@arcblock/did-connect-service 4.1.19 → 4.1.21

package/dist/handlers/cimd.js

@@ -0,0 +1,370 @@
+/**
+ * OAuth Client ID Metadata Documents (CIMD) —
+ * draft-ietf-oauth-client-id-metadata-document-00.
+ *
+ * The client's `client_id` IS an https URL; the AS fetches that URL at
+ * authorization time to learn the client's name and redirect URIs. Unlike DCR
+ * (which the MCP spec now marks deprecated), the identity is bound to a domain
+ * the client demonstrably controls — which is what lets the consent screen show
+ * a name worth trusting instead of an opaque UUID.
+ *
+ * This module is deliberately paranoid: the AS is being told to make an
+ * outbound request to an attacker-chosen URL, so every guard below is load
+ * bearing. See {@link assertSafeCimdUrl} and {@link fetchCimdClient}.
+ */
+/** Spec §5: "The recommended maximum response size ... is 5 kilobytes." */
+export const CIMD_MAX_BYTES = 5 * 1024;
+/** Outbound fetch budget. A slow client host must not stall authorization. */
+export const CIMD_FETCH_TIMEOUT_MS = 5_000;
+/** Cache window when the document carries no usable Cache-Control. */
+export const CIMD_DEFAULT_TTL_SECONDS = 60 * 60;
+/** Clamp for a document-supplied max-age (spec: the AS MAY set its own bounds). */
+export const CIMD_MIN_TTL_SECONDS = 5 * 60;
+export const CIMD_MAX_TTL_SECONDS = 24 * 60 * 60;
+const CACHE_PREFIX = "cimd:";
+/** Shared-secret auth methods the spec forbids for CIMD clients. */
+const FORBIDDEN_AUTH_METHODS = new Set([
+    "client_secret_post",
+    "client_secret_basic",
+    "client_secret_jwt",
+]);
+/**
+ * Cheap discriminator: does this client_id want the CIMD path at all?
+ * Anything else (UUID, hand-picked string) stays on the DCR / pre-registered
+ * path, so this must not throw or fetch.
+ */
+export function isCimdClientId(value) {
+    return value.startsWith("https://") || value.startsWith("http://");
+}
+/**
+ * Spec §3 URL rules plus SSRF hardening (§6.1).
+ *
+ * Rejects: non-https, no path component, dot segments, fragment, userinfo, and
+ * hosts that are loopback/private/link-local IP literals or `localhost`.
+ *
+ * Residual risk, stated plainly: a hostname that resolves to a private address
+ * (DNS rebinding) cannot be caught here, because the runtime resolves DNS
+ * inside `fetch`. Literal-address filtering is the mitigation available to us;
+ * deployments that need more must egress-filter at the network layer.
+ */
+export function assertSafeCimdUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return { ok: false, reason: "client_id is not a valid URL" };
+    }
+    if (url.protocol !== "https:") {
+        return { ok: false, reason: "client_id URL must use https" };
+    }
+    if (url.username || url.password) {
+        return { ok: false, reason: "client_id URL must not contain userinfo" };
+    }
+    if (url.hash) {
+        return { ok: false, reason: "client_id URL must not contain a fragment" };
+    }
+    // "MUST contain a path component" — a bare origin carries no document.
+    if (url.pathname === "/" || url.pathname === "") {
+        return { ok: false, reason: "client_id URL must contain a path component" };
+    }
+    // Check the RAW string, not url.pathname: the URL parser already resolves
+    // `/a/../c.json` to `/c.json`, so inspecting the parsed path would always
+    // pass. The client_id is also compared byte-for-byte against the document's
+    // own client_id, so the literal form is what matters.
+    if (hasDotSegment(value)) {
+        return { ok: false, reason: "client_id URL must not contain dot path segments" };
+    }
+    if (isBlockedHost(url.hostname)) {
+        return { ok: false, reason: "client_id URL host is not publicly routable" };
+    }
+    return { ok: true, url };
+}
+/**
+ * Dot-segment detection on the raw client_id, including the percent-encoded
+ * forms a server might still resolve (`%2e%2e`).
