientId = row.clientId;
 	if (row.scope != null) out.scope = row.scope;
+	if (row.resource != null) out.resource = row.resource;
 	if (row.nonce != null) out.nonce = row.nonce;
 	if (row.idToken != null) out.idToken = row.idToken;
 	if (row.accessToken != null) out.accessToken = row.accessToken;
 	if (row.audience != null) out.audience = row.audience;
 	return out;
 }
+/**
+* Durable {@link DynamicClientStore}. Long-lived rows (a connector caches its
+* `client_id` across grants). `touch` is the portable findOne + replaceOne
+* (same trick as `CredentialStoreAtscriptDb.touch` — no engine-specific patch
+* op); `deleteUnusedBefore` is one mass `deleteMany` over
+* `createdAt < cutoff && lastUsedAt unset` — the never-used GC.
+*/
+var DynamicClientStoreAtscriptDb = class extends require_dynamic_client_store.DynamicClientStore {
+	table;
+	clock;
+	constructor(opts) {
+		super();
+		this.table = opts.table;
+		this.clock = opts.clock ?? require_clock.defaultClock;
+	}
+	async create(rec) {
+		const row = {
+			clientId: (0, node_crypto.randomUUID)(),
+			redirectUris: JSON.stringify(rec.redirectUris),
+			tokenEndpointAuthMethod: rec.tokenEndpointAuthMethod,
+			grantTypes: JSON.stringify(rec.grantTypes),
+			responseTypes: JSON.stringify(rec.responseTypes),
+			createdAt: this.clock.now(),
+			...rec.clientName !== void 0 && { clientName: rec.clientName },
+			...rec.scope !== void 0 && { scope: rec.scope }
+		};
+		await this.table.insertOne(row);
+		return rowToDynamicClient(row);
+	}
+	async get(clientId) {
+		const row = await this.table.findOne({ filter: { clientId } });
+		return row ? rowToDynamicClient(row) : null;
+	}
+	async delete(clientId) {
+		const { deletedCount } = await this.table.deleteOne(clientId);
+		return deletedCount > 0;
+	}
+	async count() {
+		return this.table.count({});
+	}
+	async touch(clientId, at) {
+		const row = await this.table.findOne({ filter: { clientId } });
+		if (!row) return;
+		await this.table.replaceOne({
+			...row,
+			lastUsedAt: at
+		});
+	}
+	async deleteUnusedBefore(cutoff) {
+		const { deletedCount } = await this.table.deleteMany({
+			createdAt: { $lt: cutoff },
+			lastUsedAt: { $exists: false }
+		});
+		return deletedCount;
+	}
+};
+function rowToDynamicClient(row) {
+	const out = {
+		clientId: row.clientId,
+		redirectUris: JSON.parse(row.redirectUris),
+		tokenEndpointAuthMethod: row.tokenEndpointAuthMethod,
+		grantTypes: JSON.parse(row.grantTypes),
+		responseTypes: JSON.parse(row.responseTypes),
+		createdAt: row.createdAt
+	};
+	if (row.clientName != null) out.clientName = row.clientName;
+	if (row.scope != null) out.scope = row.scope;
+	if (row.lastUsedAt != null) out.lastUsedAt = row.lastUsedAt;
+	return out;
+}
 //#endregion
 //#region src/atscript-db/index.ts
 /**
@@ -263,4 +339,5 @@ function rowToState(row) {
 //#endregion
 exports.AuthCodeStoreAtscriptDb = AuthCodeStoreAtscriptDb;
 exports.CredentialStoreAtscriptDb = CredentialStoreAtscriptDb;
+exports.DynamicClientStoreAtscriptDb = DynamicClientStoreAtscriptDb;
 exports.PendingAuthorizationStoreAtscriptDb = PendingAuthorizationStoreAtscriptDb;

package/dist/atscript-db.d.cts

