@aooth/auth 0.1.18 → 0.1.19

package/dist/{auth-code-store-BZ88d_tq.d.cts → dynamic-client-store-DzqdUwnw.d.cts}

@@ -39,12 +39,25 @@ interface PendingAuthorization {
   handle: string;
   /** Registered client id (Tier 2), absent for a public/loopback client. */
   clientId?: string;
+  /**
+   * Display name resolved at `/authorize` (DCR `client_name` or a registered
+   * client's label) — UNTRUSTED text staged for the consent prompt; render as
+   * a text node only. Snapshot-at-authorize: a later rename/GC of the
+   * registration doesn't change what consent shows for this grant.
+   */
+  clientName?: string;
   /** The client's validated `redirect_uri` — where the code is delivered. */
   redirectUri: string;
   /** PKCE S256 challenge (client-generated); verified against the verifier at `/token`. */
   codeChallenge: string;
   /** The client's `state`, echoed back on the redirect so the client can correlate. */
   clientState?: string;
+  /**
+   * RFC 8707 `resource` indicator from the authorize request. v1 records it
+   * (and checks `/token`-leg consistency) without audience enforcement — see
+   * OAUTH.md R4.
+   */
+  resource?: string;
   /** Granted scope (space-joined) — `requested ∩ allowed`; drives the `id_token` profile claims. */
   scope?: string;
   /** OIDC `nonce` from the authorize request — echoed into the `id_token` (Tier 2). */
@@ -72,9 +85,11 @@ interface PendingAuthorization {
 /** Input to {@link PendingAuthorizationStore.create} — `handle`/timestamps are store-assigned. */
 interface NewPendingAuthorization {
   clientId?: string;
+  clientName?: string;
   redirectUri: string;
   codeChallenge: string;
   clientState?: string;
+  resource?: string;
   scope?: string;
   nonce?: string;
   idToken?: boolean;
@@ -152,6 +167,12 @@ interface AuthCode {
   clientId?: string;
   /** Granted scope (space-joined) — drives the `id_token` profile claims. */
   scope?: string;
+  /**
+   * RFC 8707 `resource` indicator recorded at `/authorize`. The token endpoint
+   * checks consistency (a `/token`-leg `resource` must match) — no audience
+   * enforcement in v1 (OAUTH.md R4).
+   */
+  resource?: string;
   /** OIDC `nonce` from the authorize request — echoed into the `id_token` (Tier 2). */
   nonce?: string;
   /** Mint an `id_token` at `/token` (Tier 2). */
@@ -171,6 +192,7 @@ interface NewAuthCode {
   redirectUri: string;
   clientId?: string;
   scope?: string;
+  resource?: string;
   nonce?: string;
   idToken?: boolean;
   accessToken?: boolean;
@@ -216,4 +238,93 @@ declare class AuthCodeStoreMemory extends AuthCodeStore {
   consume(code: string): Promise<AuthCode | null>;
 }
 //#endregion
-export { NewAuthCode as a, PendingAuthorization as c, PendingAuthorizationStoreMemoryOptions as d, TokenPolicy as f, AuthCodeStoreMemoryOptions as i, PendingAuthorizationStore as l, AuthCodeStore as n, DEFAULT_PENDING_TTL_MS as o, AuthCodeStoreMemory as r, NewPendingAuthorization as s, AuthCode as t, PendingAuthorizationStoreMemory as u };
+//#region src/authz/dynamic-client-store.d.ts
+/**
+ * One dynamically-registered OAuth client (RFC 7591) — the record behind a
+ * connector-style public client that self-registered at `POST /register`.
+ * Everything here is **registrant-supplied** (post-validation) except
+ * `clientId` and the timestamps: treat `clientName` as untrusted display text
+ * and `redirectUris` as the exact-match delivery allowlist that
+ * `DynamicClientPolicy` enforces at `/authorize`.
+ */
+interface DynamicClient {
+  /** Store-minted opaque client identifier (the DCR response `client_id`). */
+  clientId: string;
+  /** Sanitized display name (DCR `client_name`) — untrusted, rendered as text on consent. */
+  clientName?: string;
+  /** Validated redirect allowlist — https exact-match entries and/or loopback literals. */
+  redirectUris: string[];
