@aooth/auth 0.1.7 → 0.1.9

package/dist/authz.d.cts

@@ -0,0 +1,502 @@
+import { t as Clock } from "./clock-BjXa0LXb.cjs";
+import { JWK } from "jose";
+
+//#region src/authz/token-policy.d.ts
+/**
+ * What the authorization server mints for a completed grant — forwarded verbatim
+ * into `AuthCredential.issue(userId, …)` at the token endpoint. Decided by the
+ * {@link import("./client-policy").ClientRedirectPolicy} (per client / scope),
+ * never by the client request, and recorded on the pending-authorization + the
+ * issued auth-code so the grant's authority is fixed at `/authorize` time, not
+ * `/token` time.
+ *
+ * Tier 1 (CLI / loopback) → a full-authority `cli-session` (`{ kind, ttl }`, no
+ * `payload`). A scoped service token (Tier 2) additionally sets `payload` with
+ * the consumer's attenuation root fields.
+ */
+interface TokenPolicy {
+  /** Semantic credential kind stamped on the token (e.g. `"cli-session"`). See `IssueOptions.kind`. */
+  kind?: string;
+  /** Per-mint access-token lifetime in ms (forwarded to `IssueOptions.ttl`). */
+  ttl?: number;
+  /**
+   * Extra root payload merged into `issue()` — e.g. `@arbac.attenuate.*` fields
+   * for a SCOPED token. Omit for a full-authority token. MUST be JSON-safe: it
+   * is persisted on the pending-authorization + auth-code records.
+   */
+  payload?: Record<string, unknown>;
+}
+//#endregion
+//#region src/authz/authz-errors.d.ts
+/**
+ * Failure taxonomy for the authorization-server endpoints (AUTH-SERVER.md §7).
+ * The `/authorize` side fails SOFT (302 → an app error/login route, never a
+ * 500); the `/token` side returns the RFC-6749-shaped JSON error named by the
+ * code. Messages are benign — they must not disclose whether a failure was an
+ * unknown client vs. a bad redirect vs. an expired code.
+ */
+type AuthorizeErrorCode = /** Missing or malformed parameter at `/authorize` or `/token`. */"invalid_request" /** `redirect_uri` is not an allowed (loopback / registered) target. */ | "invalid_redirect" /** Code unknown / expired / already-redeemed, or PKCE verifier mismatch (`/token`). */ | "invalid_grant" /** Unknown or unauthenticated client (Tier 2). */ | "invalid_client" /** A known client used a grant/response it is not allowed (Tier 2). */ | "unauthorized_client" /** The user declined the authorization (consent). */ | "access_denied" /** An unexpected server-side failure. */ | "server_error";
+/** A typed authorization-server failure. */
+declare class AuthorizeError extends Error {
+  readonly code: AuthorizeErrorCode;
+  constructor(code: AuthorizeErrorCode, message: string);
+}
+//#endregion
+//#region src/authz/client-policy.d.ts
+/**
+ * The client + redirect resolved at `GET /auth/authorize` — what the grant is
+ * allowed to deliver and where.
+ */
+interface ResolvedClient {
+  /** Registered client id (Tier 2), absent for a public/loopback client. */
+  clientId?: string;
+  /** The validated `redirect_uri` the code will be delivered to. */
+  redirectUri: string;
+  /** What the grant mints (fixed here, recorded on the pending authorization). */
+  tokenPolicy: TokenPolicy;
+  /**
+   * Tier 2 (OIDC): mint an `id_token` with `aud` = {@link audience}. Omitted ⇒
+   * no `id_token` (Tier-1 loopback).
+   */
+  idToken?: boolean;
+  /**
+   * Mint an access token. **Omitted ⇒ minted** (preserves Tier-1 loopback,
+   * where the CLI gets an access token); set `false` for a pure-OIDC sign-in
+   * client that should receive identity only.
+   */
+  accessToken?: boolean;
+  /** The `id_token` `aud` (the registered `client_id`). */
+  audience?: string;
+  /** Granted scope (space-joined) — `requested ∩ allowed`; drives the `id_token` profile claims. */
+  scope?: string;
+}
+/**
+ * The pluggable trust boundary of the authorization server (AUTH-SERVER.md §4.5):
+ * decide whether a client + `redirect_uri` may start a grant and what it may
+ * receive. The flow is otherwise identical across tiers — only this policy
+ * varies. Tier 1 ships {@link LoopbackClientPolicy}; a `RegisteredClientPolicy`
+ * (static client registry, exact/prefix redirect allowlist, `id_token`) is the
+ * Tier-2 addition.
