@arcblock/did-connect-service 4.1.15 → 4.1.17

package/dist/handlers/oauth-as-handler.js

@@ -1,8 +1,8 @@
 /**
  * OAuthAsHandler — RFC 8414 Authorization Server metadata + RFC 8628
- * device authorization grant wrapping the existing access-key session flow.
+ * device authorization grant + RFC 6749 authorization_code (PKCE S256).
  *
- * This is the MCP resource-server AS surface (arc#3788 / epic #3783).
+ * This is the MCP resource-server AS surface (arc#3788 / epic #3783 / arc#3868).
  * It does NOT reuse OAuthHandler (Google/GitHub IdP login).
  *
  * Mapping to existing access-key device flow:
@@ -12,42 +12,96 @@
  *   user authorizes           → existing POST .../access-key/authorize
  *   POST token (device_code)  → decrypt session secret → access_token
  *
+ * Authorization code + PKCE (arc#3868):
+ *   GET  /oauth/authorize     → login (query preserved) or confirm page
+ *   POST /oauth/authorize     → 302 redirect_uri?code&state (fresh code, no mint)
+ *   PKCE + bound userDid/instanceDid live in session.source as `oauth-code:{json}`
+ *   challenge column stays the AES wrap key for the approved-user payload
+ *   POST token (authorization_code) → mint instance-bound access key
+ *   redirect_uri is re-checked as RFC 8252 loopback on GET, POST, and token
+ *
  * Tokens are instance-bound access keys (same store / resolveAccessKeyCaller).
  *
  * Routes:
  *   GET  /.well-known/oauth-authorization-server
+ *   GET  /.well-known/service/oauth/authorize
+ *   POST /.well-known/service/oauth/authorize
+ *   POST /.well-known/service/oauth/register
  *   POST /.well-known/service/oauth/device_authorization
  *   POST /.well-known/service/oauth/token
+ *
+ * DCR (arc#3869): code grant resolves client_id via resolveOAuthClient
+ * (cs_oauth_clients ∪ pre-registered; CIMD stub only). Device grant stays
+ * loose — unregistered client_id still works. client_id grants no permissions.
  */
-import { decryptAES } from "../crypto/aes-gcm.js";
+import { generateAccessKey } from "../access/access-key-util.js";
+import { decryptAES, encryptAES } from "../crypto/aes-gcm.js";
+import { generateRefreshTokenId, hashRefreshToken } from "../identity/refresh-tokens.js";
 import { consoleLogger } from "../logger.js";
+import { buildLoginUrl } from "../login-url.js";
+import { REFRESH_TOKEN_TTL_SECONDS } from "../store/d1-store.js";
 const SESSION_TTL_MS = 5 * 60 * 1000; // match AccessKeyConnectHandler
 const POLL_INTERVAL_SEC = 5;
 const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+const CODE_GRANT = "authorization_code";
+const REFRESH_GRANT = "refresh_token";
+const OAUTH_CODE_SOURCE_PREFIX = "oauth-code:";
+/** Unverified estimate aligned with the epic: 1 hour OAuth access TTL. */
+export const OAUTH_ACCESS_TTL_SECONDS = 60 * 60;
+/** Unverified estimate: DCR records expire after 7 days. */
+export const OAUTH_DCR_TTL_SECONDS = 7 * 24 * 60 * 60;
+/** Unverified estimate: DCR registrations per IP per window. */
+export const OAUTH_DCR_RATE_LIMIT = 20;
+export const OAUTH_DCR_RATE_WINDOW_MS = 60 * 60 * 1000;
 const METADATA_PATH = "/.well-known/oauth-authorization-server";
+const AUTHORIZE_PATH = "/.well-known/service/oauth/authorize";
+const REGISTER_PATH = "/.well-known/service/oauth/register";
 const DEVICE_PATH = "/.well-known/service/oauth/device_authorization";
 const TOKEN_PATH = "/.well-known/service/oauth/token";
 const VERIFICATION_PATH = "/.well-known/service/gen-access-key";
+const SUPPORTED_GRANT_TYPES = new Set([CODE_GRANT, DEVICE_GRANT, REFRESH_GRANT]);
+const SUPPORTED_RESPONSE_TYPES = new Set(["code"]);
+/** RFC 7636: 43–128 unreserved characters. */
+const PKCE_VERIFIER_RE = /^[A-Za-z0-9\-._~]{43,128}$/;
+const PKCE_CHALLENGE_RE = /^[A-Za-z0-9\-._~]{43,128}$/;
 /** RFC 8628 user_code alphabet (no ambiguous chars / vowels). */
 const USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
 export class OAuthAsHandler {
     store;
     logger;
+    auth;
+    accessKeyHandler;
+    dcrRateLimit;
     constructor(options) {
         this.store = options.store;
         this.logger = options.logger ?? consoleLogger;
+        this.auth = options.auth;