@@ -1,6 +1,6 @@
 import { a as CredentialState, t as CredentialStore } from "./store-BG6m6oSJ.cjs";
 import { t as Clock } from "./clock-BjXa0LXb.cjs";
-import { a as NewAuthCode, c as PendingAuthorization, l as PendingAuthorizationStore, n as AuthCodeStore, s as NewPendingAuthorization, t as AuthCode } from "./auth-code-store-BZ88d_tq.cjs";
+import { a as NewDynamicClient, f as NewPendingAuthorization, m as PendingAuthorizationStore, n as DynamicClientStore, o as AuthCode, p as PendingAuthorization, s as AuthCodeStore, t as DynamicClient, u as NewAuthCode } from "./dynamic-client-store-DzqdUwnw.cjs";
 
 //#region src/atscript-db/authz-stores.d.ts
 /**
@@ -22,7 +22,9 @@ interface PendingAuthorizationRow {
   redirectUri: string;
   codeChallenge: string;
   clientId?: string;
+  clientName?: string;
   clientState?: string;
+  resource?: string;
   scope?: string;
   nonce?: string;
   idToken?: boolean;
@@ -84,6 +86,7 @@ interface AuthCodeRow {
   redirectUri: string;
   clientId?: string;
   scope?: string;
+  resource?: string;
   nonce?: string;
   idToken?: boolean;
   accessToken?: boolean;
@@ -130,6 +133,71 @@ declare class AuthCodeStoreAtscriptDb extends AuthCodeStore {
   }>;
   consume(code: string): Promise<AuthCode | null>;
 }
+/**
+ * Persisted row — mirrors `AoothDynamicClient` (`dynamic-client.as`). The
+ * three array fields are JSON-STRING columns (same opaque-string pattern as
+ * `tokenPolicy` above): a `string[]` column would need engine-specific array
+ * support, and all matching happens in `DynamicClientPolicy` after parse.
+ */
+interface DynamicClientRow {
+  clientId: string;
+  clientName?: string;
+  /** `JSON.stringify(string[])`. */
+  redirectUris: string;
+  tokenEndpointAuthMethod: string;
+  /** `JSON.stringify(string[])`. */
+  grantTypes: string;
+  /** `JSON.stringify(string[])`. */
+  responseTypes: string;
+  scope?: string;
+  createdAt: number;
+  lastUsedAt?: number;
+}
+/** Structural surface of `AtscriptDbTable` for the dynamic-client adapter. */
+interface DynamicClientTable {
+  insertOne(row: DynamicClientRow): Promise<{
+    insertedId: unknown;
+  }>;
+  findOne(query: {
+    filter: Record<string, unknown>;
+  }): Promise<DynamicClientRow | null>;
+  count(query: {
+    filter?: Record<string, unknown>;
+  }): Promise<number>;
+  replaceOne(row: DynamicClientRow): Promise<{
+    matchedCount: number;
+    modifiedCount: number;
+  }>;
+  deleteOne(idOrPk: unknown): Promise<{
+    deletedCount: number;
+  }>;
+  deleteMany(filter: Record<string, unknown>): Promise<{
+    deletedCount: number;
+  }>;
+}
+interface DynamicClientStoreAtscriptDbOptions {
+  table: DynamicClientTable;
+  /** Injectable clock for deterministic `createdAt`. Defaults to {@link defaultClock}. */
+  clock?: Clock;
+}
+/**
+ * Durable {@link DynamicClientStore}. Long-lived rows (a connector caches its
+ * `client_id` across grants). `touch` is the portable findOne + replaceOne
+ * (same trick as `CredentialStoreAtscriptDb.touch` — no engine-specific patch
+ * op); `deleteUnusedBefore` is one mass `deleteMany` over
+ * `createdAt < cutoff && lastUsedAt unset` — the never-used GC.