+ */
+interface ClientRedirectPolicy {
+  /**
+   * Authorize the client + `redirect_uri` and resolve the token policy; THROW
+   * an {@link AuthorizeError} on a miss (`invalid_redirect` / `invalid_client`).
+   * This is THE open-redirect / token-theft gate — never reflect an unvalidated
+   * `redirect_uri`.
+   */
+  resolveClient(args: {
+    clientId?: string;
+    redirectUri: string;
+    scope?: string;
+  }): ResolvedClient | Promise<ResolvedClient>;
+  /**
+   * Tier 2: authenticate the client at `POST /auth/token` — verify the
+   * `client_secret` of a confidential client (PKCE is the binding for a public
+   * one). THROW an {@link AuthorizeError} (`invalid_client`) on failure. Optional:
+   * a public-only policy (loopback) omits it.
+   */
+  authenticateClient?(args: {
+    clientId?: string;
+    clientSecret?: string;
+  }): void | Promise<void>;
+}
+/**
+ * `true` when `uri` is a syntactically valid http(s) URL whose host is a
+ * **loopback literal** — `127.0.0.1`, `::1`, or `localhost` — on any port (RFC
+ * 8252 §7.3). Rejects everything else, including the classic bypasses: a
+ * host-suffix (`127.0.0.1.evil.com`, `localhost.evil.com`), embedded credentials
+ * (`http://127.0.0.1@evil.com` → host `evil.com`), a non-http scheme, and a bare
+ * `0.0.0.0`. Only a local process can receive a loopback redirect, which is why
+ * an arbitrary port is safe — the binding is the loopback host + PKCE.
+ */
+declare function isLoopbackRedirectUri(uri: string): boolean;
+interface LoopbackClientPolicyOptions {
+  /**
+   * What a loopback grant mints. Default: a full-authority `cli-session` with a
+   * 30-day TTL (un-attenuated — see {@link TokenPolicy}). Override to scope or
+   * re-label CLI tokens.
+   */
+  tokenPolicy?: TokenPolicy;
+}
+/**
+ * Tier-1 policy: accept any **loopback** `redirect_uri`, treat the client as a
+ * public client (no `client_id` / secret — PKCE is the binding), and mint the
+ * configured CLI token policy. Rejects every non-loopback redirect.
+ */
+declare class LoopbackClientPolicy implements ClientRedirectPolicy {
+  private readonly tokenPolicy;
+  constructor(opts?: LoopbackClientPolicyOptions);
+  resolveClient(args: {
+    clientId?: string;
+    redirectUri: string;
+    scope?: string;
+  }): ResolvedClient;
+}
+//#endregion
+//#region src/authz/registered-client-policy.d.ts
+/**
+ * One registered first-party client (AUTH-SERVER.md §4.5). The registry is the
+ * open-redirect / token-theft boundary, so a client's `redirect_uri` allowlist
+ * and what it may receive are declared HERE, never inferred from the request.
+ */
+interface RegisteredClient {
+  /** Stable client identifier; the `id_token` `aud`. */
+  clientId: string;
+  /** Exact-match `redirect_uri` allowlist (the safe default). */
+  redirectUris?: string[];
+  /**
+   * Strict-prefix `redirect_uri` allowlist (an entry must be a non-empty prefix
+   * of the request). Looser than exact match — only use for a tightly-scoped
+   * path prefix on a trusted origin.
+   */
+  redirectPrefixes?: string[];
+  /** `"public"` (PKCE only) or `"confidential"` (PKCE + `client_secret`). Default `"public"`. */
+  type?: "public" | "confidential";
+  /** Shared secret for a confidential client (compared in constant time at `/token`). */
+  clientSecret?: string;
+  /** Mint an `id_token` (requires the granted scope to include `openid`). Default `true`. */
+  idToken?: boolean;
+  /** Also mint an access token for the main API. Default `false` — a pure sign-in client gets identity only. */
+  accessToken?: boolean;
+  /** Allowed scopes; the granted scope is `requested ∩ allowed`. Omit to allow any requested scope. */
+  scopes?: string[];
+  /** Token policy for the access token, when `accessToken` is set. */
+  tokenPolicy?: TokenPolicy;
+}
+interface RegisteredClientPolicyOptions {
+  clients: RegisteredClient[];
+}
+/**
+ * Tier-2 policy: a static registry of first-party clients. `resolveClient`
+ * authorizes the client + `redirect_uri` (against the registered allowlist) and
+ * resolves the granted scope + what the grant delivers (`id_token`/`access_token`,
+ * `aud = client_id`); `authenticateClient` authenticates the client at `/token`
+ * (`client_secret` for confidential clients; PKCE is the binding for public ones).
