@atproto/oauth-provider 0.16.5 → 0.17.0

package/dist/signer/signer.js

@@ -1,15 +1,10 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Signer = exports.Keyset = void 0;
-const jwk_1 = require("@atproto/jwk");
-Object.defineProperty(exports, "Keyset", { enumerable: true, get: function () { return jwk_1.Keyset; } });
-const constants_js_1 = require("../constants.js");
-const date_js_1 = require("../lib/util/date.js");
-const access_token_payload_js_1 = require("./access-token-payload.js");
-const api_token_payload_js_1 = require("./api-token-payload.js");
-class Signer {
-    issuer;
-    keyset;
+import { Keyset, } from '@atproto/jwk';
+import { EPHEMERAL_SESSION_MAX_AGE } from '../constants.js';
+import { dateToEpoch } from '../lib/util/date.js';
+import { accessTokenPayloadSchema, } from './access-token-payload.js';
+import { apiTokenPayloadSchema } from './api-token-payload.js';
+export { Keyset };
+export class Signer {
     constructor(issuer, keyset) {
         this.issuer = issuer;
         this.keyset = keyset;
@@ -39,7 +34,7 @@ class Signer {
         const result = await this.verify(token, { ...options, typ: 'at+jwt' });
         return {
             protectedHeader: result.protectedHeader,
-            payload: access_token_payload_js_1.accessTokenPayloadSchema.parse(result.payload),
+            payload: accessTokenPayloadSchema.parse(result.payload),
         };
     }
     async createEphemeralToken(payload) {
@@ -49,21 +44,20 @@ class Signer {
         }, {
             ...payload,
             aud: `oauth-provider-api@${this.issuer}`,
-            iat: (0, date_js_1.dateToEpoch)(),
+            iat: dateToEpoch(),
         });
     }
     async verifyEphemeralToken(token, options) {
         const result = await this.verify(token, {
             ...options,
-            maxTokenAge: options?.maxTokenAge ?? constants_js_1.EPHEMERAL_SESSION_MAX_AGE / 1e3,
+            maxTokenAge: options?.maxTokenAge ?? EPHEMERAL_SESSION_MAX_AGE / 1e3,
             audience: `oauth-provider-api@${this.issuer}`,
             typ: 'at+jwt',
         });
         return {
             protectedHeader: result.protectedHeader,
-            payload: api_token_payload_js_1.apiTokenPayloadSchema.parse(result.payload),
+            payload: apiTokenPayloadSchema.parse(result.payload),
         };
     }
 }
-exports.Signer = Signer;
 //# sourceMappingURL=signer.js.map