+  /** v1 supports public clients only — PKCE is the binding, no secret exists. */
+  tokenEndpointAuthMethod: "none";
+  /** Registered grant types (narrowed to what the server supports). */
+  grantTypes: string[];
+  /** Registered response types (narrowed to what the server supports). */
+  responseTypes: string[];
+  /** Scope string from registration (space-joined) — an upper bound, not a grant. */
+  scope?: string;
+  createdAt: number;
+  /**
+   * Last time the client started an authorize request. Unset ⇒ the
+   * registration was never used — the garbage-collection target of
+   * {@link DynamicClientStore.deleteUnusedBefore} (anonymous `/register` spam
+   * registers but never authorizes).
+   */
+  lastUsedAt?: number;
+}
+/** Input to {@link DynamicClientStore.create} — `clientId`/timestamps are store-assigned. */
+interface NewDynamicClient {
+  clientName?: string;
+  redirectUris: string[];
+  tokenEndpointAuthMethod: "none";
+  grantTypes: string[];
+  responseTypes: string[];
+  scope?: string;
+}
+/**
+ * Storage seam for dynamically-registered clients (OAUTH.md R2). Long-lived
+ * (unlike the pending-auth / auth-code stores): a connector caches its
+ * `client_id` and reuses it across grants, so rows survive until deleted or
+ * garbage-collected as never-used. An in-memory impl ships for single-process
+ * apps + tests; a durable impl (atscript-db) slots under the same
+ * `DYNAMIC_CLIENT_STORE_TOKEN` (from `@aooth/auth-moost`).
+ */
+declare abstract class DynamicClientStore {
+  /** Persist a validated registration; mints and returns the full record (with `clientId`). */
+  abstract create(rec: NewDynamicClient): Promise<DynamicClient>;
+  /** Fetch by client id, or `null` when unknown. */
+  abstract get(clientId: string): Promise<DynamicClient | null>;
+  /** Remove a registration. Returns `true` when a row was removed. */
+  abstract delete(clientId: string): Promise<boolean>;
+  /** Number of stored registrations — the `maxClients` hard-cap check. */
+  abstract count(): Promise<number>;
+  /** Stamp `lastUsedAt` — marks the registration as used (exempt from never-used GC). */
+  abstract touch(clientId: string, at: number): Promise<void>;
+  /**
+   * Garbage-collect never-used registrations: delete rows with
+   * `createdAt < cutoff` AND no `lastUsedAt`. Returns the number removed.
+   * Used rows are NEVER evicted — a connector caches its `client_id`, and
+   * evicting it strands the client (see OAUTH.md R2 abuse posture).
+   */
+  abstract deleteUnusedBefore(cutoff: number): Promise<number>;
+}
+interface DynamicClientStoreMemoryOptions {
+  /** Injectable clock for deterministic `createdAt`. Defaults to {@link defaultClock}. */
+  clock?: Clock;
+}
+/**
+ * In-memory {@link DynamicClientStore} — the reference impl for a
+ * single-process app + tests. `structuredClone` on read/write isolates callers.
+ */
+declare class DynamicClientStoreMemory extends DynamicClientStore {
+  private store;
+  private clock;
+  constructor(opts?: DynamicClientStoreMemoryOptions);
+  create(rec: NewDynamicClient): Promise<DynamicClient>;
+  get(clientId: string): Promise<DynamicClient | null>;
+  delete(clientId: string): Promise<boolean>;
+  count(): Promise<number>;
+  touch(clientId: string, at: number): Promise<void>;
+  deleteUnusedBefore(cutoff: number): Promise<number>;
+}
+//#endregion
+export { TokenPolicy as _, NewDynamicClient as a, AuthCodeStoreMemory as c, DEFAULT_PENDING_TTL_MS as d, NewPendingAuthorization as f, PendingAuthorizationStoreMemoryOptions as g, PendingAuthorizationStoreMemory as h, DynamicClientStoreMemoryOptions as i, AuthCodeStoreMemoryOptions as l, PendingAuthorizationStore as m, DynamicClientStore as n, AuthCode as o, PendingAuthorization as p, DynamicClientStoreMemory as r, AuthCodeStore as s, DynamicClient as t, NewAuthCode as u };

package/dist/{auth-code-store-Om5MXNUT.d.mts → dynamic-client-store-oHEsQaJg.d.mts}