+ * An unregistered client or an unlisted redirect is rejected.
+ */
+declare class RegisteredClientPolicy implements ClientRedirectPolicy {
+  private readonly clients;
+  constructor(opts: RegisteredClientPolicyOptions);
+  resolveClient(args: {
+    clientId?: string;
+    redirectUri: string;
+    scope?: string;
+  }): ResolvedClient;
+  authenticateClient(args: {
+    clientId?: string;
+    clientSecret?: string;
+  }): void;
+  private requireClient;
+  private redirectAllowed;
+  private grantScope;
+}
+//#endregion
+//#region src/authz/composite-client-policy.d.ts
+interface CompositeClientPolicyOptions {
+  /** Used when the request carries NO `client_id` (Tier-1 public/loopback CLI). */
+  loopback: ClientRedirectPolicy;
+  /** Used when the request carries a `client_id` (Tier-2 registered service). */
+  registered: ClientRedirectPolicy;
+}
+/**
+ * Runs Tier-1 and Tier-2 side by side, dispatching on the **presence of
+ * `client_id`** (AUTH-SERVER.md §10): a request with a `client_id` is a
+ * registered client, one without is a loopback CLI. The split is the safety
+ * boundary — a registered client is routed only to {@link RegisteredClientPolicy}
+ * (which enforces ITS redirect allowlist, so it cannot smuggle a loopback
+ * redirect), and a no-`client_id` request is routed only to the loopback policy
+ * (so it cannot claim to be a registered client). Each sub-policy still owns its
+ * own redirect validation; this only picks which one runs.
+ */
+declare class CompositeClientPolicy implements ClientRedirectPolicy {
+  private readonly loopback;
+  private readonly registered;
+  constructor(opts: CompositeClientPolicyOptions);
+  resolveClient(args: {
+    clientId?: string;
+    redirectUri: string;
+    scope?: string;
+  }): ResolvedClient | Promise<ResolvedClient>;
+  authenticateClient(args: {
+    clientId?: string;
+    clientSecret?: string;
+  }): void | Promise<void>;
+}
+//#endregion
+//#region src/authz/id-token-signer.d.ts
+/** Asymmetric signing algorithms an OIDC `id_token` may use (AUTH-SERVER.md §4.9). */
+type IdTokenAlg = "RS256" | "ES256";
+interface IdTokenSignerOptions {
+  /**
+   * The OIDC issuer — the `iss` claim AND the discovery `issuer`. A relying
+   * `OidcProvider` checks `id_token.iss` against this exactly, so it must match
+   * the value it was configured with (typically `{origin}/auth`).
+   */
+  issuer: string;
+  /** Signature algorithm. Default `"RS256"` (most universally accepted; `OidcProvider` accepts RS256/ES256). */
+  alg?: IdTokenAlg;
+  /** Key id — stamped in the JWS header AND the published JWKS entry, so a verifier matches the right key. */
+  kid: string;
+  /** PKCS8 PEM private key (lazily imported + cached). */
+  privateKey: string;
+  /** SPKI PEM public key — published in the JWKS so verifiers fetch it (lazily imported + cached). */
+  publicKey: string;
+  /** `id_token` lifetime in seconds. Default 300 (5 min — it is exchanged immediately). */
+  ttlSec?: number;
+  /** Injectable clock for deterministic `iat`/`exp` in tests. Defaults to wall-clock. */
+  clock?: Clock;
+}
+/** The claims the authorization server controls per-mint; profile claims ride `extra`. */
+interface IdTokenClaims {
+  /** Subject — the stable user id (the token subject). */
+  sub: string;
+  /** Audience — the requesting `client_id`. Binds the token to one client (§6 audience binding). */
+  aud: string;
+  /** Echoed from the `/authorize` request when present; a relying party checks it to defeat replay. */
+  nonce?: string;
+  /** Per-mint lifetime override (seconds). */
+  ttlSec?: number;
+  /** Profile/standard claims merged into the payload (e.g. `email`, `email_verified`, `name`). MUST be JSON-safe. */
+  extra?: Record<string, unknown>;
+}
+/**
+ * Signs OIDC `id_token`s and publishes the matching JWKS (AUTH-SERVER.md §4.9).