+        this.accessKeyHandler = options.accessKeyHandler;
+        this.dcrRateLimit = options.dcrRateLimit ?? OAUTH_DCR_RATE_LIMIT;
     }
-    async fetch(request) {
+    async fetch(request, instanceDid) {
         const url = new URL(request.url);
         const { pathname } = url;
         if (pathname === METADATA_PATH && request.method === "GET") {
             return this.metadata(request);
         }
+        if (pathname === AUTHORIZE_PATH && request.method === "GET") {
+            return this.authorizeGet(request, instanceDid);
+        }
+        if (pathname === AUTHORIZE_PATH && request.method === "POST") {
+            return this.authorizePost(request, instanceDid);
+        }
+        if (pathname === REGISTER_PATH) {
+            if (request.method !== "POST") {
+                return jsonResponse({ error: "invalid_request", error_description: "Method not allowed" }, 405);
+            }
+            return this.register(request);
+        }
         if (pathname === DEVICE_PATH && request.method === "POST") {
             return this.deviceAuthorization(request);
         }
         if (pathname === TOKEN_PATH && request.method === "POST") {
-            return this.token(request);
+            return this.token(request, instanceDid);
         }
         return null;
     }
@@ -56,17 +110,173 @@ export class OAuthAsHandler {
         const origin = new URL(request.url).origin;
         const body = {
             issuer: origin,
+            authorization_endpoint: `${origin}${AUTHORIZE_PATH}`,
+            registration_endpoint: `${origin}${REGISTER_PATH}`,
             device_authorization_endpoint: `${origin}${DEVICE_PATH}`,
             token_endpoint: `${origin}${TOKEN_PATH}`,
-            // Device grant only — no authorization_endpoint / code flow here.
-            response_types_supported: [],
-            grant_types_supported: [DEVICE_GRANT],
+            response_types_supported: ["code"],
+            grant_types_supported: [DEVICE_GRANT, CODE_GRANT, REFRESH_GRANT],
+            code_challenge_methods_supported: ["S256"],
             token_endpoint_auth_methods_supported: ["none"],
             // Public clients (MCP agents); no client secret.
             scopes_supported: ["mcp"],
         };
         return jsonResponse(body, 200, "public, max-age=3600");
     }
+    /**
+     * POST /.well-known/service/oauth/register — RFC 7591
+     * Public client (token_endpoint_auth_method=none). Echoes the full schema;
+     * a `{client_id}`-only body is a hard fail for Claude Code.
+     */
+    async register(request) {
+        const parsed = await parseDcrRequest(request);
+        if (!parsed.ok)
+            return parsed.response;
+        const ip = clientIp(request);
+        const windowStart = new Date(Date.now() - OAUTH_DCR_RATE_WINDOW_MS).toISOString();
+        const recent = await this.store.listOAuthClientsByIp(ip);
+        const recentCount = recent.filter((row) => row.createdAt > windowStart).length;
+        if (recentCount >= this.dcrRateLimit) {
+            return jsonResponse({ error: "invalid_client_metadata", error_description: "Too many registration requests" }, 429);
+        }
+        const clientId = crypto.randomUUID();
+        const expiresAt = new Date(Date.now() + OAUTH_DCR_TTL_SECONDS * 1000).toISOString();
+        await this.store.createOAuthClient({
+            clientId,
+            redirectUris: parsed.redirectUris,
+            grantTypes: parsed.grantTypes,
+            responseTypes: parsed.responseTypes,
+            tokenEndpointAuthMethod: parsed.tokenEndpointAuthMethod,
+            source: "dcr",
+            createdFromIp: ip,
+            expiresAt,
+        });
+        return jsonResponse({
+            client_id: clientId,
+            redirect_uris: parsed.redirectUris,
+            grant_types: parsed.grantTypes,
+            response_types: parsed.responseTypes,
+            token_endpoint_auth_method: parsed.tokenEndpointAuthMethod,
+        }, 201);
+    }
+    /**
+     * GET /.well-known/service/oauth/authorize — RFC 6749 §4.1.1
+     * Unauthenticated → existing login (query preserved via return_to).
