@aooth/auth 0.1.6 → 0.1.8

package/dist/atscript-db.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_payload = require("./payload-BJjvj8AH.cjs");
 let node_crypto = require("node:crypto");
 //#region src/atscript-db/index.ts
 /**
@@ -22,18 +23,7 @@ var CredentialStoreAtscriptDb = class {
 	async persist(state, ttl) {
 		const token = (0, node_crypto.randomUUID)();
 		const expiresAt = typeof ttl === "number" ? Date.now() + ttl : state.expiresAt;
-		const row = {
-			token,
-			userId: state.userId,
-			issuedAt: state.issuedAt,
-			expiresAt,
-			kind: state.kind,
-			claims: state.claims,
-			metadata: state.metadata,
-			parentCredentialId: state.parentCredentialId,
-			rotatedAt: state.rotatedAt
-		};
-		await this.table.insertOne(row);
+		await this.table.insertOne(stateToRow(state, token, expiresAt));
 		return token;
 	}
 	async retrieve(token) {
@@ -57,23 +47,21 @@ var CredentialStoreAtscriptDb = class {
 			await this.revoke(token);
 			return token;
 		}
-		const row = {
-			token,
-			userId: state.userId,
-			issuedAt: state.issuedAt,
-			expiresAt: state.expiresAt,
-			kind: state.kind,
-			claims: state.claims,
-			metadata: state.metadata,
-			parentCredentialId: state.parentCredentialId,
-			rotatedAt: state.rotatedAt
-		};
-		await this.table.replaceOne(row);
+		await this.table.replaceOne(stateToRow(state, token, state.expiresAt));
 		return token;
 	}
 	async revoke(token) {
 		await this.table.deleteOne(token);
 	}
+	async touch(token, at) {
+		const row = await this.table.findOne({ filter: { token } });
+		if (!row) return;
+		if (row.expiresAt <= Date.now()) return;
+		await this.table.replaceOne({
+			...row,
+			lastSeenAt: at
+		});
+	}
 	async revokeAllForUser(userId) {
 		return (await this.table.deleteMany({ userId })).deletedCount;
 	}
@@ -96,17 +84,40 @@ var CredentialStoreAtscriptDb = class {
 		return out;
 	}
 };
+/**
+* Build the persisted row from a credential state: typed payload columns first
+* (so an envelope field wins a name clash), then the fixed envelope fields and
+* the resolved `token` + `expiresAt`. Shared by `persist` and `update`, which
+* differ only in the `expiresAt` they resolve.
+*/
+function stateToRow(state, token, expiresAt) {
+	return {
+		...require_payload.credentialPayloadOf(state),
+		token,
+		userId: state.userId,
+		issuedAt: state.issuedAt,
+		expiresAt,
+		kind: state.kind,
+		metadata: state.metadata,
+		parentCredentialId: state.parentCredentialId,
+		rotatedAt: state.rotatedAt,
+		sessionId: state.sessionId,
+		lastSeenAt: state.lastSeenAt
+	};
+}
 function rowToState(row) {
 	const state = {
+		...require_payload.credentialPayloadOf(row),
 		userId: row.userId,
 		issuedAt: row.issuedAt,
 		expiresAt: row.expiresAt
 	};
-	if (row.claims !== void 0) state.claims = row.claims;
 	if (row.metadata !== void 0) state.metadata = row.metadata;
 	if (row.kind === "access" || row.kind === "refresh") state.kind = row.kind;
 	if (row.parentCredentialId !== void 0) state.parentCredentialId = row.parentCredentialId;
 	if (row.rotatedAt !== void 0) state.rotatedAt = row.rotatedAt;
+	if (row.sessionId !== void 0) state.sessionId = row.sessionId;
+	if (row.lastSeenAt !== void 0) state.lastSeenAt = row.lastSeenAt;
 	return state;
 }
 //#endregion

package/dist/atscript-db.d.cts

@@ -1,20 +1,23 @@
-import { a as CredentialState, t as CredentialStore } from "./store-untAtWQz.cjs";
+import { a as CredentialState, t as CredentialStore } from "./store-BG6m6oSJ.cjs";
 