+ */
+function hasDotSegment(raw) {
+    const schemeEnd = raw.indexOf("://");
+    const pathStart = schemeEnd < 0 ? -1 : raw.indexOf("/", schemeEnd + 3);
+    if (pathStart < 0)
+        return false;
+    const path = raw.slice(pathStart).split(/[?#]/)[0] ?? "";
+    return path
+        .toLowerCase()
+        .split("/")
+        .some((seg) => {
+        const decoded = seg.replace(/%2e/g, ".");
+        return decoded === "." || decoded === "..";
+    });
+}
+function isBlockedHost(hostname) {
+    const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    if (host === "localhost" || host.endsWith(".localhost"))
+        return true;
+    // IPv4 literal → block loopback / private / link-local / CGNAT / unspecified.
+    const v4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (v4) {
+        const [a, b] = [Number(v4[1]), Number(v4[2])];
+        if (a === 10 || a === 127 || a === 0)
+            return true;
+        if (a === 172 && b >= 16 && b <= 31)
+            return true;
+        if (a === 192 && b === 168)
+            return true;
+        if (a === 169 && b === 254)
+            return true;
+        if (a === 100 && b >= 64 && b <= 127)
+            return true;
+        return false;
+    }
+    // IPv6 literal → block loopback / unspecified / ULA / link-local, and any
+    // IPv4-mapped form whose embedded address is itself blocked.
+    if (host.includes(":")) {
+        if (host === "::1" || host === "::")
+            return true;
+        if (/^f[cd][0-9a-f]{2}:/.test(host))
+            return true;
+        if (/^fe[89ab][0-9a-f]:/.test(host))
+            return true;
+        // Dotted IPv4-mapped form, e.g. ::ffff:169.254.169.254
+        const dotted = host.match(/::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+        if (dotted)
+            return isBlockedHost(dotted[1]);
+        // ...and the hex form the URL parser normalises it to (::ffff:a9fe:a9fe).
+        const hex = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+        if (hex) {
+            const high = Number.parseInt(hex[1], 16);
+            const low = Number.parseInt(hex[2], 16);
+            return isBlockedHost([high >> 8, high & 0xff, low >> 8, low & 0xff].join("."));
+        }
+        return false;
+    }
+    return false;
+}
+/**
+ * Fetch + validate a Client ID Metadata Document.
+ *
+ * Spec compliance notes:
+ * - `client_id` inside the document MUST equal the URL (simple string
+ *   comparison, RFC 3986 §6.2.1) — this is what stops one domain from
+ *   impersonating another's document.
+ * - Redirects are refused. The document's `client_id` must equal the URL we
+ *   were given, so a redirect either lands somewhere that fails that check or
+ *   is an SSRF chain we have no reason to walk.
+ * - Errors and malformed documents are never cached (spec §5).
+ */
+export async function fetchCimdClient(clientId, redirectUriValidator, deps = {}) {
+    const checked = assertSafeCimdUrl(clientId);
+    if (!checked.ok)
+        return checked;
+    const cacheKey = `${CACHE_PREFIX}${clientId}`;
+    if (deps.cache) {
+        const hit = await deps.cache.get(cacheKey).catch(() => null);
+        if (hit) {
+            const parsed = parseCimdDocument(hit, clientId, redirectUriValidator);
+            // A poisoned/stale cache entry must not be fatal — fall through to a
+            // live fetch rather than locking the client out.