package/dist/signer/signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/signer/signer.ts"],"names":[],"mappings":";;;AAAA,sCAOqB;AAYZ,uFAfP,YAAM,OAeO;AAXf,kDAA2D;AAC3D,iDAAiD;AAEjD,uEAGkC;AAClC,iEAA+E;AAO/E,MAAa,MAAM;IAEC;IACA;IAFlB,YACkB,MAAc,EACd,MAAc;QADd,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;IAC7B,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,KAAgB,EAChB,OAA0C;QAE1C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAI,KAAK,EAAE;YACrC,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;SACtB,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,IAAI,CACf,UAAyB,EACzB,OAAoD;QAEpD,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACxE,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU;gBAC/B,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;gBACrC,CAAC,CAAC,OAAO,CAAC;YACZ,GAAG,EAAE,IAAI,CAAC,MAAM;SACjB,CAAC,CAAC,CAAA;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,OAA2C;QAE3C,OAAO,IAAI,CAAC,IAAI,CACd;YACE,4DAA4D;YAC5D,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,QAAQ;SACd,EACD,OAAO,CACR,CAAA;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAgB,EAChB,OAAkD;QAElD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAI,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;QACzE,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,kDAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAGrD;SACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,OAAwD;QAExD,OAAO,IAAI,CAAC,IAAI,CACd;YACE,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,QAAQ;SACd,EACD;YACE,GAAG,OAAO;YACV,GAAG,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;YACxC,GAAG,EAAE,IAAA,qBAAW,GAAE;SACnB,CACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAgB,EAChB,OAA+D;QAE/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAI,KAAK,EAAE;YACzC,GAAG,OAAO;YACV,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,wCAAyB,GAAG,GAAG;YACpE,QAAQ,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;YAC7C,GAAG,EAAE,QAAQ;SACd,CAAC,CAAA;QACF,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,4CAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAGlD;SACF,CAAA;IACH,CAAC;CACF;AAzFD,wBAyFC","sourcesContent":["import {\n  JwtPayload,\n  JwtPayloadGetter,\n  JwtSignHeader,\n  Keyset,\n  SignedJwt,\n  VerifyOptions,\n} from '@atproto/jwk'\nimport { EPHEMERAL_SESSION_MAX_AGE } from '../constants.js'\nimport { dateToEpoch } from '../lib/util/date.js'\nimport { OmitKey, RequiredKey } from '../lib/util/type.js'\nimport {\n  AccessTokenPayload,\n  accessTokenPayloadSchema,\n} from './access-token-payload.js'\nimport { ApiTokenPayload, apiTokenPayloadSchema } from './api-token-payload.js'\n\nexport type SignPayload = JwtPayload & { iss?: never }\n\nexport { Keyset }\nexport type { JwtPayloadGetter, JwtSignHeader, SignedJwt, VerifyOptions }\n\nexport class Signer {\n  constructor(\n    public readonly issuer: string,\n    public readonly keyset: Keyset,\n  ) {}\n\n  async verify<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer'>,\n  ) {\n    return this.keyset.verifyJwt<C>(token, {\n      ...options,\n      issuer: [this.issuer],\n    })\n  }\n\n  public async sign(\n    signHeader: JwtSignHeader,\n    payload: SignPayload | JwtPayloadGetter<SignPayload>,\n  ): Promise<SignedJwt> {\n    return this.keyset.createJwt(signHeader, async (protectedHeader, key) => ({\n      ...(typeof payload === 'function'\n        ? await payload(protectedHeader, key)\n        : payload),\n      iss: this.issuer,\n    }))\n  }\n\n  async createAccessToken(\n    payload: OmitKey<AccessTokenPayload, 'iss'>,\n  ): Promise<SignedJwt> {\n    return this.sign(\n      {\n        // https://datatracker.ietf.org/doc/html/rfc9068#section-2.1\n        alg: undefined,\n        typ: 'at+jwt',\n      },\n      payload,\n    )\n  }\n\n  async verifyAccessToken<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer' | 'typ'>,\n  ) {\n    const result = await this.verify<C>(token, { ...options, typ: 'at+jwt' })\n    return {\n      protectedHeader: result.protectedHeader,\n      payload: accessTokenPayloadSchema.parse(result.payload) as RequiredKey<\n        AccessTokenPayload,\n        C\n      >,\n    }\n  }\n\n  async createEphemeralToken(\n    payload: OmitKey<ApiTokenPayload, 'iss' | 'aud' | 'iat'>,\n  ) {\n    return this.sign(\n      {\n        alg: undefined,\n        typ: 'at+jwt',\n      },\n      {\n        ...payload,\n        aud: `oauth-provider-api@${this.issuer}`,\n        iat: dateToEpoch(),\n      },\n    )\n  }\n\n  async verifyEphemeralToken<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer' | 'audience' | 'typ'>,\n  ) {\n    const result = await this.verify<C>(token, {\n      ...options,\n      maxTokenAge: options?.maxTokenAge ?? EPHEMERAL_SESSION_MAX_AGE / 1e3,\n      audience: `oauth-provider-api@${this.issuer}`,\n      typ: 'at+jwt',\n    })\n    return {\n      protectedHeader: result.protectedHeader,\n      payload: apiTokenPayloadSchema.parse(result.payload) as RequiredKey<\n        ApiTokenPayload,\n        C\n      >,\n    }\n  }\n}\n"]}
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/signer/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,MAAM,GAGP,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,EAEL,wBAAwB,GACzB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAmB,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAI/E,OAAO,EAAE,MAAM,EAAE,CAAA;AAGjB,MAAM,OAAO,MAAM;IACjB,YACkB,MAAc,EACd,MAAc;QADd,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;IAC7B,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,KAAgB,EAChB,OAA0C;QAE1C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAI,KAAK,EAAE;YACrC,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;SACtB,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,IAAI,CACf,UAAyB,EACzB,OAAoD;QAEpD,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACxE,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU;gBAC/B,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;gBACrC,CAAC,CAAC,OAAO,CAAC;YACZ,GAAG,EAAE,IAAI,CAAC,MAAM;SACjB,CAAC,CAAC,CAAA;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,OAA2C;QAE3C,OAAO,IAAI,CAAC,IAAI,CACd;YACE,4DAA4D;YAC5D,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,QAAQ;SACd,EACD,OAAO,CACR,CAAA;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAgB,EAChB,OAAkD;QAElD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAI,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;QACzE,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAGrD;SACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,OAAwD;QAExD,OAAO,IAAI,CAAC,IAAI,CACd;YACE,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,QAAQ;SACd,EACD;YACE,GAAG,OAAO;YACV,GAAG,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;YACxC,GAAG,EAAE,WAAW,EAAE;SACnB,CACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAgB,EAChB,OAA+D;QAE/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAI,KAAK,EAAE;YACzC,GAAG,OAAO;YACV,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,yBAAyB,GAAG,GAAG;YACpE,QAAQ,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;YAC7C,GAAG,EAAE,QAAQ;SACd,CAAC,CAAA;QACF,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAGlD;SACF,CAAA;IACH,CAAC;CACF","sourcesContent":["import {\n  JwtPayload,\n  JwtPayloadGetter,\n  JwtSignHeader,\n  Keyset,\n  SignedJwt,\n  VerifyOptions,\n} from '@atproto/jwk'\nimport { EPHEMERAL_SESSION_MAX_AGE } from '../constants.js'\nimport { dateToEpoch } from '../lib/util/date.js'\nimport { OmitKey, RequiredKey } from '../lib/util/type.js'\nimport {\n  AccessTokenPayload,\n  accessTokenPayloadSchema,\n} from './access-token-payload.js'\nimport { ApiTokenPayload, apiTokenPayloadSchema } from './api-token-payload.js'\n\nexport type SignPayload = JwtPayload & { iss?: never }\n\nexport { Keyset }\nexport type { JwtPayloadGetter, JwtSignHeader, SignedJwt, VerifyOptions }\n\nexport class Signer {\n  constructor(\n    public readonly issuer: string,\n    public readonly keyset: Keyset,\n  ) {}\n\n  async verify<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer'>,\n  ) {\n    return this.keyset.verifyJwt<C>(token, {\n      ...options,\n      issuer: [this.issuer],\n    })\n  }\n\n  public async sign(\n    signHeader: JwtSignHeader,\n    payload: SignPayload | JwtPayloadGetter<SignPayload>,\n  ): Promise<SignedJwt> {\n    return this.keyset.createJwt(signHeader, async (protectedHeader, key) => ({\n      ...(typeof payload === 'function'\n        ? await payload(protectedHeader, key)\n        : payload),\n      iss: this.issuer,\n    }))\n  }\n\n  async createAccessToken(\n    payload: OmitKey<AccessTokenPayload, 'iss'>,\n  ): Promise<SignedJwt> {\n    return this.sign(\n      {\n        // https://datatracker.ietf.org/doc/html/rfc9068#section-2.1\n        alg: undefined,\n        typ: 'at+jwt',\n      },\n      payload,\n    )\n  }\n\n  async verifyAccessToken<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer' | 'typ'>,\n  ) {\n    const result = await this.verify<C>(token, { ...options, typ: 'at+jwt' })\n    return {\n      protectedHeader: result.protectedHeader,\n      payload: accessTokenPayloadSchema.parse(result.payload) as RequiredKey<\n        AccessTokenPayload,\n        C\n      >,\n    }\n  }\n\n  async createEphemeralToken(\n    payload: OmitKey<ApiTokenPayload, 'iss' | 'aud' | 'iat'>,\n  ) {\n    return this.sign(\n      {\n        alg: undefined,\n        typ: 'at+jwt',\n      },\n      {\n        ...payload,\n        aud: `oauth-provider-api@${this.issuer}`,\n        iat: dateToEpoch(),\n      },\n    )\n  }\n\n  async verifyEphemeralToken<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer' | 'audience' | 'typ'>,\n  ) {\n    const result = await this.verify<C>(token, {\n      ...options,\n      maxTokenAge: options?.maxTokenAge ?? EPHEMERAL_SESSION_MAX_AGE / 1e3,\n      audience: `oauth-provider-api@${this.issuer}`,\n      typ: 'at+jwt',\n    })\n    return {\n      protectedHeader: result.protectedHeader,\n      payload: apiTokenPayloadSchema.parse(result.payload) as RequiredKey<\n        ApiTokenPayload,\n        C\n      >,\n    }\n  }\n}\n"]}

