@arcblock/did-connect-service 4.1.14 → 4.1.16

package/dist/handlers/oauth-as-handler.d.ts

@@ -0,0 +1,108 @@
+/**
+ * OAuthAsHandler — RFC 8414 Authorization Server metadata + RFC 8628
+ * device authorization grant + RFC 6749 authorization_code (PKCE S256).
+ *
+ * This is the MCP resource-server AS surface (arc#3788 / epic #3783 / arc#3868).
+ * It does NOT reuse OAuthHandler (Google/GitHub IdP login).
+ *
+ * Mapping to existing access-key device flow:
+ *   POST device_authorization → createAccessKeySession ({id, challenge})
+ *   verification_uri          → /.well-known/service/gen-access-key
+ *   verification_uri_complete → gen-access-key?__token__=<device_code>
+ *   user authorizes           → existing POST .../access-key/authorize
+ *   POST token (device_code)  → decrypt session secret → access_token
+ *
+ * Authorization code + PKCE (arc#3868):
+ *   GET  /oauth/authorize     → login (query preserved) or confirm page
+ *   POST /oauth/authorize     → 302 redirect_uri?code&state (fresh code, no mint)
+ *   PKCE + bound userDid/instanceDid live in session.source as `oauth-code:{json}`
+ *   challenge column stays the AES wrap key for the approved-user payload
+ *   POST token (authorization_code) → mint instance-bound access key
+ *   redirect_uri is re-checked as RFC 8252 loopback on GET, POST, and token
+ *
+ * Tokens are instance-bound access keys (same store / resolveAccessKeyCaller).
+ *
+ * Routes:
+ *   GET  /.well-known/oauth-authorization-server
+ *   GET  /.well-known/service/oauth/authorize
+ *   POST /.well-known/service/oauth/authorize
+ *   POST /.well-known/service/oauth/register
+ *   POST /.well-known/service/oauth/device_authorization
+ *   POST /.well-known/service/oauth/token
+ *
+ * DCR (arc#3869): code grant resolves client_id via resolveOAuthClient
+ * (cs_oauth_clients ∪ pre-registered; CIMD stub only). Device grant stays
+ * loose — unregistered client_id still works. client_id grants no permissions.
+ */
+import { type Logger } from "../logger.js";
+import type { D1Store, StoredOAuthClient } from "../store/d1-store.js";
+import type { AccessKeyHandler } from "./access-key-handler.js";
+import type { Auth } from "./passkey-handler.js";
+/** Unverified estimate: DCR records expire after 7 days. */
+export declare const OAUTH_DCR_TTL_SECONDS: number;
+/** Unverified estimate: DCR registrations per IP per window. */
+export declare const OAUTH_DCR_RATE_LIMIT = 20;
+export declare const OAUTH_DCR_RATE_WINDOW_MS: number;
+export interface OAuthAsHandlerOptions {
+    store: D1Store;
+    /** Structured logger (defaults to consoleLogger). */
+    logger?: Logger;
+    /** Session verifier — required for /oauth/authorize. */
+    auth?: Auth;
+    /** Mints the instance-bound access key at the token endpoint. */
+    accessKeyHandler?: AccessKeyHandler;
+    /** Override DCR per-IP rate limit (tests). Default {@link OAUTH_DCR_RATE_LIMIT}. */
+    dcrRateLimit?: number;
+}
+export type OAuthClientRecord = StoredOAuthClient;
+export declare class OAuthAsHandler {
+    private store;
+    private logger;
+    private auth?;
+    private accessKeyHandler?;
+    private dcrRateLimit;
+    constructor(options: OAuthAsHandlerOptions);
+    fetch(request: Request, instanceDid?: string): Promise<Response | null>;
+    /** GET /.well-known/oauth-authorization-server — RFC 8414 */
+    private metadata;
+    /**
+     * POST /.well-known/service/oauth/register — RFC 7591
+     * Public client (token_endpoint_auth_method=none). Echoes the full schema;
+     * a `{client_id}`-only body is a hard fail for Claude Code.
+     */
+    private register;
+    /**
+     * GET /.well-known/service/oauth/authorize — RFC 6749 §4.1.1
+     * Unauthenticated → existing login (query preserved via return_to).
+     * Authenticated → pending oauth-code session + confirm UI.
+     */
+    private authorizeGet;
+    /**
+     * POST /.well-known/service/oauth/authorize
+     * User confirmation. Does not mint — token endpoint mints.
+     * Success: 302 redirect_uri?code&state
+     */
+    private authorizePost;
+    /**
+     * POST /.well-known/service/oauth/device_authorization — RFC 8628 §3.1
+     * Creates an access-key session; device_code = session id.
+     */
+    private deviceAuthorization;
+    /**
+     * POST /.well-known/service/oauth/token — RFC 8628 §3.4 / RFC 6749 §4.1.3
+     * Device: decrypt session secret. Code: mint a new instance-bound access key.
+     */
+    private token;
+    /**
+     * grant_type=authorization_code — PKCE S256, one-time code, mint at token.
+     */
+    private authorizationCodeToken;
+}
+/**
+ * DCR table ∪ pre-registered. Expired DCR rows are treated as unknown.
+ * Device grant must NOT call this (unregistered client_id stays valid).
+ */
+export declare function resolveOAuthClient(store: D1Store, clientId: string): Promise<OAuthClientRecord | null>;
+/** CIMD (Client ID Metadata Document) — stub only this wave. */
+export declare function resolveCimdClient(_clientId: string): Promise<OAuthClientRecord | null>;
+//# sourceMappingURL=oauth-as-handler.d.ts.map

package/dist/handlers/oauth-as-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-as-handler.d.ts","sourceRoot":"","sources":["../../src/handlers/oauth-as-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAQjD,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AACtD,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AAmBvD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAkBlD,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,IAAI,CAAC,CAAO;IACpB,OAAO,CAAC,gBAAgB,CAAC,CAAmB;IAC5C,OAAO,CAAC,YAAY,CAAS;gBAEjB,OAAO,EAAE,qBAAqB;IAQpC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAkC7E,6DAA6D;IAC7D,OAAO,CAAC,QAAQ;IAmBhB;;;;OAIG;YACW,QAAQ;IAwCtB;;;;OAIG;YACW,YAAY;IA8C1B;;;;OAIG;YACW,aAAa;IA2E3B;;;OAGG;YACW,mBAAmB;IAkCjC;;;OAGG;YACW,KAAK;IA+DnB;;OAEG;YACW,sBAAsB;CA8FrC;AA2DD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAMnC;AAED,gEAAgE;AAChE,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAE5F"}