+            if (parsed.ok)
+                return parsed;
+        }
+    }
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), CIMD_FETCH_TIMEOUT_MS);
+    let response;
+    try {
+        response = await fetchImpl(checked.url.toString(), {
+            method: "GET",
+            redirect: "error",
+            headers: { Accept: "application/json" },
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        deps.logger?.warn({
+            message: "cimd: metadata fetch failed",
+            mod: "oauth-as",
+            clientId,
+            err,
+        });
+        return { ok: false, reason: "client_id metadata document could not be fetched" };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!response.ok) {
+        return { ok: false, reason: `client_id metadata document returned HTTP ${response.status}` };
+    }
+    const declared = Number(response.headers.get("content-length") ?? "");
+    if (Number.isFinite(declared) && declared > CIMD_MAX_BYTES) {
+        return { ok: false, reason: "client_id metadata document is too large" };
+    }
+    const body = await readCapped(response, CIMD_MAX_BYTES);
+    if (body === null) {
+        return { ok: false, reason: "client_id metadata document is too large" };
+    }
+    const parsed = parseCimdDocument(body, clientId, redirectUriValidator);
+    if (!parsed.ok)
+        return parsed;
+    if (deps.cache) {
+        const ttl = cacheTtlFrom(response.headers.get("cache-control"));
+        await deps.cache.put(cacheKey, body, ttl).catch(() => { });
+    }
+    return parsed;
+}
+/** Reads at most `max` bytes; returns null if the body exceeds it. */
+async function readCapped(response, max) {
+    if (!response.body) {
+        const text = await response.text().catch(() => "");
+        return text.length > max ? null : text;
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > max) {
+                await reader.cancel().catch(() => { });
+                return null;
+            }
+            chunks.push(value);
+        }
+    }
+    catch {
+        return null;
+    }
+    const merged = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        merged.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(merged);
+}
+/** Honour Cache-Control max-age, clamped to our own bounds (spec allows this). */
+function cacheTtlFrom(cacheControl) {
+    if (!cacheControl)
+        return CIMD_DEFAULT_TTL_SECONDS;
+    const lowered = cacheControl.toLowerCase();
+    if (lowered.includes("no-store") || lowered.includes("no-cache"))
+        return CIMD_MIN_TTL_SECONDS;
+    const match = lowered.match(/max-age\s*=\s*(\d+)/);
+    if (!match)
+        return CIMD_DEFAULT_TTL_SECONDS;
+    const seconds = Number(match[1]);
+    if (!Number.isFinite(seconds))
+        return CIMD_DEFAULT_TTL_SECONDS;
+    return Math.min(CIMD_MAX_TTL_SECONDS, Math.max(CIMD_MIN_TTL_SECONDS, seconds));
+}
+export function parseCimdDocument(body, clientId, redirectUriValidator) {
+    let doc;
+    try {
+        doc = JSON.parse(body);
+    }
+    catch {
+        return { ok: false, reason: "client_id metadata document is not valid JSON" };
+    }
+    if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+        return { ok: false, reason: "client_id metadata document must be a JSON object" };
+    }
+    const rec = doc;
+    // The anchor of the whole scheme: the document must claim the exact URL it
+    // was served from, so example.com cannot publish a document for another.
+    if (rec.client_id !== clientId) {
+        return { ok: false, reason: "client_id in metadata document does not match its URL" };
+    }
+    if ("client_secret" in rec || "client_secret_expires_at" in rec) {
+        return { ok: false, reason: "client_id metadata document must not carry a client_secret" };
+    }
+    if (typeof rec.token_endpoint_auth_method === "string" &&
+        FORBIDDEN_AUTH_METHODS.has(rec.token_endpoint_auth_method)) {
+        return { ok: false, reason: "client_id metadata document requests a shared-secret auth method" };
+    }
+    const clientName = sanitizeDisplayText(rec.client_name);
+    if (!clientName) {
+        return { ok: false, reason: "client_id metadata document is missing client_name" };
+    }
+    if (!Array.isArray(rec.redirect_uris) || rec.redirect_uris.length === 0) {
+        return { ok: false, reason: "client_id metadata document is missing redirect_uris" };
+    }
+    const redirectUris = [];
+    for (const uri of rec.redirect_uris) {
+        if (typeof uri !== "string" || !redirectUriValidator(uri)) {
+            return { ok: false, reason: "client_id metadata document has an unusable redirect_uri" };
+        }
+        redirectUris.push(uri);
+    }
+    const clientUri = typeof rec.client_uri === "string" ? rec.client_uri : undefined;
+    // logo_uri is only honoured when it is served from the same host as the
+    // metadata document, so a client cannot point at someone else's brand.