package/dist/token/refresh-token.js

@@ -1,20 +1,15 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateRefreshToken = exports.isRefreshToken = exports.refreshTokenSchema = exports.REFRESH_TOKEN_LENGTH = void 0;
-const zod_1 = require("zod");
-const constants_js_1 = require("../constants.js");
-const crypto_js_1 = require("../lib/util/crypto.js");
-exports.REFRESH_TOKEN_LENGTH = constants_js_1.REFRESH_TOKEN_PREFIX.length + constants_js_1.REFRESH_TOKEN_BYTES_LENGTH * 2; // hex encoding
-exports.refreshTokenSchema = zod_1.z
+import { z } from 'zod';
+import { REFRESH_TOKEN_BYTES_LENGTH, REFRESH_TOKEN_PREFIX, } from '../constants.js';
+import { randomHexId } from '../lib/util/crypto.js';
+export const REFRESH_TOKEN_LENGTH = REFRESH_TOKEN_PREFIX.length + REFRESH_TOKEN_BYTES_LENGTH * 2; // hex encoding
+export const refreshTokenSchema = z
     .string()
-    .length(exports.REFRESH_TOKEN_LENGTH)
-    .refine((v) => v.startsWith(constants_js_1.REFRESH_TOKEN_PREFIX), {
+    .length(REFRESH_TOKEN_LENGTH)
+    .refine((v) => v.startsWith(REFRESH_TOKEN_PREFIX), {
     message: `Invalid refresh token format`,
 });
-const isRefreshToken = (data) => exports.refreshTokenSchema.safeParse(data).success;
-exports.isRefreshToken = isRefreshToken;
-const generateRefreshToken = async () => {
-    return `${constants_js_1.REFRESH_TOKEN_PREFIX}${await (0, crypto_js_1.randomHexId)(constants_js_1.REFRESH_TOKEN_BYTES_LENGTH)}`;
+export const isRefreshToken = (data) => refreshTokenSchema.safeParse(data).success;
+export const generateRefreshToken = async () => {
+    return `${REFRESH_TOKEN_PREFIX}${await randomHexId(REFRESH_TOKEN_BYTES_LENGTH)}`;
 };
-exports.generateRefreshToken = generateRefreshToken;
 //# sourceMappingURL=refresh-token.js.map