 //#region src/atscript-db/index.d.ts
 /**
  * Persisted row shape — mirrors `AoothAuthCredential` from
- * `./auth-credential.as`. Re-declared here as a plain TS interface so
- * consumers can use the adapter without running the atscript build (and so
- * `@aooth/auth` doesn't need to depend on `@atscript/typescript` at build
- * time). When you DO wire the `.as` model, the shapes match by construction.
+ * `./auth-credential.as`. Re-declared here as a plain TS type so consumers can
+ * use the adapter without running the atscript build (and so `@aooth/auth`
+ * doesn't need to depend on `@atscript/typescript` at build time). When you DO
+ * wire the `.as` model, the shapes match by construction.
+ *
+ * The consumer's typed payload `TPayload` (the root fields they add to their
+ * `extends AoothAuthCredential` model) is intersected flat — those become real
+ * typed columns, replacing the dropped free-form `claims` blob.
  */
-interface AuthCredentialRow<TClaims extends object = object> {
+type AuthCredentialRow<TPayload extends object = object> = {
   token: string;
   userId: string;
   issuedAt: number;
   expiresAt: number;
   kind?: string;
-  claims?: TClaims;
   metadata?: {
     ip?: string;
     userAgent?: string;
@@ -23,25 +26,27 @@ interface AuthCredentialRow<TClaims extends object = object> {
   };
   parentCredentialId?: string;
   rotatedAt?: number;
-}
+  sessionId?: string;
+  lastSeenAt?: number;
+} & TPayload;
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this
  * adapter calls. Kept loose to avoid pulling `@atscript/db` types into the
  * `@aooth/auth` public surface — consumers pass `db.getTable(AoothAuthCredential)`
  * directly and TypeScript matches by-shape.
  */
-interface AuthCredentialTable<TClaims extends object = object> {
-  insertOne(row: AuthCredentialRow<TClaims>): Promise<{
+interface AuthCredentialTable<TPayload extends object = object> {
+  insertOne(row: AuthCredentialRow<TPayload>): Promise<{
     insertedId: unknown;
   }>;
   findOne(query: {
     filter: Record<string, unknown>;
-  }): Promise<AuthCredentialRow<TClaims> | null>;
+  }): Promise<AuthCredentialRow<TPayload> | null>;
   findMany(query: {
     filter?: Record<string, unknown>;
     controls?: Record<string, unknown>;
-  }): Promise<AuthCredentialRow<TClaims>[]>;
-  replaceOne(row: AuthCredentialRow<TClaims>): Promise<{
+  }): Promise<AuthCredentialRow<TPayload>[]>;
+  replaceOne(row: AuthCredentialRow<TPayload>): Promise<{
     matchedCount: number;
     modifiedCount: number;
   }>;
@@ -52,8 +57,8 @@ interface AuthCredentialTable<TClaims extends object = object> {
     deletedCount: number;
   }>;
 }
-interface CredentialStoreAtscriptDbOptions<TClaims extends object> {
-  table: AuthCredentialTable<TClaims>;
+interface CredentialStoreAtscriptDbOptions<TPayload extends object> {
+  table: AuthCredentialTable<TPayload>;
 }
 /**
  * atscript-db-backed `CredentialStore`.
@@ -68,16 +73,17 @@ interface CredentialStoreAtscriptDbOptions<TClaims extends object> {
  * `.as` model). Custom tables must keep `token` as PK or override the
  * adapter.
  */
-declare class CredentialStoreAtscriptDb<TClaims extends object = object> implements CredentialStore<TClaims> {
+declare class CredentialStoreAtscriptDb<TPayload extends object = object> implements CredentialStore<TPayload> {
   private readonly table;
-  constructor(opts: CredentialStoreAtscriptDbOptions<TClaims>);
-  persist(state: CredentialState<TClaims>, ttl?: number): Promise<string>;
-  retrieve(token: string): Promise<CredentialState<TClaims> | null>;
-  consume(token: string): Promise<CredentialState<TClaims> | null>;
-  update(token: string, state: CredentialState<TClaims>): Promise<string>;
+  constructor(opts: CredentialStoreAtscriptDbOptions<TPayload>);
+  persist(state: CredentialState & TPayload, ttl?: number): Promise<string>;
+  retrieve(token: string): Promise<(CredentialState & TPayload) | null>;
+  consume(token: string): Promise<(CredentialState & TPayload) | null>;
+  update(token: string, state: CredentialState & TPayload): Promise<string>;
   revoke(token: string): Promise<void>;
+  touch(token: string, at: number): Promise<void>;
   revokeAllForUser(userId: string): Promise<number>;
-  listForUser(userId: string): Promise<Array<CredentialState<TClaims> & {
+  listForUser(userId: string): Promise<Array<CredentialState & TPayload & {
     token: string;
   }>>;
 }