+ */
+declare class DynamicClientStoreAtscriptDb extends DynamicClientStore {
+  private readonly table;
+  private readonly clock;
+  constructor(opts: DynamicClientStoreAtscriptDbOptions);
+  create(rec: NewDynamicClient): Promise<DynamicClient>;
+  get(clientId: string): Promise<DynamicClient | null>;
+  delete(clientId: string): Promise<boolean>;
+  count(): Promise<number>;
+  touch(clientId: string, at: number): Promise<void>;
+  deleteUnusedBefore(cutoff: number): Promise<number>;
+}
 //#endregion
 //#region src/atscript-db/index.d.ts
 /**
@@ -219,4 +287,4 @@ declare class CredentialStoreAtscriptDb<TPayload extends object = object> implem
   }>>;
 }
 //#endregion
-export { AuthCodeRow, AuthCodeStoreAtscriptDb, AuthCodeStoreAtscriptDbOptions, AuthCodeTable, AuthCredentialRow, AuthCredentialTable, CredentialStoreAtscriptDb, PendingAuthorizationRow, PendingAuthorizationStoreAtscriptDb, PendingAuthorizationStoreAtscriptDbOptions, PendingAuthorizationTable };
+export { AuthCodeRow, AuthCodeStoreAtscriptDb, AuthCodeStoreAtscriptDbOptions, AuthCodeTable, AuthCredentialRow, AuthCredentialTable, CredentialStoreAtscriptDb, DynamicClientRow, DynamicClientStoreAtscriptDb, DynamicClientStoreAtscriptDbOptions, DynamicClientTable, PendingAuthorizationRow, PendingAuthorizationStoreAtscriptDb, PendingAuthorizationStoreAtscriptDbOptions, PendingAuthorizationTable };

package/dist/atscript-db.d.mts

@@ -1,6 +1,6 @@
 import { a as CredentialState, t as CredentialStore } from "./store-BG6m6oSJ.mjs";
 import { t as Clock } from "./clock-BjXa0LXb.mjs";
-import { a as NewAuthCode, c as PendingAuthorization, l as PendingAuthorizationStore, n as AuthCodeStore, s as NewPendingAuthorization, t as AuthCode } from "./auth-code-store-Om5MXNUT.mjs";
+import { a as NewDynamicClient, f as NewPendingAuthorization, m as PendingAuthorizationStore, n as DynamicClientStore, o as AuthCode, p as PendingAuthorization, s as AuthCodeStore, t as DynamicClient, u as NewAuthCode } from "./dynamic-client-store-oHEsQaJg.mjs";
 
 //#region src/atscript-db/authz-stores.d.ts
 /**
@@ -22,7 +22,9 @@ interface PendingAuthorizationRow {
   redirectUri: string;
   codeChallenge: string;
   clientId?: string;
+  clientName?: string;
   clientState?: string;
+  resource?: string;
   scope?: string;
   nonce?: string;
   idToken?: boolean;
@@ -84,6 +86,7 @@ interface AuthCodeRow {
   redirectUri: string;
   clientId?: string;
   scope?: string;
+  resource?: string;
   nonce?: string;
   idToken?: boolean;
   accessToken?: boolean;
@@ -130,6 +133,71 @@ declare class AuthCodeStoreAtscriptDb extends AuthCodeStore {
   }>;
   consume(code: string): Promise<AuthCode | null>;
 }
+/**
+ * Persisted row — mirrors `AoothDynamicClient` (`dynamic-client.as`). The
+ * three array fields are JSON-STRING columns (same opaque-string pattern as
+ * `tokenPolicy` above): a `string[]` column would need engine-specific array
+ * support, and all matching happens in `DynamicClientPolicy` after parse.
+ */
+interface DynamicClientRow {
+  clientId: string;
+  clientName?: string;
+  /** `JSON.stringify(string[])`. */
+  redirectUris: string;
+  tokenEndpointAuthMethod: string;
+  /** `JSON.stringify(string[])`. */
+  grantTypes: string;
+  /** `JSON.stringify(string[])`. */
+  responseTypes: string;
+  scope?: string;
+  createdAt: number;
+  lastUsedAt?: number;
+}
+/** Structural surface of `AtscriptDbTable` for the dynamic-client adapter. */
+interface DynamicClientTable {
+  insertOne(row: DynamicClientRow): Promise<{
+    insertedId: unknown;
+  }>;
+  findOne(query: {
+    filter: Record<string, unknown>;
+  }): Promise<DynamicClientRow | null>;
+  count(query: {
+    filter?: Record<string, unknown>;
+  }): Promise<number>;
+  replaceOne(row: DynamicClientRow): Promise<{
+    matchedCount: number;
+    modifiedCount: number;
+  }>;
+  deleteOne(idOrPk: unknown): Promise<{
+    deletedCount: number;
+  }>;
+  deleteMany(filter: Record<string, unknown>): Promise<{
+    deletedCount: number;
+  }>;
+}
+interface DynamicClientStoreAtscriptDbOptions {
+  table: DynamicClientTable;
+  /** Injectable clock for deterministic `createdAt`. Defaults to {@link defaultClock}. */
+  clock?: Clock;
+}
+/**
+ * Durable {@link DynamicClientStore}. Long-lived rows (a connector caches its
+ * `client_id` across grants). `touch` is the portable findOne + replaceOne
+ * (same trick as `CredentialStoreAtscriptDb.touch` — no engine-specific patch
+ * op); `deleteUnusedBefore` is one mass `deleteMany` over
+ * `createdAt < cutoff && lastUsedAt unset` — the never-used GC.