package/dist/token/refresh-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.js","sourceRoot":"","sources":["../../src/token/refresh-token.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,kDAGwB;AACxB,qDAAmD;AAEtC,QAAA,oBAAoB,GAC/B,mCAAoB,CAAC,MAAM,GAAG,yCAA0B,GAAG,CAAC,CAAA,CAAC,eAAe;AAEjE,QAAA,kBAAkB,GAAG,OAAC;KAChC,MAAM,EAAE;KACR,MAAM,CAAC,4BAAoB,CAAC;KAC5B,MAAM,CACL,CAAC,CAAC,EAAkD,EAAE,CACpD,CAAC,CAAC,UAAU,CAAC,mCAAoB,CAAC,EACpC;IACE,OAAO,EAAE,8BAA8B;CACxC,CACF,CAAA;AAEI,MAAM,cAAc,GAAG,CAAC,IAAa,EAAwB,EAAE,CACpE,0BAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;AAD/B,QAAA,cAAc,kBACiB;AAGrC,MAAM,oBAAoB,GAAG,KAAK,IAA2B,EAAE;IACpE,OAAO,GAAG,mCAAoB,GAAG,MAAM,IAAA,uBAAW,EAChD,yCAA0B,CAC3B,EAAE,CAAA;AACL,CAAC,CAAA;AAJY,QAAA,oBAAoB,wBAIhC","sourcesContent":["import { z } from 'zod'\nimport {\n  REFRESH_TOKEN_BYTES_LENGTH,\n  REFRESH_TOKEN_PREFIX,\n} from '../constants.js'\nimport { randomHexId } from '../lib/util/crypto.js'\n\nexport const REFRESH_TOKEN_LENGTH =\n  REFRESH_TOKEN_PREFIX.length + REFRESH_TOKEN_BYTES_LENGTH * 2 // hex encoding\n\nexport const refreshTokenSchema = z\n  .string()\n  .length(REFRESH_TOKEN_LENGTH)\n  .refine(\n    (v): v is `${typeof REFRESH_TOKEN_PREFIX}${string}` =>\n      v.startsWith(REFRESH_TOKEN_PREFIX),\n    {\n      message: `Invalid refresh token format`,\n    },\n  )\n\nexport const isRefreshToken = (data: unknown): data is RefreshToken =>\n  refreshTokenSchema.safeParse(data).success\n\nexport type RefreshToken = z.infer<typeof refreshTokenSchema>\nexport const generateRefreshToken = async (): Promise<RefreshToken> => {\n  return `${REFRESH_TOKEN_PREFIX}${await randomHexId(\n    REFRESH_TOKEN_BYTES_LENGTH,\n  )}`\n}\n"]}
+{"version":3,"file":"refresh-token.js","sourceRoot":"","sources":["../../src/token/refresh-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,MAAM,CAAC,MAAM,oBAAoB,GAC/B,oBAAoB,CAAC,MAAM,GAAG,0BAA0B,GAAG,CAAC,CAAA,CAAC,eAAe;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,MAAM,CAAC,oBAAoB,CAAC;KAC5B,MAAM,CACL,CAAC,CAAC,EAAkD,EAAE,CACpD,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,EACpC;IACE,OAAO,EAAE,8BAA8B;CACxC,CACF,CAAA;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAa,EAAwB,EAAE,CACpE,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;AAG5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,IAA2B,EAAE;IACpE,OAAO,GAAG,oBAAoB,GAAG,MAAM,WAAW,CAChD,0BAA0B,CAC3B,EAAE,CAAA;AACL,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport {\n  REFRESH_TOKEN_BYTES_LENGTH,\n  REFRESH_TOKEN_PREFIX,\n} from '../constants.js'\nimport { randomHexId } from '../lib/util/crypto.js'\n\nexport const REFRESH_TOKEN_LENGTH =\n  REFRESH_TOKEN_PREFIX.length + REFRESH_TOKEN_BYTES_LENGTH * 2 // hex encoding\n\nexport const refreshTokenSchema = z\n  .string()\n  .length(REFRESH_TOKEN_LENGTH)\n  .refine(\n    (v): v is `${typeof REFRESH_TOKEN_PREFIX}${string}` =>\n      v.startsWith(REFRESH_TOKEN_PREFIX),\n    {\n      message: `Invalid refresh token format`,\n    },\n  )\n\nexport const isRefreshToken = (data: unknown): data is RefreshToken =>\n  refreshTokenSchema.safeParse(data).success\n\nexport type RefreshToken = z.infer<typeof refreshTokenSchema>\nexport const generateRefreshToken = async (): Promise<RefreshToken> => {\n  return `${REFRESH_TOKEN_PREFIX}${await randomHexId(\n    REFRESH_TOKEN_BYTES_LENGTH,\n  )}`\n}\n"]}