package/dist/atscript-db.d.mts

@@ -1,20 +1,23 @@
-import { a as CredentialState, t as CredentialStore } from "./store-B1t8KkfA.mjs";
+import { a as CredentialState, t as CredentialStore } from "./store-BG6m6oSJ.mjs";
 
 //#region src/atscript-db/index.d.ts
 /**
  * Persisted row shape — mirrors `AoothAuthCredential` from
- * `./auth-credential.as`. Re-declared here as a plain TS interface so
- * consumers can use the adapter without running the atscript build (and so
- * `@aooth/auth` doesn't need to depend on `@atscript/typescript` at build
- * time). When you DO wire the `.as` model, the shapes match by construction.
+ * `./auth-credential.as`. Re-declared here as a plain TS type so consumers can
+ * use the adapter without running the atscript build (and so `@aooth/auth`
+ * doesn't need to depend on `@atscript/typescript` at build time). When you DO
+ * wire the `.as` model, the shapes match by construction.
+ *
+ * The consumer's typed payload `TPayload` (the root fields they add to their
+ * `extends AoothAuthCredential` model) is intersected flat — those become real
+ * typed columns, replacing the dropped free-form `claims` blob.
  */
-interface AuthCredentialRow<TClaims extends object = object> {
+type AuthCredentialRow<TPayload extends object = object> = {
   token: string;
   userId: string;
   issuedAt: number;
   expiresAt: number;
   kind?: string;
-  claims?: TClaims;
   metadata?: {
     ip?: string;
     userAgent?: string;
@@ -23,25 +26,27 @@ interface AuthCredentialRow<TClaims extends object = object> {
   };
   parentCredentialId?: string;
   rotatedAt?: number;
-}
+  sessionId?: string;
+  lastSeenAt?: number;
+} & TPayload;
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this
  * adapter calls. Kept loose to avoid pulling `@atscript/db` types into the
  * `@aooth/auth` public surface — consumers pass `db.getTable(AoothAuthCredential)`
  * directly and TypeScript matches by-shape.
  */
-interface AuthCredentialTable<TClaims extends object = object> {
-  insertOne(row: AuthCredentialRow<TClaims>): Promise<{
+interface AuthCredentialTable<TPayload extends object = object> {
+  insertOne(row: AuthCredentialRow<TPayload>): Promise<{
     insertedId: unknown;
   }>;
   findOne(query: {
     filter: Record<string, unknown>;
-  }): Promise<AuthCredentialRow<TClaims> | null>;
+  }): Promise<AuthCredentialRow<TPayload> | null>;
   findMany(query: {
     filter?: Record<string, unknown>;
     controls?: Record<string, unknown>;
-  }): Promise<AuthCredentialRow<TClaims>[]>;
-  replaceOne(row: AuthCredentialRow<TClaims>): Promise<{
+  }): Promise<AuthCredentialRow<TPayload>[]>;
+  replaceOne(row: AuthCredentialRow<TPayload>): Promise<{
     matchedCount: number;
     modifiedCount: number;
   }>;
@@ -52,8 +57,8 @@ interface AuthCredentialTable<TClaims extends object = object> {
     deletedCount: number;
   }>;
 }
-interface CredentialStoreAtscriptDbOptions<TClaims extends object> {
-  table: AuthCredentialTable<TClaims>;
+interface CredentialStoreAtscriptDbOptions<TPayload extends object> {
+  table: AuthCredentialTable<TPayload>;
 }
 /**
  * atscript-db-backed `CredentialStore`.
@@ -68,16 +73,17 @@ interface CredentialStoreAtscriptDbOptions<TClaims extends object> {
  * `.as` model). Custom tables must keep `token` as PK or override the
  * adapter.
  */
-declare class CredentialStoreAtscriptDb<TClaims extends object = object> implements CredentialStore<TClaims> {
+declare class CredentialStoreAtscriptDb<TPayload extends object = object> implements CredentialStore<TPayload> {
   private readonly table;
-  constructor(opts: CredentialStoreAtscriptDbOptions<TClaims>);
-  persist(state: CredentialState<TClaims>, ttl?: number): Promise<string>;
-  retrieve(token: string): Promise<CredentialState<TClaims> | null>;
-  consume(token: string): Promise<CredentialState<TClaims> | null>;
-  update(token: string, state: CredentialState<TClaims>): Promise<string>;
+  constructor(opts: CredentialStoreAtscriptDbOptions<TPayload>);
+  persist(state: CredentialState & TPayload, ttl?: number): Promise<string>;
+  retrieve(token: string): Promise<(CredentialState & TPayload) | null>;
+  consume(token: string): Promise<(CredentialState & TPayload) | null>;
+  update(token: string, state: CredentialState & TPayload): Promise<string>;
   revoke(token: string): Promise<void>;
+  touch(token: string, at: number): Promise<void>;
   revokeAllForUser(userId: string): Promise<number>;
-  listForUser(userId: string): Promise<Array<CredentialState<TClaims> & {
+  listForUser(userId: string): Promise<Array<CredentialState & TPayload & {
     token: string;
   }>>;
 }