@@ -39,12 +39,25 @@ interface PendingAuthorization {
   handle: string;
   /** Registered client id (Tier 2), absent for a public/loopback client. */
   clientId?: string;
+  /**
+   * Display name resolved at `/authorize` (DCR `client_name` or a registered
+   * client's label) — UNTRUSTED text staged for the consent prompt; render as
+   * a text node only. Snapshot-at-authorize: a later rename/GC of the
+   * registration doesn't change what consent shows for this grant.
+   */
+  clientName?: string;
   /** The client's validated `redirect_uri` — where the code is delivered. */
   redirectUri: string;
   /** PKCE S256 challenge (client-generated); verified against the verifier at `/token`. */
   codeChallenge: string;
   /** The client's `state`, echoed back on the redirect so the client can correlate. */
   clientState?: string;
+  /**
+   * RFC 8707 `resource` indicator from the authorize request. v1 records it
+   * (and checks `/token`-leg consistency) without audience enforcement — see
+   * OAUTH.md R4.
+   */
+  resource?: string;
   /** Granted scope (space-joined) — `requested ∩ allowed`; drives the `id_token` profile claims. */
   scope?: string;
   /** OIDC `nonce` from the authorize request — echoed into the `id_token` (Tier 2). */
@@ -72,9 +85,11 @@ interface PendingAuthorization {
 /** Input to {@link PendingAuthorizationStore.create} — `handle`/timestamps are store-assigned. */
 interface NewPendingAuthorization {
   clientId?: string;
+  clientName?: string;
   redirectUri: string;
   codeChallenge: string;
   clientState?: string;
+  resource?: string;
   scope?: string;
   nonce?: string;
   idToken?: boolean;
@@ -152,6 +167,12 @@ interface AuthCode {
   clientId?: string;
   /** Granted scope (space-joined) — drives the `id_token` profile claims. */
   scope?: string;
+  /**
+   * RFC 8707 `resource` indicator recorded at `/authorize`. The token endpoint
+   * checks consistency (a `/token`-leg `resource` must match) — no audience
+   * enforcement in v1 (OAUTH.md R4).
+   */
+  resource?: string;
   /** OIDC `nonce` from the authorize request — echoed into the `id_token` (Tier 2). */
   nonce?: string;
   /** Mint an `id_token` at `/token` (Tier 2). */
@@ -171,6 +192,7 @@ interface NewAuthCode {
   redirectUri: string;
   clientId?: string;
   scope?: string;
+  resource?: string;
   nonce?: string;
   idToken?: boolean;
   accessToken?: boolean;
@@ -216,4 +238,93 @@ declare class AuthCodeStoreMemory extends AuthCodeStore {
   consume(code: string): Promise<AuthCode | null>;
 }
 //#endregion
-export { NewAuthCode as a, PendingAuthorization as c, PendingAuthorizationStoreMemoryOptions as d, TokenPolicy as f, AuthCodeStoreMemoryOptions as i, PendingAuthorizationStore as l, AuthCodeStore as n, DEFAULT_PENDING_TTL_MS as o, AuthCodeStoreMemory as r, NewPendingAuthorization as s, AuthCode as t, PendingAuthorizationStoreMemory as u };
+//#region src/authz/dynamic-client-store.d.ts
+/**
+ * One dynamically-registered OAuth client (RFC 7591) — the record behind a
+ * connector-style public client that self-registered at `POST /register`.
+ * Everything here is **registrant-supplied** (post-validation) except
+ * `clientId` and the timestamps: treat `clientName` as untrusted display text
+ * and `redirectUris` as the exact-match delivery allowlist that
+ * `DynamicClientPolicy` enforces at `/authorize`.
+ */
+interface DynamicClient {
+  /** Store-minted opaque client identifier (the DCR response `client_id`). */
+  clientId: string;
+  /** Sanitized display name (DCR `client_name`) — untrusted, rendered as text on consent. */
+  clientName?: string;
+  /** Validated redirect allowlist — https exact-match entries and/or loopback literals. */
+  redirectUris: string[];
+  /** v1 supports public clients only — PKCE is the binding, no secret exists. */
+  tokenEndpointAuthMethod: "none";
+  /** Registered grant types (narrowed to what the server supports). */
+  grantTypes: string[];
+  /** Registered response types (narrowed to what the server supports). */
+  responseTypes: string[];
+  /** Scope string from registration (space-joined) — an upper bound, not a grant. */
+  scope?: string;
+  createdAt: number;
+  /**
+   * Last time the client started an authorize request. Unset ⇒ the
+   * registration was never used — the garbage-collection target of
+   * {@link DynamicClientStore.deleteUnusedBefore} (anonymous `/register` spam
+   * registers but never authorizes).