package/dist/token/token-claims.js

@@ -1,3 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
+export {};
 //# sourceMappingURL=token-claims.js.map

package/dist/token/token-data.js

@@ -1,3 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
+export {};
 //# sourceMappingURL=token-data.js.map

package/dist/token/token-id.js

@@ -1,20 +1,15 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTokenId = exports.generateTokenId = exports.tokenIdSchema = exports.TOKEN_ID_LENGTH = void 0;
-const zod_1 = require("zod");
-const constants_js_1 = require("../constants.js");
-const crypto_js_1 = require("../lib/util/crypto.js");
-exports.TOKEN_ID_LENGTH = constants_js_1.TOKEN_ID_PREFIX.length + constants_js_1.TOKEN_ID_BYTES_LENGTH * 2; // hex encoding
-exports.tokenIdSchema = zod_1.z
+import { z } from 'zod';
+import { TOKEN_ID_BYTES_LENGTH, TOKEN_ID_PREFIX } from '../constants.js';
+import { randomHexId } from '../lib/util/crypto.js';
+export const TOKEN_ID_LENGTH = TOKEN_ID_PREFIX.length + TOKEN_ID_BYTES_LENGTH * 2; // hex encoding
+export const tokenIdSchema = z
     .string()
-    .length(exports.TOKEN_ID_LENGTH)
-    .refine((v) => v.startsWith(constants_js_1.TOKEN_ID_PREFIX), {
+    .length(TOKEN_ID_LENGTH)
+    .refine((v) => v.startsWith(TOKEN_ID_PREFIX), {
     message: `Invalid token ID format`,
 });
-const generateTokenId = async () => {
-    return `${constants_js_1.TOKEN_ID_PREFIX}${await (0, crypto_js_1.randomHexId)(constants_js_1.TOKEN_ID_BYTES_LENGTH)}`;
+export const generateTokenId = async () => {
+    return `${TOKEN_ID_PREFIX}${await randomHexId(TOKEN_ID_BYTES_LENGTH)}`;
 };
-exports.generateTokenId = generateTokenId;
-const isTokenId = (data) => exports.tokenIdSchema.safeParse(data).success;
-exports.isTokenId = isTokenId;
+export const isTokenId = (data) => tokenIdSchema.safeParse(data).success;
 //# sourceMappingURL=token-id.js.map