package/dist/atscript-db.mjs

@@ -1,3 +1,4 @@
+import { t as credentialPayloadOf } from "./payload-D-DzH5-J.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/atscript-db/index.ts
 /**
@@ -21,18 +22,7 @@ var CredentialStoreAtscriptDb = class {
 	async persist(state, ttl) {
 		const token = randomUUID();
 		const expiresAt = typeof ttl === "number" ? Date.now() + ttl : state.expiresAt;
-		const row = {
-			token,
-			userId: state.userId,
-			issuedAt: state.issuedAt,
-			expiresAt,
-			kind: state.kind,
-			claims: state.claims,
-			metadata: state.metadata,
-			parentCredentialId: state.parentCredentialId,
-			rotatedAt: state.rotatedAt
-		};
-		await this.table.insertOne(row);
+		await this.table.insertOne(stateToRow(state, token, expiresAt));
 		return token;
 	}
 	async retrieve(token) {
@@ -56,23 +46,21 @@ var CredentialStoreAtscriptDb = class {
 			await this.revoke(token);
 			return token;
 		}
-		const row = {
-			token,
-			userId: state.userId,
-			issuedAt: state.issuedAt,
-			expiresAt: state.expiresAt,
-			kind: state.kind,
-			claims: state.claims,
-			metadata: state.metadata,
-			parentCredentialId: state.parentCredentialId,
-			rotatedAt: state.rotatedAt
-		};
-		await this.table.replaceOne(row);
+		await this.table.replaceOne(stateToRow(state, token, state.expiresAt));
 		return token;
 	}
 	async revoke(token) {
 		await this.table.deleteOne(token);
 	}
+	async touch(token, at) {
+		const row = await this.table.findOne({ filter: { token } });
+		if (!row) return;
+		if (row.expiresAt <= Date.now()) return;
+		await this.table.replaceOne({
+			...row,
+			lastSeenAt: at
+		});
+	}
 	async revokeAllForUser(userId) {
 		return (await this.table.deleteMany({ userId })).deletedCount;
 	}
@@ -95,17 +83,40 @@ var CredentialStoreAtscriptDb = class {
 		return out;
 	}
 };
+/**
+* Build the persisted row from a credential state: typed payload columns first
+* (so an envelope field wins a name clash), then the fixed envelope fields and
+* the resolved `token` + `expiresAt`. Shared by `persist` and `update`, which
+* differ only in the `expiresAt` they resolve.
+*/
+function stateToRow(state, token, expiresAt) {
+	return {
+		...credentialPayloadOf(state),
+		token,
+		userId: state.userId,
+		issuedAt: state.issuedAt,
+		expiresAt,
+		kind: state.kind,
+		metadata: state.metadata,
+		parentCredentialId: state.parentCredentialId,
+		rotatedAt: state.rotatedAt,
+		sessionId: state.sessionId,
+		lastSeenAt: state.lastSeenAt
+	};
+}
 function rowToState(row) {
 	const state = {
+		...credentialPayloadOf(row),
 		userId: row.userId,
 		issuedAt: row.issuedAt,
 		expiresAt: row.expiresAt
 	};
-	if (row.claims !== void 0) state.claims = row.claims;
 	if (row.metadata !== void 0) state.metadata = row.metadata;
 	if (row.kind === "access" || row.kind === "refresh") state.kind = row.kind;
 	if (row.parentCredentialId !== void 0) state.parentCredentialId = row.parentCredentialId;
 	if (row.rotatedAt !== void 0) state.rotatedAt = row.rotatedAt;
+	if (row.sessionId !== void 0) state.sessionId = row.sessionId;
+	if (row.lastSeenAt !== void 0) state.lastSeenAt = row.lastSeenAt;
 	return state;
 }
 //#endregion