+   */
+  lastUsedAt?: number;
+}
+/** Input to {@link DynamicClientStore.create} — `clientId`/timestamps are store-assigned. */
+interface NewDynamicClient {
+  clientName?: string;
+  redirectUris: string[];
+  tokenEndpointAuthMethod: "none";
+  grantTypes: string[];
+  responseTypes: string[];
+  scope?: string;
+}
+/**
+ * Storage seam for dynamically-registered clients (OAUTH.md R2). Long-lived
+ * (unlike the pending-auth / auth-code stores): a connector caches its
+ * `client_id` and reuses it across grants, so rows survive until deleted or
+ * garbage-collected as never-used. An in-memory impl ships for single-process
+ * apps + tests; a durable impl (atscript-db) slots under the same
+ * `DYNAMIC_CLIENT_STORE_TOKEN` (from `@aooth/auth-moost`).
+ */
+declare abstract class DynamicClientStore {
+  /** Persist a validated registration; mints and returns the full record (with `clientId`). */
+  abstract create(rec: NewDynamicClient): Promise<DynamicClient>;
+  /** Fetch by client id, or `null` when unknown. */
+  abstract get(clientId: string): Promise<DynamicClient | null>;
+  /** Remove a registration. Returns `true` when a row was removed. */
+  abstract delete(clientId: string): Promise<boolean>;
+  /** Number of stored registrations — the `maxClients` hard-cap check. */
+  abstract count(): Promise<number>;
+  /** Stamp `lastUsedAt` — marks the registration as used (exempt from never-used GC). */
+  abstract touch(clientId: string, at: number): Promise<void>;
+  /**
+   * Garbage-collect never-used registrations: delete rows with
+   * `createdAt < cutoff` AND no `lastUsedAt`. Returns the number removed.
+   * Used rows are NEVER evicted — a connector caches its `client_id`, and
+   * evicting it strands the client (see OAUTH.md R2 abuse posture).
+   */
+  abstract deleteUnusedBefore(cutoff: number): Promise<number>;
+}
+interface DynamicClientStoreMemoryOptions {
+  /** Injectable clock for deterministic `createdAt`. Defaults to {@link defaultClock}. */
+  clock?: Clock;
+}
+/**
+ * In-memory {@link DynamicClientStore} — the reference impl for a
+ * single-process app + tests. `structuredClone` on read/write isolates callers.
+ */
+declare class DynamicClientStoreMemory extends DynamicClientStore {
+  private store;
+  private clock;
+  constructor(opts?: DynamicClientStoreMemoryOptions);
+  create(rec: NewDynamicClient): Promise<DynamicClient>;
+  get(clientId: string): Promise<DynamicClient | null>;
+  delete(clientId: string): Promise<boolean>;
+  count(): Promise<number>;
+  touch(clientId: string, at: number): Promise<void>;
+  deleteUnusedBefore(cutoff: number): Promise<number>;
+}
+//#endregion
+export { TokenPolicy as _, NewDynamicClient as a, AuthCodeStoreMemory as c, DEFAULT_PENDING_TTL_MS as d, NewPendingAuthorization as f, PendingAuthorizationStoreMemoryOptions as g, PendingAuthorizationStoreMemory as h, DynamicClientStoreMemoryOptions as i, AuthCodeStoreMemoryOptions as l, PendingAuthorizationStore as m, DynamicClientStore as n, AuthCode as o, PendingAuthorization as p, DynamicClientStoreMemory as r, AuthCodeStore as s, DynamicClient as t, NewAuthCode as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/auth",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "description": "Auth method layer for aoothjs (sessions, tokens, password reset, MFA primitives)",
   "keywords": [
     "aoothjs",
@@ -30,7 +30,9 @@
     "src/atscript-db/pending-authorization.as",
     "src/atscript-db/pending-authorization.as.d.ts",
     "src/atscript-db/auth-code.as",
-    "src/atscript-db/auth-code.as.d.ts"
+    "src/atscript-db/auth-code.as.d.ts",
+    "src/atscript-db/dynamic-client.as",
+    "src/atscript-db/dynamic-client.as.d.ts"
   ],
   "type": "module",
   "sideEffects": false,
@@ -87,6 +89,14 @@
       "types": "./src/atscript-db/auth-code.as.d.ts",
       "default": "./src/atscript-db/auth-code.as"
     },
+    "./atscript-db/dynamic-client": {
+      "types": "./src/atscript-db/dynamic-client.as.d.ts",
+      "default": "./src/atscript-db/dynamic-client.as"
+    },
+    "./atscript-db/dynamic-client.as": {
+      "types": "./src/atscript-db/dynamic-client.as.d.ts",
+      "default": "./src/atscript-db/dynamic-client.as"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {
@@ -94,7 +104,7 @@
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@aooth/user": "0.1.18"
+    "@aooth/user": "0.1.19"
   },
   "devDependencies": {
     "@atscript/core": "^0.1.75",