+     * Authenticated → pending oauth-code session + confirm UI.
+     */
+    async authorizeGet(request, instanceDid) {
+        const url = new URL(request.url);
+        const parsed = parseAuthorizeQuery(url.searchParams);
+        if (!parsed.ok)
+            return parsed.response;
+        const client = await resolveOAuthClient(this.store, parsed.clientId);
+        if (!client) {
+            return oauthError("invalid_client", "Unknown client_id", 400);
+        }
+        if (!client.redirectUris.includes(parsed.redirectUri)) {
+            return oauthError("invalid_request", "redirect_uri is not registered for this client", 400);
+        }
+        const caller = this.auth ? await this.auth.verifyFull(request, instanceDid) : null;
+        if (!caller) {
+            const login = buildLoginUrl({ returnTo: url.pathname + url.search });
+            return redirectResponse(login);
+        }
+        if (!instanceDid) {
+            return oauthError("invalid_request", "Missing instance", 400);
+        }
+        const id = crypto.randomUUID();
+        const challenge = randomHex(24);
+        const expiresAt = new Date(Date.now() + SESSION_TTL_MS).toISOString();
+        const source = serializeOAuthCodeSource({
+            client_id: parsed.clientId,
+            redirect_uri: parsed.redirectUri,
+            code_challenge: parsed.codeChallenge,
+            code_challenge_method: "S256",
+            state: parsed.state,
+            userDid: caller.did,
+            instanceDid,
+        });
+        await this.store.purgeExpiredAccessKeySessions();
+        await this.store.createAccessKeySession({ id, challenge, source, expiresAt });
+        const confirm = new URL(VERIFICATION_PATH, url.origin);
+        confirm.searchParams.set("__token__", id);
+        confirm.searchParams.set("oauth", "1");
+        confirm.searchParams.set("source", parsed.clientId);
+        return redirectResponse(confirm.pathname + confirm.search);
+    }
+    /**
+     * POST /.well-known/service/oauth/authorize
+     * User confirmation. Does not mint — token endpoint mints.
+     * Success: 302 redirect_uri?code&state
+     */
+    async authorizePost(request, instanceDid) {
+        const csrf = rejectCrossOrigin(request);
+        if (csrf)
+            return csrf;
+        if (!this.auth) {
+            return oauthError("access_denied", "Authentication required", 401);
+        }
+        const caller = await this.auth.verifyFull(request, instanceDid);
+        if (!caller) {
+            return oauthError("access_denied", "Authentication required", 401);
+        }
+        if (!instanceDid) {
+            return oauthError("invalid_request", "Missing instance", 400);
+        }
+        const params = await readParams(request);
+        const sid = params.sid?.trim() ?? "";
+        if (!sid) {
+            return oauthError("invalid_request", "Missing sid", 400);
+        }
+        const session = await this.store.getAccessKeySession(sid);
+        if (!session) {
+            return oauthError("invalid_grant", "Invalid or expired authorization request", 400);
+        }
+        const meta = parseOAuthCodeSource(session.source);
+        if (!meta || !isLoopbackRedirectUri(meta.redirect_uri)) {
+            return oauthError("invalid_request", "Invalid redirect_uri", 400);
+        }
+        if (meta.userDid !== caller.did || meta.instanceDid !== instanceDid) {
+            return oauthError("access_denied", "Authorization session is bound to another user or instance", 403);
+        }
+        if (session.status === "completed") {
+            return oauthError("invalid_grant", "Authorization request already used", 400);
+        }
+        if (session.status !== "pending") {
+            this.logger.warn({
+                message: "oauth-as authorize: unexpected session status",
+                mod: "oauth-as",
+                status: session.status,
+            });
+            return oauthError("invalid_grant", "Invalid authorization state", 400);
+        }
+        // Fresh one-time code — never reuse the session id the creator already knows.