package/dist/token/token-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-id.js","sourceRoot":"","sources":["../../src/token/token-id.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,kDAAwE;AACxE,qDAAmD;AAEtC,QAAA,eAAe,GAC1B,8BAAe,CAAC,MAAM,GAAG,oCAAqB,GAAG,CAAC,CAAA,CAAC,eAAe;AAEvD,QAAA,aAAa,GAAG,OAAC;KAC3B,MAAM,EAAE;KACR,MAAM,CAAC,uBAAe,CAAC;KACvB,MAAM,CACL,CAAC,CAAC,EAA6C,EAAE,CAC/C,CAAC,CAAC,UAAU,CAAC,8BAAe,CAAC,EAC/B;IACE,OAAO,EAAE,yBAAyB;CACnC,CACF,CAAA;AAGI,MAAM,eAAe,GAAG,KAAK,IAAsB,EAAE;IAC1D,OAAO,GAAG,8BAAe,GAAG,MAAM,IAAA,uBAAW,EAAC,oCAAqB,CAAC,EAAE,CAAA;AACxE,CAAC,CAAA;AAFY,QAAA,eAAe,mBAE3B;AAEM,MAAM,SAAS,GAAG,CAAC,IAAa,EAAmB,EAAE,CAC1D,qBAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;AAD1B,QAAA,SAAS,aACiB","sourcesContent":["import { z } from 'zod'\nimport { TOKEN_ID_BYTES_LENGTH, TOKEN_ID_PREFIX } from '../constants.js'\nimport { randomHexId } from '../lib/util/crypto.js'\n\nexport const TOKEN_ID_LENGTH =\n  TOKEN_ID_PREFIX.length + TOKEN_ID_BYTES_LENGTH * 2 // hex encoding\n\nexport const tokenIdSchema = z\n  .string()\n  .length(TOKEN_ID_LENGTH)\n  .refine(\n    (v): v is `${typeof TOKEN_ID_PREFIX}${string}` =>\n      v.startsWith(TOKEN_ID_PREFIX),\n    {\n      message: `Invalid token ID format`,\n    },\n  )\n\nexport type TokenId = z.infer<typeof tokenIdSchema>\nexport const generateTokenId = async (): Promise<TokenId> => {\n  return `${TOKEN_ID_PREFIX}${await randomHexId(TOKEN_ID_BYTES_LENGTH)}`\n}\n\nexport const isTokenId = (data: unknown): data is TokenId =>\n  tokenIdSchema.safeParse(data).success\n"]}
+{"version":3,"file":"token-id.js","sourceRoot":"","sources":["../../src/token/token-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,MAAM,CAAC,MAAM,eAAe,GAC1B,eAAe,CAAC,MAAM,GAAG,qBAAqB,GAAG,CAAC,CAAA,CAAC,eAAe;AAEpE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,MAAM,CAAC,eAAe,CAAC;KACvB,MAAM,CACL,CAAC,CAAC,EAA6C,EAAE,CAC/C,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAC/B;IACE,OAAO,EAAE,yBAAyB;CACnC,CACF,CAAA;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,IAAsB,EAAE;IAC1D,OAAO,GAAG,eAAe,GAAG,MAAM,WAAW,CAAC,qBAAqB,CAAC,EAAE,CAAA;AACxE,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAa,EAAmB,EAAE,CAC1D,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA","sourcesContent":["import { z } from 'zod'\nimport { TOKEN_ID_BYTES_LENGTH, TOKEN_ID_PREFIX } from '../constants.js'\nimport { randomHexId } from '../lib/util/crypto.js'\n\nexport const TOKEN_ID_LENGTH =\n  TOKEN_ID_PREFIX.length + TOKEN_ID_BYTES_LENGTH * 2 // hex encoding\n\nexport const tokenIdSchema = z\n  .string()\n  .length(TOKEN_ID_LENGTH)\n  .refine(\n    (v): v is `${typeof TOKEN_ID_PREFIX}${string}` =>\n      v.startsWith(TOKEN_ID_PREFIX),\n    {\n      message: `Invalid token ID format`,\n    },\n  )\n\nexport type TokenId = z.infer<typeof tokenIdSchema>\nexport const generateTokenId = async (): Promise<TokenId> => {\n  return `${TOKEN_ID_PREFIX}${await randomHexId(TOKEN_ID_BYTES_LENGTH)}`\n}\n\nexport const isTokenId = (data: unknown): data is TokenId =>\n  tokenIdSchema.safeParse(data).success\n"]}