package/src/atscript-db/auth-code.as

@@ -21,6 +21,8 @@ export interface AoothAuthCode {
     clientId?: string
     /** Granted scope (space-joined). */
     scope?: string
+    /** RFC 8707 `resource` indicator (recorded; consistency-checked at /token). */
+    resource?: string
     /** OIDC `nonce`, echoed into the `id_token` (Tier 2). */
     nonce?: string
     /** Mint an `id_token` at `/token` (Tier 2). */

package/src/atscript-db/auth-code.as.d.ts

@@ -20,6 +20,7 @@ export declare class AoothAuthCode {
   redirectUri: string
   clientId?: string
   scope?: string
+  resource?: string
   nonce?: string
   idToken?: boolean
   accessToken?: boolean
@@ -41,6 +42,7 @@ export declare class AoothAuthCode {
     "redirectUri": string
     "clientId"?: string
     "scope"?: string
+    "resource"?: string
     "nonce"?: string
     "idToken"?: boolean
     "accessToken"?: boolean
@@ -55,6 +57,7 @@ export declare class AoothAuthCode {
     "redirectUri": string
     "clientId"?: string
     "scope"?: string
+    "resource"?: string
     "nonce"?: string
     "idToken"?: boolean
     "accessToken"?: boolean

package/src/atscript-db/dynamic-client.as

@@ -0,0 +1,44 @@
+@db.table 'aooth_dynamic_clients'
+@db.depth.limit 0
+export interface AoothDynamicClient {
+    /**
+     * Opaque client identifier (PK) — the DCR response `client_id`.
+     * Server-generated UUID in `DynamicClientStoreAtscriptDb.create`.
+     */
+    @meta.id
+    clientId: string
+
+    /**
+     * Sanitized DCR `client_name` — untrusted registrant-supplied display text
+     * for the consent prompt; rendered as a text node only.
+     */
+    clientName?: string
+
+    /**
+     * Validated redirect allowlist, serialized as a JSON string array — same
+     * opaque-string pattern as `AoothPendingAuthorization.tokenPolicy` (a
+     * string[] column would need engine-specific array support; the adapter
+     * (de)serializes at the boundary and matching happens in
+     * `DynamicClientPolicy`).
+     */
+    redirectUris: string
+
+    /** v1 supports public clients only ("none") — PKCE is the binding. */
+    tokenEndpointAuthMethod: string
+
+    /** Registered grant types (narrowed to supported), JSON string array. */
+    grantTypes: string
+    /** Registered response types (narrowed to supported), JSON string array. */
+    responseTypes: string
+
+    /** Scope string from registration (space-joined) — an upper bound, not a grant. */
+    scope?: string
+
+    createdAt: number.timestamp
+    /**
+     * Last authorize-request use. Unset ⇒ never used — the GC target of
+     * `deleteUnusedBefore` (anonymous /register spam registers but never
+     * authorizes). Used rows are never evicted.
+     */
+    lastUsedAt?: number.timestamp
+}