+        const code = crypto.randomUUID();
+        const payload = {
+            did: caller.did,
+            role: caller.role || "guest",
+            instanceDid,
+        };
+        const encrypted = await encryptAES(JSON.stringify(payload), session.challenge);
+        await this.store.deleteAccessKeySession(sid);
+        await this.store.createAccessKeySession({
+            id: code,
+            challenge: session.challenge,
+            source: serializeOAuthCodeSource(meta),
+            expiresAt: session.expires_at,
+        });
+        await this.store.updateAccessKeySession(code, {
+            status: "completed",
+            accessKeyId: "",
+            accessKeySecretEncrypted: encrypted,
+        });
+        const target = new URL(meta.redirect_uri);
+        target.hash = "";
+        target.searchParams.set("code", code);
+        if (meta.state)
+            target.searchParams.set("state", meta.state);
+        return redirectResponse(target.toString());
+    }
     /**
      * POST /.well-known/service/oauth/device_authorization — RFC 8628 §3.1
      * Creates an access-key session; device_code = session id.
@@ -76,9 +286,7 @@ export class OAuthAsHandler {
         const clientId = params.client_id?.trim() || "";
         const source = clientId ? `oauth-device:${clientId}` : "oauth-device";
         const id = crypto.randomUUID();
-        const challenge = Array.from(crypto.getRandomValues(new Uint8Array(24)))
-            .map((b) => b.toString(16).padStart(2, "0"))
-            .join("");
+        const challenge = randomHex(24);
         const userCode = generateUserCode();
         const expiresAt = new Date(Date.now() + SESSION_TTL_MS).toISOString();
         await this.store.purgeExpiredAccessKeySessions();
@@ -103,14 +311,20 @@ export class OAuthAsHandler {
         });
     }
     /**
-     * POST /.well-known/service/oauth/token — RFC 8628 §3.4 / §3.5
-     * On success returns the plaintext access-key secret as access_token.
+     * POST /.well-known/service/oauth/token — RFC 8628 §3.4 / RFC 6749 §4.1.3
+     * Device: decrypt session secret. Code: mint a new instance-bound access key.
      */
-    async token(request) {
+    async token(request, instanceDid) {
         const params = await readParams(request);
         const grantType = params.grant_type ?? "";
+        if (grantType === CODE_GRANT) {
+            return this.authorizationCodeToken(params, instanceDid);
+        }
+        if (grantType === REFRESH_GRANT) {
+            return this.refreshTokenGrant(params, instanceDid);
+        }
         if (grantType !== DEVICE_GRANT) {
-            return oauthError("unsupported_grant_type", "Only device_code grant is supported", 400);
+            return oauthError("unsupported_grant_type", "Only device_code, authorization_code, and refresh_token grants are supported", 400);
         }
         const deviceCode = params.device_code?.trim() ?? "";
         if (!deviceCode) {
@@ -158,6 +372,414 @@ export class OAuthAsHandler {
             scope: "mcp",
         });
     }
+    /**
+     * grant_type=authorization_code — PKCE S256, one-time code, mint at token.