+ * Holds one asymmetric keypair; mints short-lived RS256/ES256 tokens with the
+ * issuer + audience + subject a relying `OidcProvider` validates, and exports the
+ * public half as a JWKS for `GET /auth/jwks`. Keys are imported lazily and cached
+ * (the Apple-client-secret pattern), so construction is cheap and synchronous.
+ *
+ * Never used for the access token (that stays in `AuthCredential`'s store) — the
+ * `id_token` is a separate, audience-bound identity assertion.
+ */
+declare class IdTokenSigner {
+  /** The `iss` claim + discovery `issuer` (read by `/.well-known/openid-configuration`). */
+  readonly issuer: string;
+  /** Signature algorithm — published in discovery's `id_token_signing_alg_values_supported`. */
+  readonly alg: IdTokenAlg;
+  /** Key id — the JWS header + JWKS entry `kid`. */
+  readonly kid: string;
+  private readonly privateKeyPem;
+  private readonly publicKeyPem;
+  private readonly ttlSec;
+  private readonly clock;
+  private privateKeyPromise?;
+  private jwksPromise?;
+  constructor(opts: IdTokenSignerOptions);
+  /** Mint a signed `id_token` JWT. Iat/exp come from the injected clock. */
+  sign(claims: IdTokenClaims): Promise<string>;
+  /**
+   * The JWKS document served at `/auth/jwks` — the public key as a single
+   * `use: "sig"` entry tagged with the same `kid`/`alg` as the minted tokens, so
+   * a verifier selects it by `kid`. Computed once and cached.
+   */
+  jwks(): Promise<{
+    keys: JWK[];
+  }>;
+  private importPrivateKey;
+}
+//#endregion
+//#region src/authz/oidc-claims-resolver.d.ts
+/**
+ * Resolves the OIDC profile claims to embed in an `id_token` for a given user +
+ * granted scope (AUTH-SERVER.md §4.9). The authorization server already controls
+ * the registered claims (`iss`/`aud`/`sub`/`iat`/`exp`/`nonce`) itself — this seam
+ * supplies the **profile** claims that depend on the consumer's user shape
+ * (`email`/`email_verified`/`name`/`picture`), which `@aooth/auth` cannot know.
+ *
+ * Pluggable like every other store/policy: the no-op default ({@link NoopOidcClaimsResolver},
+ * `sub`-only tokens) ships, and a consumer subclasses it to read its own user
+ * record. Bound in `@aooth/auth-moost` under `OIDC_CLAIMS_RESOLVER_TOKEN`.
+ *
+ * The map's keys are standard OIDC claim names; values MUST be JSON-safe. Honour
+ * the granted `scope` — only emit `email`/`email_verified` under `email`, and
+ * `name`/`picture`/etc. under `profile`, so a client receives only what it asked
+ * for (and was allowed).
+ */
+declare abstract class OidcClaimsResolver {
+  /**
+   * @param userId  the authenticated subject (the `id_token` `sub`).
+   * @param scope   the granted scope, space-joined (e.g. `"openid email profile"`), or undefined.
+   * @returns       a flat map of standard OIDC profile claims to merge into the `id_token`.
+   */
+  abstract resolveClaims(userId: string, scope: string | undefined): Record<string, unknown> | Promise<Record<string, unknown>>;
+}
+/** Default resolver: emits no profile claims, so the `id_token` carries only `sub` + the registered claims. */
+declare class NoopOidcClaimsResolver extends OidcClaimsResolver {
+  resolveClaims(): Record<string, unknown>;
+}
+/** `true` when `scope` (space-joined) grants `claim` — `"email"`/`"profile"` etc. */
+declare function scopeGrants(scope: string | undefined, claim: string): boolean;
+//#endregion
+//#region src/authz/pending-authorization-store.d.ts
+/**
+ * One in-flight authorization request, recorded at `GET /auth/authorize` and
+ * read once at the login-workflow terminal that mints the auth code. Keyed by an
+ * opaque `handle` that rides the login-wf ctx (and, across a "Continue with
+ * Google" detour, the federated signed `state`) — so nothing secret leaves the
+ * server.