package/dist/token/token-manager.js

@@ -1,28 +1,18 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TokenManager = exports.Signer = exports.AccessTokenMode = void 0;
-const jwk_1 = require("@atproto/jwk");
-const lex_resolver_1 = require("@atproto/lex-resolver");
-const access_token_mode_js_1 = require("../access-token/access-token-mode.js");
-Object.defineProperty(exports, "AccessTokenMode", { enumerable: true, get: function () { return access_token_mode_js_1.AccessTokenMode; } });
-const constants_js_1 = require("../constants.js");
-const invalid_grant_error_js_1 = require("../errors/invalid-grant-error.js");
-const invalid_request_error_js_1 = require("../errors/invalid-request-error.js");
-const invalid_token_error_js_1 = require("../errors/invalid-token-error.js");
-const date_js_1 = require("../lib/util/date.js");
-const code_js_1 = require("../request/code.js");
-const signer_js_1 = require("../signer/signer.js");
-Object.defineProperty(exports, "Signer", { enumerable: true, get: function () { return signer_js_1.Signer; } });
-const refresh_token_js_1 = require("./refresh-token.js");
-const token_id_js_1 = require("./token-id.js");
-class TokenManager {
-    store;
-    lexiconManager;
-    signer;
-    hooks;
-    accessTokenMode;
-    tokenMaxAge;
-    constructor(store, lexiconManager, signer, hooks, accessTokenMode, tokenMaxAge = constants_js_1.TOKEN_MAX_AGE) {
+import { isSignedJwt } from '@atproto/jwk';
+import { LexResolverError } from '@atproto/lex-resolver';
+import { AccessTokenMode } from '../access-token/access-token-mode.js';
+import { TOKEN_MAX_AGE } from '../constants.js';
+import { InvalidGrantError } from '../errors/invalid-grant-error.js';
+import { InvalidRequestError } from '../errors/invalid-request-error.js';
+import { InvalidTokenError } from '../errors/invalid-token-error.js';
+import { dateToEpoch, dateToRelativeSeconds } from '../lib/util/date.js';
+import { isCode } from '../request/code.js';
+import { Signer } from '../signer/signer.js';
+import { generateRefreshToken, isRefreshToken, } from './refresh-token.js';
+import { generateTokenId, isTokenId } from './token-id.js';
+export { AccessTokenMode, Signer };
+export class TokenManager {
+    constructor(store, lexiconManager, signer, hooks, accessTokenMode, tokenMaxAge = TOKEN_MAX_AGE) {
         this.store = store;
         this.lexiconManager = lexiconManager;
         this.signer = signer;
@@ -37,15 +27,15 @@ class TokenManager {
         const claims = {
             jti: tokenId,
             sub: account.sub,
-            iat: (0, date_js_1.dateToEpoch)(issuedAt),
-            exp: (0, date_js_1.dateToEpoch)(expiresAt),
+            iat: dateToEpoch(issuedAt),
+            exp: dateToEpoch(expiresAt),
             aud: account.aud,
             ...(parameters.dpop_jkt && {
                 cnf: { jkt: parameters.dpop_jkt },
             }),
             // Because tokens can end-up being quite big, we only include the scope in
             // stateless mode.
-            ...(this.accessTokenMode === access_token_mode_js_1.AccessTokenMode.stateless && {
+            ...(this.accessTokenMode === AccessTokenMode.stateless && {
                 scope,
             }),
             // https://datatracker.ietf.org/doc/html/rfc8693#section-4.3
@@ -61,9 +51,9 @@ class TokenManager {
     }
     async createToken(client, clientAuth, clientMetadata, account, deviceId, parameters, code) {
         await this.validateTokenParams(client, clientAuth, parameters);
-        const tokenId = await (0, token_id_js_1.generateTokenId)();
+        const tokenId = await generateTokenId();
         const refreshToken = client.metadata.grant_types.includes('refresh_token')
-            ? await (0, refresh_token_js_1.generateRefreshToken)()
+            ? await generateRefreshToken()
             : undefined;
         const now = new Date();
         const expiresAt = this.createTokenExpiry(now);
@@ -71,8 +61,8 @@ class TokenManager {
             .buildTokenScope(parameters.scope)
             .catch((err) => {
             // Parse expected errors
-            if (err instanceof lex_resolver_1.LexResolverError) {
-                throw new invalid_request_error_js_1.InvalidRequestError(err.message, err);
+            if (err instanceof LexResolverError) {
+                throw new InvalidRequestError(err.message, err);
             }
             // Unexpected error
             throw err;
@@ -112,7 +102,7 @@ class TokenManager {
     }
     async validateTokenParams(client, clientAuth, parameters) {
         if (client.metadata.dpop_bound_access_tokens && !parameters.dpop_jkt) {
-            throw new invalid_grant_error_js_1.InvalidGrantError(`DPoP JKT is required for DPoP bound access tokens`);
+            throw new InvalidGrantError(`DPoP JKT is required for DPoP bound access tokens`);
         }
     }
     buildTokenResponse(tokenType, accessToken, refreshToken, expiresAt, sub, scope) {
@@ -124,7 +114,7 @@ class TokenManager {
             // @NOTE using a getter so that the value gets computed when the JSON
             // response is generated, allowing to value to be as accurate as possible.
             get expires_in() {
-                return (0, date_js_1.dateToRelativeSeconds)(expiresAt);
+                return dateToRelativeSeconds(expiresAt);