+     */
+    async authorizationCodeToken(params, instanceDid) {
+        const code = params.code?.trim() ?? "";
+        const verifier = params.code_verifier ?? "";
+        const redirectUri = params.redirect_uri ?? "";
+        const clientId = params.client_id?.trim() ?? "";
+        if (!code || !verifier || !redirectUri || !clientId) {
+            return oauthError("invalid_request", "Missing code, code_verifier, redirect_uri, or client_id", 400);
+        }
+        if (!instanceDid) {
+            return oauthError("invalid_request", "Missing instance", 400);
+        }
+        if (!isLoopbackRedirectUri(redirectUri)) {
+            return oauthError("invalid_request", "Invalid redirect_uri", 400);
+        }
+        const session = await this.store.getAccessKeySession(code);
+        if (!session) {
+            return oauthError("invalid_grant", "Invalid or expired code", 400);
+        }
+        const meta = parseOAuthCodeSource(session.source);
+        if (!meta || !isLoopbackRedirectUri(meta.redirect_uri)) {
+            return oauthError("invalid_grant", "Invalid or expired code", 400);
+        }
+        if (session.status !== "completed") {
+            return oauthError("invalid_grant", "Authorization not completed", 400);
+        }
+        if (meta.client_id !== clientId || meta.redirect_uri !== redirectUri) {
+            return oauthError("invalid_grant", "client_id or redirect_uri mismatch", 400);
+        }
+        if (meta.instanceDid !== instanceDid) {
+            return oauthError("invalid_grant", "instance mismatch", 400);
+        }
+        if (meta.code_challenge_method !== "S256" || !PKCE_VERIFIER_RE.test(verifier)) {
+            return oauthError("invalid_grant", "Invalid code_verifier", 400);
+        }
+        const computed = await s256Challenge(verifier);
+        if (!timingSafeEqual(computed, meta.code_challenge)) {
+            return oauthError("invalid_grant", "Invalid code_verifier", 400);
+        }
+        if (!session.access_key_secret_encrypted || !session.challenge) {
+            return oauthError("invalid_grant", "Authorization data missing", 400);
+        }
+        let grant;
+        try {
+            grant = JSON.parse(await decryptAES(session.access_key_secret_encrypted, session.challenge));
+        }
+        catch (err) {
+            this.logger.error({
+                message: "oauth-as token: grant decrypt failed",
+                mod: "oauth-as",
+                err,
+            });
+            return oauthError("invalid_grant", "Authorization data missing", 400);
+        }
+        if (!grant?.did || grant.did !== meta.userDid || grant.instanceDid !== instanceDid) {
+            return oauthError("invalid_grant", "Authorization data missing", 400);
+        }
+        if (!this.accessKeyHandler) {
+            return oauthError("server_error", "Access key minting is not configured", 500);
+        }
+        const expireAt = new Date(Date.now() + OAUTH_ACCESS_TTL_SECONDS * 1000).toISOString();
+        const accessKey = await this.accessKeyHandler.createKeyInternal({
+            role: grant.role || "guest",
+            remark: `OAuth: ${meta.client_id}`,
+            createdBy: grant.did,
+            authType: "oauth",
+            instanceDid,
+            expireAt,
+        });
+        const refresh = await this.store.createRefreshToken(grant.did, REFRESH_TOKEN_TTL_SECONDS, {
+            accessKeyId: accessKey.accessKeyId,
+        });
+        await this.store.deleteAccessKeySession(code);
+        return jsonResponse({
+            access_token: accessKey.accessKeySecret,
+            token_type: "Bearer",
+            scope: "mcp",
+            expires_in: OAUTH_ACCESS_TTL_SECONDS,
+            refresh_token: refresh.plaintext,
+        });
+    }
+    /**
+     * grant_type=refresh_token — mint a new access key + refresh, delete the old key.
+     * Does not call rotateRefreshToken (that path is session-JWT and drops accessKeyId).
+     */
+    async refreshTokenGrant(params, instanceDid) {
+        const presented = params.refresh_token?.trim() ?? "";
+        if (!presented) {
+            return oauthError("invalid_request", "Missing refresh_token", 400);
+        }
+        if (!instanceDid) {
+            return oauthError("invalid_request", "Missing instance", 400);
+        }
+        const row = await this.store.getRefreshTokenRow(presented);
+        if (!row || row.revokedAt) {
+            return oauthError("invalid_grant", "Invalid refresh_token", 400);
+        }
+        if (new Date(row.expiresAt).getTime() < Date.now()) {
+            return oauthError("invalid_grant", "Invalid refresh_token", 400);
+        }
+        // Session-JWT refresh rows have no accessKeyId — not an OAuth grant.