+ */
+interface PendingAuthorization {
+  /** Opaque server-side handle (the only thing that rides the URL / wf state). */
+  handle: string;
+  /** Registered client id (Tier 2), absent for a public/loopback client. */
+  clientId?: string;
+  /** The client's validated `redirect_uri` — where the code is delivered. */
+  redirectUri: string;
+  /** PKCE S256 challenge (client-generated); verified against the verifier at `/token`. */
+  codeChallenge: string;
+  /** The client's `state`, echoed back on the redirect so the client can correlate. */
+  clientState?: string;
+  /** Granted scope (space-joined) — `requested ∩ allowed`; drives the `id_token` profile claims. */
+  scope?: string;
+  /** OIDC `nonce` from the authorize request — echoed into the `id_token` (Tier 2). */
+  nonce?: string;
+  /** Mint an `id_token` at `/token` (Tier 2). */
+  idToken?: boolean;
+  /** Mint an access token at `/token`. Omitted ⇒ minted (Tier-1 loopback). */
+  accessToken?: boolean;
+  /** The `id_token` `aud` (the registered `client_id`). */
+  audience?: string;
+  /** What the grant will mint (fixed at authorize time). */
+  tokenPolicy: TokenPolicy;
+  createdAt: number;
+  expiresAt: number;
+}
+/** Input to {@link PendingAuthorizationStore.create} — `handle`/timestamps are store-assigned. */
+interface NewPendingAuthorization {
+  clientId?: string;
+  redirectUri: string;
+  codeChallenge: string;
+  clientState?: string;
+  scope?: string;
+  nonce?: string;
+  idToken?: boolean;
+  accessToken?: boolean;
+  audience?: string;
+  tokenPolicy: TokenPolicy;
+}
+/**
+ * Storage seam for in-flight authorizations (AUTH-SERVER.md §4.3). Short-lived
+ * (≈ the login-session ceiling): created at `/authorize`, read+deleted at the
+ * wf terminal. An in-memory impl ships for single-process apps + tests; a
+ * multi-pod deployment provides a durable (e.g. Redis) impl under the same
+ * `PENDING_AUTHORIZATION_STORE_TOKEN` (from `@aooth/auth-moost`).
+ */
+declare abstract class PendingAuthorizationStore {
+  /** Record a new pending authorization; returns its opaque `handle`. */
+  abstract create(rec: NewPendingAuthorization): Promise<{
+    handle: string;
+  }>;
+  /** Fetch by handle, or `null` when unknown/expired. */
+  abstract get(handle: string): Promise<PendingAuthorization | null>;
+  /** Drop a handle once consumed. Returns `true` when a row was removed. */
+  abstract delete(handle: string): Promise<boolean>;
+}
+interface PendingAuthorizationStoreMemoryOptions {
+  /** Injectable clock for deterministic expiry. Defaults to {@link defaultClock}. */
+  clock?: Clock;
+  /** How long a pending authorization stays valid. Default 15 min. */
+  ttlMs?: number;
+}
+/**
+ * In-memory {@link PendingAuthorizationStore} — the reference impl for a
+ * single-process app + tests. `structuredClone` on read/write isolates callers.
+ */
+declare class PendingAuthorizationStoreMemory extends PendingAuthorizationStore {
+  private store;
+  private clock;
+  private ttlMs;
+  constructor(opts?: PendingAuthorizationStoreMemoryOptions);
+  create(rec: NewPendingAuthorization): Promise<{
+    handle: string;
+  }>;
+  get(handle: string): Promise<PendingAuthorization | null>;
+  delete(handle: string): Promise<boolean>;
+}
+//#endregion
+//#region src/authz/auth-code-store.d.ts
+/**
+ * A minted, single-use authorization code, bound to the user the login resolved
+ * plus the PKCE challenge / redirect / token policy recorded at `/authorize`.
+ * Consumed atomically at `POST /auth/token` — the token is minted there, off the
+ * browser, so nothing long-lived ever rides a redirect URL.