package/dist/authz.cjs

@@ -0,0 +1,168 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_clock = require("./clock-Bl-H3eqE.cjs");
+let node_crypto = require("node:crypto");
+//#region src/authz/authz-errors.ts
+/** A typed authorization-server failure. */
+var AuthorizeError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "AuthorizeError";
+		this.code = code;
+	}
+};
+//#endregion
+//#region src/authz/client-policy.ts
+/**
+* `true` when `uri` is a syntactically valid http(s) URL whose host is a
+* **loopback literal** — `127.0.0.1`, `::1`, or `localhost` — on any port (RFC
+* 8252 §7.3). Rejects everything else, including the classic bypasses: a
+* host-suffix (`127.0.0.1.evil.com`, `localhost.evil.com`), embedded credentials
+* (`http://127.0.0.1@evil.com` → host `evil.com`), a non-http scheme, and a bare
+* `0.0.0.0`. Only a local process can receive a loopback redirect, which is why
+* an arbitrary port is safe — the binding is the loopback host + PKCE.
+*/
+function isLoopbackRedirectUri(uri) {
+	let url;
+	try {
+		url = new URL(uri);
+	} catch {
+		return false;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+	if (url.username !== "" || url.password !== "") return false;
+	const host = url.hostname.replace(/^\[|\]$/g, "");
+	return host === "127.0.0.1" || host === "::1" || host === "localhost";
+}
+const DEFAULT_CLI_TOKEN_POLICY = {
+	kind: "cli-session",
+	ttl: 720 * 60 * 6e4
+};
+/**
+* Tier-1 policy: accept any **loopback** `redirect_uri`, treat the client as a
+* public client (no `client_id` / secret — PKCE is the binding), and mint the
+* configured CLI token policy. Rejects every non-loopback redirect.
+*/
+var LoopbackClientPolicy = class {
+	tokenPolicy;
+	constructor(opts) {
+		this.tokenPolicy = opts?.tokenPolicy ?? DEFAULT_CLI_TOKEN_POLICY;
+	}
+	resolveClient(args) {
+		if (!isLoopbackRedirectUri(args.redirectUri)) throw new AuthorizeError("invalid_redirect", "redirect_uri must be a loopback address");
+		return {
+			redirectUri: args.redirectUri,
+			tokenPolicy: structuredClone(this.tokenPolicy)
+		};
+	}
+};
+//#endregion
+//#region src/authz/pending-authorization-store.ts
+/**
+* Storage seam for in-flight authorizations (AUTH-SERVER.md §4.3). Short-lived
+* (≈ the login-session ceiling): created at `/authorize`, read+deleted at the
+* wf terminal. An in-memory impl ships for single-process apps + tests; a
+* multi-pod deployment provides a durable (e.g. Redis) impl under the same
+* `PENDING_AUTHORIZATION_STORE_TOKEN` (from `@aooth/auth-moost`).
+*/
+var PendingAuthorizationStore = class {};
+const DEFAULT_PENDING_TTL_MS = 15 * 6e4;
+/**
+* In-memory {@link PendingAuthorizationStore} — the reference impl for a
+* single-process app + tests. `structuredClone` on read/write isolates callers.
+*/
+var PendingAuthorizationStoreMemory = class extends PendingAuthorizationStore {
+	store = /* @__PURE__ */ new Map();
+	clock;
+	ttlMs;
+	constructor(opts) {
+		super();
+		this.clock = opts?.clock ?? require_clock.defaultClock;