package/src/atscript-db/dynamic-client.as.d.ts

@@ -0,0 +1,59 @@
+// prettier-ignore-start
+/* eslint-disable */
+/* oxlint-disable */
+/// <reference path="./dynamic-client.as" />
+/**
+ * 🪄 This file was generated by Atscript
+ * Do not edit this file!
+ */
+
+import type { TAtscriptTypeObject, TAtscriptTypeComplex, TAtscriptTypeFinal, TAtscriptTypeArray, TAtscriptAnnotatedType, TMetadataMap, Validator, TValidatorOptions } from "@atscript/typescript/utils"
+
+/**
+ * Atscript interface **AoothDynamicClient**
+ * @see {@link ./dynamic-client.as:3:18}
+ */
+export declare class AoothDynamicClient {
+  clientId: string
+  clientName?: string
+  redirectUris: string
+  tokenEndpointAuthMethod: string
+  grantTypes: string
+  responseTypes: string
+  scope?: string
+  createdAt: number /* timestamp */
+  lastUsedAt?: number /* timestamp */
+  static __is_atscript_annotated_type: true
+  static type: TAtscriptTypeObject<keyof AoothDynamicClient, AoothDynamicClient>
+  static metadata: TMetadataMap<AtscriptMetadata>
+  static validator: (opts?: Partial<TValidatorOptions>) => Validator<typeof AoothDynamicClient>
+  /** @deprecated JSON Schema support is disabled. Calling this method will throw a runtime error. To enable, set `jsonSchema: 'lazy'` or `jsonSchema: 'bundle'` in tsPlugin options, or add `@emit.jsonSchema` annotation to individual interfaces. */
+  static toJsonSchema: () => any
+  /** @deprecated Example Data support is disabled. To enable, set `exampleData: true` in tsPlugin options. */
+  static toExampleData?: () => any
+  static __flat: {
+    "clientId": string
+    "clientName"?: string
+    "redirectUris": string
+    "tokenEndpointAuthMethod": string
+    "grantTypes": string
+    "responseTypes": string
+    "scope"?: string
+    "createdAt": number /* timestamp */
+    "lastUsedAt"?: number /* timestamp */
+  }
+  static __ownProps: {
+    "clientId": string
+    "clientName"?: string
+    "redirectUris": string
+    "tokenEndpointAuthMethod": string
+    "grantTypes": string
+    "responseTypes": string
+    "scope"?: string
+    "createdAt": number /* timestamp */
+    "lastUsedAt"?: number /* timestamp */
+  }
+  
+  static __pk: string
+}
+// prettier-ignore-end

package/src/atscript-db/pending-authorization.as

@@ -15,8 +15,15 @@ export interface AoothPendingAuthorization {
 
     /** Registered client id (Tier 2); absent for a public/loopback client. */
     clientId?: string
+    /**
+     * Display name resolved at /authorize (DCR `client_name` or a registered
+     * client's label) — untrusted text staged for the consent prompt.
+     */
+    clientName?: string
     /** The client's `state`, echoed back on the redirect so it can correlate. */
     clientState?: string
+    /** RFC 8707 `resource` indicator (recorded; consistency-checked at /token). */
+    resource?: string
     /** Granted scope (space-joined). */
     scope?: string
     /** OIDC `nonce`, echoed into the `id_token` (Tier 2). */

package/src/atscript-db/pending-authorization.as.d.ts

@@ -18,7 +18,9 @@ export declare class AoothPendingAuthorization {
   redirectUri: string
   codeChallenge: string
   clientId?: string
+  clientName?: string
   clientState?: string
+  resource?: string
   scope?: string
   nonce?: string
   idToken?: boolean
@@ -41,7 +43,9 @@ export declare class AoothPendingAuthorization {
     "redirectUri": string
     "codeChallenge": string
     "clientId"?: string
+    "clientName"?: string
     "clientState"?: string
+    "resource"?: string
     "scope"?: string
     "nonce"?: string
     "idToken"?: boolean
@@ -57,7 +61,9 @@ export declare class AoothPendingAuthorization {
     "redirectUri": string
     "codeChallenge": string
     "clientId"?: string
+    "clientName"?: string
     "clientState"?: string
+    "resource"?: string
     "scope"?: string
     "nonce"?: string
     "idToken"?: boolean