+        if (!row.accessKeyId) {
+            return oauthError("invalid_grant", "Invalid refresh_token", 400);
+        }
+        const oldKey = await this.store.getAccessKeyById(row.accessKeyId);
+        if (!oldKey || oldKey.authType !== "oauth") {
+            return oauthError("invalid_grant", "Invalid refresh_token", 400);
+        }
+        if (oldKey.instanceDid !== instanceDid) {
+            return oauthError("invalid_grant", "instance mismatch", 400);
+        }
+        const minted = generateAccessKey();
+        const expireAt = new Date(Date.now() + OAUTH_ACCESS_TTL_SECONDS * 1000).toISOString();
+        const newRefreshPlain = generateRefreshTokenId();
+        const newRefreshHash = await hashRefreshToken(newRefreshPlain);
+        const refreshExpiresAt = new Date(Date.now() + REFRESH_TOKEN_TTL_SECONDS * 1000).toISOString();
+        try {
+            await this.store.rotateOauthAccessGrant({
+                oldAccessKeyId: oldKey.accessKeyId,
+                oldRefreshHash: row.tokenHash,
+                newKey: {
+                    accessKeyId: minted.accessKeyId,
+                    accessKeyPublic: minted.accessKeyPublic,
+                    role: oldKey.role,
+                    remark: oldKey.remark,
+                    createdBy: oldKey.createdBy,
+                    expireAt,
+                    instanceDid: oldKey.instanceDid ?? instanceDid,
+                    authType: "oauth",
+                },
+                newRefresh: {
+                    tokenHash: newRefreshHash,
+                    userDid: row.userDid,
+                    familyId: row.familyId,
+                    accessKeyId: minted.accessKeyId,
+                    expiresAt: refreshExpiresAt,
+                },
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (/UNIQUE constraint/i.test(msg)) {
+                return oauthError("invalid_grant", "Invalid refresh_token", 400);
+            }
+            throw err;
+        }
+        return jsonResponse({
+            access_token: minted.accessKeySecret,
+            token_type: "Bearer",
+            scope: "mcp",
+            expires_in: OAUTH_ACCESS_TTL_SECONDS,
+            refresh_token: newRefreshPlain,
+        });
+    }
+}
+// ─── Authorize query / PKCE / redirect URI ─────────────────────────
+function parseAuthorizeQuery(search) {
+    const clientId = search.get("client_id")?.trim() ?? "";
+    const redirectUri = search.get("redirect_uri") ?? "";
+    const responseType = search.get("response_type") ?? "";
+    const codeChallenge = search.get("code_challenge") ?? "";
+    const method = search.get("code_challenge_method") ?? "";
+    const state = search.get("state") ?? "";
+    if (!clientId) {
+        return { ok: false, response: oauthError("invalid_request", "Missing client_id", 400) };
+    }
+    if (!redirectUri || !isLoopbackRedirectUri(redirectUri)) {
+        // Never redirect to an unvalidated redirect_uri (open-redirect guard).
+        return { ok: false, response: oauthError("invalid_request", "Invalid redirect_uri", 400) };
+    }
+    if (responseType !== "code") {
+        return { ok: false, response: oauthError("unsupported_response_type", "Only response_type=code is supported", 400) };
+    }
+    if (!codeChallenge || !PKCE_CHALLENGE_RE.test(codeChallenge)) {
+        return { ok: false, response: oauthError("invalid_request", "Missing or invalid code_challenge", 400) };
+    }
+    // Missing method is RFC 7636 "plain"; we only support S256.
+    if (method !== "S256") {
+        return { ok: false, response: oauthError("invalid_request", "Only code_challenge_method=S256 is supported", 400) };
+    }
+    return { ok: true, clientId, redirectUri, codeChallenge, state };
+}
+/**
+ * RFC 8252 loopback redirect: http://127.0.0.1:<port>/... or http://[::1]:<port>/...
+ * Any port. HTTPS loopback and non-loopback hosts are rejected.