+ */
+interface AuthCode {
+  /** Opaque single-use code (delivered to the client in the redirect query). */
+  code: string;
+  /** The user the login workflow authenticated. */
+  userId: string;
+  /** PKCE S256 challenge from the originating authorize request. */
+  codeChallenge: string;
+  /** The client's `redirect_uri` (bound; the code is meaningless elsewhere). */
+  redirectUri: string;
+  /** Registered client id (Tier 2), absent for a public/loopback client. */
+  clientId?: string;
+  /** Granted scope (space-joined) — drives the `id_token` profile claims. */
+  scope?: string;
+  /** OIDC `nonce` from the authorize request — echoed into the `id_token` (Tier 2). */
+  nonce?: string;
+  /** Mint an `id_token` at `/token` (Tier 2). */
+  idToken?: boolean;
+  /** Mint an access token at `/token`. Omitted ⇒ minted (Tier-1 loopback). */
+  accessToken?: boolean;
+  /** The `id_token` `aud` (the registered `client_id`). */
+  audience?: string;
+  /** What `/token` mints when this code is redeemed. */
+  tokenPolicy: TokenPolicy;
+  expiresAt: number;
+}
+/** Input to {@link AuthCodeStore.mint} — `code`/`expiresAt` are store-assigned. */
+interface NewAuthCode {
+  userId: string;
+  codeChallenge: string;
+  redirectUri: string;
+  clientId?: string;
+  scope?: string;
+  nonce?: string;
+  idToken?: boolean;
+  accessToken?: boolean;
+  audience?: string;
+  tokenPolicy: TokenPolicy;
+}
+/**
+ * Storage seam for issued authorization codes (AUTH-SERVER.md §4.3). Very
+ * short-lived (≈ 30–60 s) and **single-use**: {@link consume} returns the row
+ * AND invalidates it in one atomic step, so a concurrent double-redeem (or a
+ * back-button replay) yields the code to exactly one caller. An in-memory impl
+ * ships (atomic for free in single-threaded JS); a durable impl must implement
+ * `consume` as an atomic check-and-delete (e.g. `withCas` / `@db.column.version`,
+ * or a Redis `GETDEL`).
+ */
+declare abstract class AuthCodeStore {
+  /** Mint + store a single-use code; returns the opaque code string. */
+  abstract mint(rec: NewAuthCode): Promise<{
+    code: string;
+  }>;
+  /** Atomically claim + return the code's row, or `null` on miss / reuse / expiry. */
+  abstract consume(code: string): Promise<AuthCode | null>;
+}
+interface AuthCodeStoreMemoryOptions {
+  /** Injectable clock for deterministic expiry. Defaults to {@link defaultClock}. */
+  clock?: Clock;
+  /** Code lifetime. Default 60 s. */
+  ttlMs?: number;
+}
+/**
+ * In-memory {@link AuthCodeStore} — the reference impl. `consume` is atomic
+ * because the `get` + `delete` run with no intervening `await`, so a second
+ * concurrent `consume` of the same code always misses.
+ */
+declare class AuthCodeStoreMemory extends AuthCodeStore {
+  private store;
+  private clock;
+  private ttlMs;
+  constructor(opts?: AuthCodeStoreMemoryOptions);
+  mint(rec: NewAuthCode): Promise<{
+    code: string;
+  }>;
+  consume(code: string): Promise<AuthCode | null>;
+}
+//#endregion
+export { type AuthCode, AuthCodeStore, AuthCodeStoreMemory, type AuthCodeStoreMemoryOptions, AuthorizeError, type AuthorizeErrorCode, type ClientRedirectPolicy, CompositeClientPolicy, type CompositeClientPolicyOptions, type IdTokenAlg, type IdTokenClaims, IdTokenSigner, type IdTokenSignerOptions, LoopbackClientPolicy, type LoopbackClientPolicyOptions, type NewAuthCode, type NewPendingAuthorization, NoopOidcClaimsResolver, OidcClaimsResolver, type PendingAuthorization, PendingAuthorizationStore, PendingAuthorizationStoreMemory, type PendingAuthorizationStoreMemoryOptions, type RegisteredClient, RegisteredClientPolicy, type RegisteredClientPolicyOptions, type ResolvedClient, type TokenPolicy, isLoopbackRedirectUri, scopeGrants };