+    const logoUri = sameHostHttps(rec.logo_uri, clientId);
+    return {
+        ok: true,
+        client: {
+            clientId,
+            clientName,
+            ...(clientUri && sameHostHttps(clientUri, clientId) ? { clientUri } : {}),
+            ...(logoUri ? { logoUri } : {}),
+            redirectUris,
+        },
+    };
+}
+/** Max length of a client-supplied display name on the consent screen. */
+export const CIMD_NAME_MAX = 64;
+/**
+ * A client-supplied name is rendered next to an Authorize button, so strip
+ * anything that can fake structure: control characters and the bidi overrides
+ * used to make "…gpj.exe" read as "…exe.jpg". Rendering is still textContent
+ * only — this is defence in depth, not the only guard.
+ */
+export function sanitizeDisplayText(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const cleaned = value
+        // biome-ignore lint/suspicious/noControlCharactersInRegex: stripping them is the point
+        .replace(/[\u0000-\u001F\u007F]/g, "")
+        // Zero-width + bidi overrides: the trick that renders one string as another.
+        .replace(/[\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]/g, "")
+        .trim();
+    if (!cleaned)
+        return undefined;
+    return cleaned.length > CIMD_NAME_MAX
+        ? cleaned.slice(0, CIMD_NAME_MAX) + "\u2026"
+        : cleaned;
+}
+/**
+ * A branding URL is only honoured when it is https and lives on the same host
+ * as the metadata document, so a client cannot point at someone else's assets.
+ *
+ * Exported because it is re-applied every time the value is read back out of
+ * storage, not just at fetch time: the consent screen must never render a logo
+ * from a host that is not the client's own, whatever wrote the row.
+ *
+ * It bounds impersonation, it does not eliminate it — a client that controls
+ * evil.test can still host a copy of someone else's artwork there. That is why
+ * the consent screen keeps showing the destination and the trust badge.
+ */
+export function sameHostHttps(value, clientId) {
+    if (typeof value !== "string" || !value)
+        return undefined;
+    try {
+        const candidate = new URL(value);
+        const base = new URL(clientId);
+        if (candidate.protocol !== "https:")
+            return undefined;
+        if (candidate.hostname !== base.hostname)
+            return undefined;
+        return value;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=cimd.js.map

package/dist/handlers/cimd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../src/handlers/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AACvC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAC3C,sEAAsE;AACtE,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAChD,mFAAmF;AACnF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEjD,MAAM,YAAY,GAAG,OAAO,CAAC;AAE7B,oEAAoE;AACpE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,oBAAoB;IACpB,qBAAqB;IACrB,mBAAmB;CACpB,CAAC,CAAC;AAuBH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAC5E,CAAC;IACD,uEAAuE;IACvE,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IAC9E,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,sDAAsD;IACtD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;IACvE,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,OAAO,IAAI;SACR,WAAW,EAAE;SACb,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACZ,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;IAC7C,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAErE,8EAA8E;IAC9E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACtE,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0EAA0E;IAC1E,6DAA6D;IAC7D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,uDAAuD;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC1E,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QAC7C,0EAA0E;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACnE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;YACzC,OAAO,aAAa,CAClB,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,oBAA8C,EAC9C,OAAiB,EAAE;IAEnB,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAEhC,MAAM,QAAQ,GAAG,GAAG,YAAY,GAAG,QAAQ,EAAE,CAAC;IAC9C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;YACtE,qEAAqE;YACrE,iDAAiD;YACjD,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,qBAAqB,CAAC,CAAC;IAE1E,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACjD,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;YAChB,OAAO,EAAE,6BAA6B;YACtC,GAAG,EAAE,UAAU;YACf,QAAQ;YACR,GAAG;SACJ,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IACnF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/F,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,cAAc,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAE9B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,GAAW;IACvD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;gBAChB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,YAA2B;IAC/C,IAAI,CAAC,YAAY;QAAE,OAAO,wBAAwB,CAAC;IACnD,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAC9F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,wBAAwB,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,wBAAwB,CAAC;IAC/D,OAAO,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,QAAgB,EAChB,oBAA8C;IAE9C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,eAAe,IAAI,GAAG,IAAI,0BAA0B,IAAI,GAAG,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;IAC7F,CAAC;IACD,IACE,OAAO,GAAG,CAAC,0BAA0B,KAAK,QAAQ;QAClD,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAC1D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;IACrF,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0DAA0D,EAAE,CAAC;QAC3F,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEtD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,QAAQ;YACR,UAAU;YACV,GAAG,CAAC,SAAS,IAAI,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,YAAY;SACb;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK;QACnB,uFAAuF;SACtF,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;QACtC,6EAA6E;SAC5E,OAAO,CAAC,kDAAkD,EAAE,EAAE,CAAC;SAC/D,IAAI,EAAE,CAAC;IACV,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,OAAO,CAAC,MAAM,GAAG,aAAa;QACnC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,GAAG,QAAQ;QAC5C,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,QAAgB;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtD,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/handlers/oauth-as-handler.d.ts

@@ -39,10 +39,16 @@
 import { type Logger } from "../logger.js";
 import { type D1Store, type StoredOAuthClient } from "../store/d1-store.js";
 import type { AccessKeyHandler } from "./access-key-handler.js";
+import { type CimdDeps } from "./cimd.js";
 import type { Auth } from "./passkey-handler.js";
 /** Unverified estimate aligned with the epic: 1 hour OAuth access TTL. */
 export declare const OAUTH_ACCESS_TTL_SECONDS: number;
-/** Unverified estimate: DCR records expire after 7 days. */
+/**
+ * Grace period for an *unused* DCR registration — a drive-by or abandoned
+ * `POST /register` is swept after 7 days. Once a user actually consents to the
+ * client, {@link D1Store.clearOAuthClientExpiry} drops the TTL for good, so a
+ * connector in real use never expires out from under its owner.
+ */
 export declare const OAUTH_DCR_TTL_SECONDS: number;
 /** Unverified estimate: DCR registrations per IP per window. */
 export declare const OAUTH_DCR_RATE_LIMIT = 20;
@@ -57,6 +63,11 @@ export interface OAuthAsHandlerOptions {
     accessKeyHandler?: AccessKeyHandler;
     /** Override DCR per-IP rate limit (tests). Default {@link OAUTH_DCR_RATE_LIMIT}. */
     dcrRateLimit?: number;
+    /**
+     * Outbound fetch used to retrieve Client ID Metadata Documents. Injectable so
+     * tests never touch the network; defaults to the global `fetch`.
+     */
+    cimdFetch?: typeof fetch;
 }
 export type OAuthClientRecord = StoredOAuthClient;
 export declare class OAuthAsHandler {
@@ -65,7 +76,37 @@ export declare class OAuthAsHandler {
     private auth?;
     private accessKeyHandler?;
     private dcrRateLimit;
+    private cimdFetch?;
     constructor(options: OAuthAsHandlerOptions);
+    /**
+     * Deps for the CIMD path: the injectable fetch plus a document cache backed
+     * by the existing kv_cache table (spec: respect HTTP cache headers, never
+     * cache an error or a malformed document).
+     */
+    private cimdDeps;
+    /**
+     * Durable record of an OAuth lifecycle event.