+ */
+declare class DynamicClientStoreAtscriptDb extends DynamicClientStore {
+  private readonly table;
+  private readonly clock;
+  constructor(opts: DynamicClientStoreAtscriptDbOptions);
+  create(rec: NewDynamicClient): Promise<DynamicClient>;
+  get(clientId: string): Promise<DynamicClient | null>;
+  delete(clientId: string): Promise<boolean>;
+  count(): Promise<number>;
+  touch(clientId: string, at: number): Promise<void>;
+  deleteUnusedBefore(cutoff: number): Promise<number>;
+}
 //#endregion
 //#region src/atscript-db/index.d.ts
 /**
@@ -219,4 +287,4 @@ declare class CredentialStoreAtscriptDb<TPayload extends object = object> implem
   }>>;
 }
 //#endregion
-export { AuthCodeRow, AuthCodeStoreAtscriptDb, AuthCodeStoreAtscriptDbOptions, AuthCodeTable, AuthCredentialRow, AuthCredentialTable, CredentialStoreAtscriptDb, PendingAuthorizationRow, PendingAuthorizationStoreAtscriptDb, PendingAuthorizationStoreAtscriptDbOptions, PendingAuthorizationTable };
+export { AuthCodeRow, AuthCodeStoreAtscriptDb, AuthCodeStoreAtscriptDbOptions, AuthCodeTable, AuthCredentialRow, AuthCredentialTable, CredentialStoreAtscriptDb, DynamicClientRow, DynamicClientStoreAtscriptDb, DynamicClientStoreAtscriptDbOptions, DynamicClientTable, PendingAuthorizationRow, PendingAuthorizationStoreAtscriptDb, PendingAuthorizationStoreAtscriptDbOptions, PendingAuthorizationTable };

package/dist/atscript-db.mjs

@@ -1,6 +1,6 @@
 import { t as defaultClock } from "./clock-Bdsep_1j.mjs";
 import { t as credentialPayloadOf } from "./payload-D-DzH5-J.mjs";
-import { a as PendingAuthorizationStore, t as AuthCodeStore } from "./auth-code-store-Dqc4rEOx.mjs";
+import { r as AuthCodeStore, s as PendingAuthorizationStore, t as DynamicClientStore } from "./dynamic-client-store-DLRfntHr.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/atscript-db/authz-stores.ts
 /**
@@ -31,7 +31,9 @@ var PendingAuthorizationStoreAtscriptDb = class extends PendingAuthorizationStor
 			createdAt: now,
 			expiresAt,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
+			...rec.clientName !== void 0 && { clientName: rec.clientName },
 			...rec.clientState !== void 0 && { clientState: rec.clientState },
+			...rec.resource !== void 0 && { resource: rec.resource },
 			...rec.scope !== void 0 && { scope: rec.scope },
 			...rec.nonce !== void 0 && { nonce: rec.nonce },
 			...rec.idToken !== void 0 && { idToken: rec.idToken },
@@ -68,7 +70,9 @@ function rowToPending(row) {
 		expiresAt: row.expiresAt
 	};
 	if (row.clientId != null) out.clientId = row.clientId;
+	if (row.clientName != null) out.clientName = row.clientName;
 	if (row.clientState != null) out.clientState = row.clientState;
+	if (row.resource != null) out.resource = row.resource;
 	if (row.scope != null) out.scope = row.scope;
 	if (row.nonce != null) out.nonce = row.nonce;
 	if (row.idToken != null) out.idToken = row.idToken;
@@ -106,6 +110,7 @@ var AuthCodeStoreAtscriptDb = class extends AuthCodeStore {
 			expiresAt: this.clock.now() + this.ttlMs,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
 			...rec.scope !== void 0 && { scope: rec.scope },
+			...rec.resource !== void 0 && { resource: rec.resource },
 			...rec.nonce !== void 0 && { nonce: rec.nonce },