+ */
+function isLoopbackRedirectUri(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== "http:")
+        return false;
+    if (url.username || url.password)
+        return false;
+    if (url.hash)
+        return false;
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    return host === "127.0.0.1" || host === "::1";
+}
+/**
+ * DCR table ∪ pre-registered. Expired DCR rows are treated as unknown.
+ * Device grant must NOT call this (unregistered client_id stays valid).
+ */
+export async function resolveOAuthClient(store, clientId) {
+    const id = clientId.trim();
+    if (!id)
+        return null;
+    const row = await store.getOAuthClient(id);
+    if (row && !isOAuthClientExpired(row))
+        return row;
+    return resolveCimdClient(id);
+}
+/** CIMD (Client ID Metadata Document) — stub only this wave. */
+export async function resolveCimdClient(_clientId) {
+    return null;
+}
+function isOAuthClientExpired(client) {
+    if (!client.expiresAt)
+        return false;
+    const ts = Date.parse(client.expiresAt);
+    return Number.isFinite(ts) && ts <= Date.now();
+}
+function clientIp(request) {
+    const cf = request.headers.get("CF-Connecting-IP")?.trim();
+    if (cf)
+        return cf;
+    const xff = request.headers.get("X-Forwarded-For")?.split(",")[0]?.trim();
+    if (xff)
+        return xff;
+    return "unknown";
+}
+async function parseDcrRequest(request) {
+    const ct = request.headers.get("Content-Type") ?? "";
+    if (!ct.includes("application/json")) {
+        return {
+            ok: false,
+            response: dcrError("invalid_client_metadata", "Content-Type must be application/json"),
+        };
+    }
+    let text;
+    try {
+        text = await request.text();
+    }
+    catch {
+        return { ok: false, response: dcrError("invalid_client_metadata", "Invalid request body") };
+    }
+    if (!text.trim()) {
+        return { ok: false, response: dcrError("invalid_client_metadata", "Empty request body") };
+    }
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        return { ok: false, response: dcrError("invalid_client_metadata", "Request body must be JSON") };
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+        return { ok: false, response: dcrError("invalid_client_metadata", "Request body must be a JSON object") };
+    }
+    const rec = body;
+    if (!Object.hasOwn(rec, "redirect_uris")) {
+        return { ok: false, response: dcrError("invalid_redirect_uri", "Missing redirect_uris") };
+    }
+    if (!Array.isArray(rec.redirect_uris) || rec.redirect_uris.length === 0) {
+        return { ok: false, response: dcrError("invalid_redirect_uri", "redirect_uris must be a non-empty array") };
+    }
+    const redirectUris = [];
+    for (const uri of rec.redirect_uris) {
+        if (typeof uri !== "string" || !uri) {
+            return { ok: false, response: dcrError("invalid_redirect_uri", "redirect_uris must be strings") };
+        }
+        if (!isLoopbackRedirectUri(uri)) {
+            return {
+                ok: false,
+                response: dcrError("invalid_redirect_uri", "Only RFC 8252 loopback redirect_uris are allowed"),
+            };
+        }
+        redirectUris.push(uri);
+    }
+    let grantTypes = [CODE_GRANT];
+    if (rec.grant_types !== undefined) {
+        if (!Array.isArray(rec.grant_types) || rec.grant_types.length === 0) {
+            return { ok: false, response: dcrError("invalid_client_metadata", "grant_types must be a non-empty array") };
+        }
+        if (rec.grant_types.some((g) => typeof g !== "string")) {
+            return { ok: false, response: dcrError("invalid_client_metadata", "grant_types must be strings") };
+        }
+        grantTypes = rec.grant_types;
+        if (grantTypes.some((g) => !SUPPORTED_GRANT_TYPES.has(g))) {
+            return { ok: false, response: dcrError("invalid_client_metadata", "Unsupported grant_types") };
+        }
+    }
+    let responseTypes = ["code"];
+    if (rec.response_types !== undefined) {
+        if (!Array.isArray(rec.response_types) || rec.response_types.length === 0) {
+            return { ok: false, response: dcrError("invalid_client_metadata", "response_types must be a non-empty array") };
+        }
+        if (rec.response_types.some((t) => typeof t !== "string")) {