+     *
+     * Denial logs answer "why did this fail?" but roll away; this answers "who
+     * authorised which client, when, and what was minted" months later. Never
+     * carries a code, verifier, token secret, or refresh token — access key IDs
+     * are identifiers, not credentials.
+     *
+     * Audit failure must not fail the authorization it describes, but it must be
+     * visible: a silent catch here would defeat the point of having an audit.
+     */
+    private audit;
+    /**
+     * Single funnel for every rejection this handler emits. Before this existed
+     * the AS had 51 error returns and 5 log lines, so a client that stopped
+     * working ("invalid_client", "Invalid redirect_uri") left no server-side
+     * trace and had to be diagnosed by guesswork. One structured record per
+     * denial, carrying stage + error + reason + non-secret request identity.
+     *
+     * Deliberately never logs a code, code_verifier, access/refresh token, or
+     * session secret — {@link DenyContext} is the allowlist.
+     */
+    private deny;
     fetch(request: Request, instanceDid?: string): Promise<Response | null>;
     /** GET /.well-known/oauth-authorization-server — RFC 8414 */
     private metadata;
@@ -108,10 +149,70 @@ export declare class OAuthAsHandler {
     private refreshTokenGrant;
 }
 /**
- * DCR table ∪ pre-registered. Expired DCR rows are treated as unknown.
- * Device grant must NOT call this (unregistered client_id stays valid).
+ * A client the AS is willing to run an authorization for, from any of the
+ * three MCP registration mechanisms. `clientName` is populated for CIMD (and
+ * for DCR clients that supplied one) so the consent screen can show something
+ * a human recognises instead of an opaque id.
+ */
+export interface ResolvedOAuthClient {
+    clientId: string;
+    redirectUris: string[];
+    source: "dcr" | "pre-registered" | "cimd";
+    /** null = no TTL (pre-registered, consented DCR, or CIMD). */
+    expiresAt: string | null;
+    clientName?: string;
+    clientUri?: string;
+    logoUri?: string;
+}
+/**
+ * Stored row (pre-registered ∪ DCR) first, then CIMD for URL-shaped client_ids.
+ * Expired DCR rows are treated as unknown. Device grant must NOT call this
+ * (unregistered client_id stays valid there).
+ */
+export declare function resolveOAuthClient(store: D1Store, clientId: string, deps?: CimdDeps): Promise<ResolvedOAuthClient | null>;
+/**
+ * CIMD (Client ID Metadata Document) — draft-ietf-oauth-client-id-metadata-document-00.
+ * The MCP spec now prefers this over DCR: the client_id is an https URL the AS
+ * fetches, so the displayed identity is bound to a domain the client controls.
+ */
+export declare function resolveCimdClient(clientId: string, deps?: CimdDeps): Promise<ResolvedOAuthClient | null>;
+/** What the consent screen shows about the requesting client. */
+export interface OAuthConsentDisplay {
+    /** Human-readable name, when the client supplied a usable one. */
+    clientName?: string;
+    /**
+     * https logo on the client's own host (CIMD only). Same-host binding limits
+     * impersonation but does not remove it — a client can host a copy of anyone's
+     * artwork on its own domain — so the destination and badge stay authoritative.
+     */
+    logoUri?: string;
+    /** Raw client_id, for support/debugging — never the headline. */
+    clientId: string;
+    /**
+     * Where the authorization code will actually be delivered. This is the
+     * anti-phishing anchor: a client can claim any name, but it cannot claim a
+     * destination it does not control.
+     */
+    destination: {
+        kind: "web" | "device" | "app";
+        label: string;
+    };
+    /**
+     * The domain the identity is bound to, for CIMD clients. The whole point of
+     * CIMD is this binding, and the spec asks the AS to show the client_id's
+     * hostname on the authorization interface — so it must reach the screen.
+     */
+    verifiedHost?: string;
+    /**
+     * cimd = identity bound to a domain the client proved it controls.