+		this.ttlMs = opts?.ttlMs ?? DEFAULT_PENDING_TTL_MS;
+	}
+	async create(rec) {
+		const now = this.clock.now();
+		const row = {
+			handle: (0, node_crypto.randomUUID)(),
+			redirectUri: rec.redirectUri,
+			codeChallenge: rec.codeChallenge,
+			tokenPolicy: structuredClone(rec.tokenPolicy),
+			createdAt: now,
+			expiresAt: now + this.ttlMs,
+			...rec.clientId !== void 0 && { clientId: rec.clientId },
+			...rec.clientState !== void 0 && { clientState: rec.clientState },
+			...rec.scope !== void 0 && { scope: rec.scope }
+		};
+		this.store.set(row.handle, structuredClone(row));
+		return { handle: row.handle };
+	}
+	async get(handle) {
+		const row = this.store.get(handle);
+		if (!row) return null;
+		if (row.expiresAt <= this.clock.now()) {
+			this.store.delete(handle);
+			return null;
+		}
+		return structuredClone(row);
+	}
+	async delete(handle) {
+		return this.store.delete(handle);
+	}
+};
+//#endregion
+//#region src/authz/auth-code-store.ts
+/**
+* Storage seam for issued authorization codes (AUTH-SERVER.md §4.3). Very
+* short-lived (≈ 30–60 s) and **single-use**: {@link consume} returns the row
+* AND invalidates it in one atomic step, so a concurrent double-redeem (or a
+* back-button replay) yields the code to exactly one caller. An in-memory impl
+* ships (atomic for free in single-threaded JS); a durable impl must implement
+* `consume` as an atomic check-and-delete (e.g. `withCas` / `@db.column.version`,
+* or a Redis `GETDEL`).
+*/
+var AuthCodeStore = class {};
+const DEFAULT_CODE_TTL_MS = 6e4;
+/**
+* In-memory {@link AuthCodeStore} — the reference impl. `consume` is atomic
+* because the `get` + `delete` run with no intervening `await`, so a second
+* concurrent `consume` of the same code always misses.
+*/
+var AuthCodeStoreMemory = class extends AuthCodeStore {
+	store = /* @__PURE__ */ new Map();
+	clock;
+	ttlMs;
+	constructor(opts) {
+		super();
+		this.clock = opts?.clock ?? require_clock.defaultClock;
+		this.ttlMs = opts?.ttlMs ?? DEFAULT_CODE_TTL_MS;
+	}
+	async mint(rec) {
+		const code = (0, node_crypto.randomUUID)();
+		const row = {
+			code,
+			userId: rec.userId,
+			codeChallenge: rec.codeChallenge,
+			redirectUri: rec.redirectUri,
+			tokenPolicy: structuredClone(rec.tokenPolicy),
+			expiresAt: this.clock.now() + this.ttlMs,
+			...rec.clientId !== void 0 && { clientId: rec.clientId }
+		};
+		this.store.set(code, structuredClone(row));
+		return { code };
+	}
+	async consume(code) {
+		const row = this.store.get(code);
+		if (!row) return null;
+		this.store.delete(code);
+		if (row.expiresAt <= this.clock.now()) return null;
+		return structuredClone(row);
+	}
+};
+//#endregion
+exports.AuthCodeStore = AuthCodeStore;
+exports.AuthCodeStoreMemory = AuthCodeStoreMemory;
+exports.AuthorizeError = AuthorizeError;
+exports.LoopbackClientPolicy = LoopbackClientPolicy;
+exports.PendingAuthorizationStore = PendingAuthorizationStore;
+exports.PendingAuthorizationStoreMemory = PendingAuthorizationStoreMemory;
+exports.isLoopbackRedirectUri = isLoopbackRedirectUri;