+            return { ok: false, response: dcrError("invalid_client_metadata", "response_types must be strings") };
+        }
+        responseTypes = rec.response_types;
+        if (responseTypes.some((t) => !SUPPORTED_RESPONSE_TYPES.has(t))) {
+            return { ok: false, response: dcrError("invalid_client_metadata", "Unsupported response_types") };
+        }
+    }
+    let tokenEndpointAuthMethod = "none";
+    if (rec.token_endpoint_auth_method !== undefined) {
+        if (rec.token_endpoint_auth_method !== "none") {
+            return {
+                ok: false,
+                response: dcrError("invalid_client_metadata", "Only token_endpoint_auth_method=none is supported"),
+            };
+        }
+        tokenEndpointAuthMethod = "none";
+    }
+    return { ok: true, redirectUris, grantTypes, responseTypes, tokenEndpointAuthMethod };
+}
+function dcrError(error, description) {
+    return jsonResponse({ error, error_description: description }, 400);
+}
+function serializeOAuthCodeSource(meta) {
+    return `${OAUTH_CODE_SOURCE_PREFIX}${JSON.stringify(meta)}`;
+}
+function parseOAuthCodeSource(source) {
+    if (!source.startsWith(OAUTH_CODE_SOURCE_PREFIX))
+        return null;
+    try {
+        const parsed = JSON.parse(source.slice(OAUTH_CODE_SOURCE_PREFIX.length));
+        if (typeof parsed.client_id !== "string" ||
+            typeof parsed.redirect_uri !== "string" ||
+            typeof parsed.code_challenge !== "string" ||
+            parsed.code_challenge_method !== "S256" ||
+            typeof parsed.userDid !== "string" ||
+            !parsed.userDid ||
+            typeof parsed.instanceDid !== "string" ||
+            !parsed.instanceDid ||
+            !isLoopbackRedirectUri(parsed.redirect_uri)) {
+            return null;
+        }
+        return {
+            client_id: parsed.client_id,
+            redirect_uri: parsed.redirect_uri,
+            code_challenge: parsed.code_challenge,
+            code_challenge_method: "S256",
+            state: typeof parsed.state === "string" ? parsed.state : "",
+            userDid: parsed.userDid,
+            instanceDid: parsed.instanceDid,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** Cookie POST must be same-origin. Missing Origin/Referer is fail-closed. */
+function rejectCrossOrigin(request) {
+    const reqOrigin = new URL(request.url).origin;
+    const headerOrigin = request.headers.get("Origin");
+    if (headerOrigin) {
+        try {
+            if (new URL(headerOrigin).origin === reqOrigin)
+                return null;
+        }
+        catch {
+            /* invalid Origin */
+        }
+        return oauthError("access_denied", "Cross-origin request rejected", 403);
+    }
+    const referer = request.headers.get("Referer");
+    if (referer) {
+        try {
+            if (new URL(referer).origin === reqOrigin)
+                return null;
+        }
+        catch {
+            /* invalid Referer */
+        }
+        return oauthError("access_denied", "Cross-origin request rejected", 403);
+    }
+    return oauthError("access_denied", "Missing Origin", 403);
+}
+async function s256Challenge(verifier) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+    return base64UrlEncode(new Uint8Array(digest));
+}
+function base64UrlEncode(bytes) {
+    let binary = "";
+    for (const b of bytes)
+        binary += String.fromCharCode(b);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let out = 0;
+    for (let i = 0; i < a.length; i++)
+        out |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return out === 0;
+}
+function randomHex(byteLength) {
+    return Array.from(crypto.getRandomValues(new Uint8Array(byteLength)))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
 }
 // ─── Helpers ───────────────────────────────────────────────────────────
 function generateUserCode() {
@@ -207,6 +829,15 @@ function jsonResponse(data, status = 200, cacheControl = "private, no-store") {
         },
     });
 }
+function redirectResponse(location) {
+    return new Response(null, {
+        status: 302,
+        headers: {
+            Location: location,
+            "Cache-Control": "private, no-store",
+        },
+    });
+}
 function oauthError(error, description, status) {
     return jsonResponse({ error, error_description: description }, status);
 }