+     * pre-registered = an operator vouched for it.
+     * dcr = self-asserted; the name means nothing on its own.
+     */
+    trust: "cimd" | "pre-registered" | "dcr";
+}
+/**
+ * Build the consent-screen descriptor from a stored authorization session.
+ * Server-side only — the page must never assemble this from its query string.
  */
-export declare function resolveOAuthClient(store: D1Store, clientId: string): Promise<OAuthClientRecord | null>;
-/** CIMD (Client ID Metadata Document) — stub only this wave. */
-export declare function resolveCimdClient(_clientId: string): Promise<OAuthClientRecord | null>;
+export declare function describeOAuthConsent(source: string): OAuthConsentDisplay | null;
 //# sourceMappingURL=oauth-as-handler.d.ts.map

package/dist/handlers/oauth-as-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-as-handler.d.ts","sourceRoot":"","sources":["../../src/handlers/oauth-as-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAKH,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,EAAE,KAAK,OAAO,EAA6B,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEvG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AASjD,0EAA0E;AAC1E,eAAO,MAAM,wBAAwB,QAAU,CAAC;AAEhD,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AACtD,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AAmBvD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAkBlD,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,IAAI,CAAC,CAAO;IACpB,OAAO,CAAC,gBAAgB,CAAC,CAAmB;IAC5C,OAAO,CAAC,YAAY,CAAS;gBAEjB,OAAO,EAAE,qBAAqB;IAQpC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAkC7E,6DAA6D;IAC7D,OAAO,CAAC,QAAQ;IAkBhB;;;;OAIG;YACW,QAAQ;IAwCtB;;;;OAIG;YACW,YAAY;IA8C1B;;;;OAIG;YACW,aAAa;IAiF3B;;;OAGG;YACW,mBAAmB;IAkCjC;;;OAGG;YACW,KAAK;IAsEnB;;OAEG;YACW,sBAAsB;IA0GpC;;;OAGG;YACW,iBAAiB;CA4EhC;AA+GD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAMnC;AAED,gEAAgE;AAChE,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAE5F"}
+{"version":3,"file":"oauth-as-handler.d.ts","sourceRoot":"","sources":["../../src/handlers/oauth-as-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAMH,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,EAAE,KAAK,OAAO,EAA6B,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEvG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EACL,KAAK,QAAQ,EAKd,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAgBjD,0EAA0E;AAC1E,eAAO,MAAM,wBAAwB,QAAU,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AACtD,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AAmBvD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AA0ElD,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,IAAI,CAAC,CAAO;IACpB,OAAO,CAAC,gBAAgB,CAAC,CAAmB;IAC5C,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,SAAS,CAAC,CAAe;gBAErB,OAAO,EAAE,qBAAqB;IAS1C;;;;OAIG;IACH,OAAO,CAAC,QAAQ;IAWhB;;;;;;;;;;OAUG;YACW,KAAK;IAyBnB;;;;;;;;;OASG;IACH,OAAO,CAAC,IAAI;IAgBN,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAsC7E,6DAA6D;IAC7D,OAAO,CAAC,QAAQ;IAoBhB;;;;OAIG;YACW,QAAQ;IAwDtB;;;;OAIG;YACW,YAAY;IA+E1B;;;;OAIG;YACW,aAAa;IAgK3B;;;OAGG;YACW,mBAAmB;IAkCjC;;;OAGG;YACW,KAAK;IA8FnB;;OAEG;YACW,sBAAsB;IAwMpC;;;OAGG;YACW,iBAAiB;CA8GhC;AA6KD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,KAAK,GAAG,gBAAgB,GAAG,MAAM,CAAC;IAC1C,8DAA8D;IAC9D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,QAAQ,GACd,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAiBrC;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,QAAQ,GACd,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAqBrC;AA4LD,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,EAAE;QAAE,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,KAAK,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAY/E"}