 			...rec.idToken !== void 0 && { idToken: rec.idToken },
 			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
@@ -133,12 +138,83 @@ function rowToAuthCode(row) {
 	};
 	if (row.clientId != null) out.clientId = row.clientId;
 	if (row.scope != null) out.scope = row.scope;
+	if (row.resource != null) out.resource = row.resource;
 	if (row.nonce != null) out.nonce = row.nonce;
 	if (row.idToken != null) out.idToken = row.idToken;
 	if (row.accessToken != null) out.accessToken = row.accessToken;
 	if (row.audience != null) out.audience = row.audience;
 	return out;
 }
+/**
+* Durable {@link DynamicClientStore}. Long-lived rows (a connector caches its
+* `client_id` across grants). `touch` is the portable findOne + replaceOne
+* (same trick as `CredentialStoreAtscriptDb.touch` — no engine-specific patch
+* op); `deleteUnusedBefore` is one mass `deleteMany` over
+* `createdAt < cutoff && lastUsedAt unset` — the never-used GC.
+*/
+var DynamicClientStoreAtscriptDb = class extends DynamicClientStore {
+	table;
+	clock;
+	constructor(opts) {
+		super();
+		this.table = opts.table;
+		this.clock = opts.clock ?? defaultClock;
+	}
+	async create(rec) {
+		const row = {
+			clientId: randomUUID(),
+			redirectUris: JSON.stringify(rec.redirectUris),
+			tokenEndpointAuthMethod: rec.tokenEndpointAuthMethod,
+			grantTypes: JSON.stringify(rec.grantTypes),
+			responseTypes: JSON.stringify(rec.responseTypes),
+			createdAt: this.clock.now(),
+			...rec.clientName !== void 0 && { clientName: rec.clientName },
+			...rec.scope !== void 0 && { scope: rec.scope }
+		};
+		await this.table.insertOne(row);
+		return rowToDynamicClient(row);
+	}
+	async get(clientId) {
+		const row = await this.table.findOne({ filter: { clientId } });
+		return row ? rowToDynamicClient(row) : null;
+	}
+	async delete(clientId) {
+		const { deletedCount } = await this.table.deleteOne(clientId);
+		return deletedCount > 0;
+	}
+	async count() {
+		return this.table.count({});
+	}
+	async touch(clientId, at) {
+		const row = await this.table.findOne({ filter: { clientId } });
+		if (!row) return;
+		await this.table.replaceOne({
+			...row,
+			lastUsedAt: at
+		});
+	}
+	async deleteUnusedBefore(cutoff) {
+		const { deletedCount } = await this.table.deleteMany({
+			createdAt: { $lt: cutoff },
+			lastUsedAt: { $exists: false }
+		});
+		return deletedCount;
+	}
+};
+function rowToDynamicClient(row) {
+	const out = {
+		clientId: row.clientId,
+		redirectUris: JSON.parse(row.redirectUris),
+		tokenEndpointAuthMethod: row.tokenEndpointAuthMethod,
+		grantTypes: JSON.parse(row.grantTypes),
+		responseTypes: JSON.parse(row.responseTypes),
+		createdAt: row.createdAt
+	};
+	if (row.clientName != null) out.clientName = row.clientName;
+	if (row.scope != null) out.scope = row.scope;
+	if (row.lastUsedAt != null) out.lastUsedAt = row.lastUsedAt;
+	return out;
+}
 //#endregion
 //#region src/atscript-db/index.ts
 /**
@@ -260,4 +336,4 @@ function rowToState(row) {
 	return state;
 }
 //#endregion
-export { AuthCodeStoreAtscriptDb, CredentialStoreAtscriptDb, PendingAuthorizationStoreAtscriptDb };
+export { AuthCodeStoreAtscriptDb, CredentialStoreAtscriptDb, DynamicClientStoreAtscriptDb, PendingAuthorizationStoreAtscriptDb };