             },
             // ATPROTO extension: add the sub claim to the token response to allow
             // clients to resolve the PDS url (audience) using the did resolution
@@ -136,8 +126,8 @@ class TokenManager {
         const { account, data } = tokenInfo;
         const { parameters } = data;
         await this.validateTokenParams(client, clientAuth, parameters);
-        const nextTokenId = await (0, token_id_js_1.generateTokenId)();
-        const nextRefreshToken = await (0, refresh_token_js_1.generateRefreshToken)();
+        const nextTokenId = await generateTokenId();
+        const nextRefreshToken = await generateRefreshToken();
         const now = new Date();
         const expiresAt = this.createTokenExpiry(now);
         // @NOTE since the permission sets are stored in a persistent store,
@@ -172,20 +162,20 @@ class TokenManager {
      * token is valid before using the returned token info.
      */
     async findToken(token) {
-        if ((0, token_id_js_1.isTokenId)(token)) {
+        if (isTokenId(token)) {
             return this.getTokenInfo(token);
         }
-        else if ((0, code_js_1.isCode)(token)) {
+        else if (isCode(token)) {
             return this.findByCode(token);
         }
-        else if ((0, refresh_token_js_1.isRefreshToken)(token)) {
+        else if (isRefreshToken(token)) {
             return this.findByRefreshToken(token);
         }
-        else if ((0, jwk_1.isSignedJwt)(token)) {
+        else if (isSignedJwt(token)) {
             return this.findByAccessToken(token);
         }
         else {
-            throw new invalid_request_error_js_1.InvalidRequestError(`Invalid token`);
+            throw new InvalidRequestError(`Invalid token`);
         }
     }
     async findByAccessToken(token) {
@@ -216,14 +206,14 @@ class TokenManager {
         // @TODO Add another store method that atomically consumes the refresh token
         // with a lock.
         const tokenInfo = await this.findByRefreshToken(token).catch((err) => {
-            throw invalid_grant_error_js_1.InvalidGrantError.from(err, `Invalid refresh token`);
+            throw InvalidGrantError.from(err, `Invalid refresh token`);
         });
         if (!tokenInfo) {
-            throw new invalid_grant_error_js_1.InvalidGrantError(`Invalid refresh token`);
+            throw new InvalidGrantError(`Invalid refresh token`);
         }
         if (tokenInfo.currentRefreshToken !== token) {
             await this.deleteToken(tokenInfo.id);
-            throw new invalid_grant_error_js_1.InvalidGrantError(`Refresh token replayed`);
+            throw new InvalidGrantError(`Refresh token replayed`);
         }
         return tokenInfo;
     }
@@ -244,10 +234,10 @@ class TokenManager {
     async loadTokenClaims(tokenType, tokenPayload) {
         const tokenId = tokenPayload.jti;
         const tokenInfo = await this.getTokenInfo(tokenId).catch((err) => {
-            throw invalid_token_error_js_1.InvalidTokenError.from(err, tokenType);
+            throw InvalidTokenError.from(err, tokenType);
         });
         if (!tokenInfo) {
-            throw new invalid_token_error_js_1.InvalidTokenError(tokenType, `Invalid token`);
+            throw new InvalidTokenError(tokenType, `Invalid token`);
         }
         const { account, data } = tokenInfo;
         // Fool proof, make sure that the database & token payload are consistent.
@@ -255,17 +245,17 @@ class TokenManager {
         // the values directly.
         if (tokenPayload.cnf?.jkt !== data.parameters.dpop_jkt) {
             await this.deleteToken(tokenId);
-            throw new invalid_token_error_js_1.InvalidTokenError(tokenType, `Invalid token`);
+            throw new InvalidTokenError(tokenType, `Invalid token`);
         }
         if (isCurrentTokenExpired(tokenInfo)) {
             await this.deleteToken(tokenId);
-            throw new invalid_token_error_js_1.InvalidTokenError(tokenType, `Token expired`);
+            throw new InvalidTokenError(tokenType, `Token expired`);
         }
         return {
             jti: tokenId,
             sub: account.sub,
-            iat: (0, date_js_1.dateToEpoch)(data.updatedAt),
-            exp: (0, date_js_1.dateToEpoch)(data.expiresAt),
+            iat: dateToEpoch(data.updatedAt),
+            exp: dateToEpoch(data.expiresAt),
             aud: account.aud,
             scope: data.scope ?? data.parameters.scope,
             // https://datatracker.ietf.org/doc/html/rfc8693#section-4.3
@@ -279,7 +269,6 @@ class TokenManager {
             .filter((tokenInfo) => !isCurrentTokenExpired(tokenInfo));
     }
 }
-exports.TokenManager = TokenManager;
 function isCurrentTokenExpired(tokenInfo) {
     return tokenInfo.data.expiresAt.getTime() < Date.now();
 }

package/dist/token/token-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-manager.js","sourceRoot":"","sources":["../../src/token/token-manager.ts"],"names":[],"mappings":";;;AAAA,sCAAqD;AACrD,wDAAwD;AASxD,+EAAsE;AAyB7D,gGAzBA,sCAAe,OAyBA;AAtBxB,kDAA+C;AAE/C,6EAAoE;AACpE,iFAAwE;AACxE,6EAAoE;AAGpE,iDAAwE;AAGxE,gDAAiD;AAEjD,mDAA4C;AAUlB,uFAVjB,kBAAM,OAUiB;AAThC,yDAI2B;AAE3B,+CAAmE;AAMnE,MAAa,YAAY;IAEF;IACA;IACA;IACA;IACA;IACA;IANrB,YACqB,KAAiB,EACjB,cAA8B,EAC9B,MAAc,EACd,KAAiB,EACjB,eAAgC,EAChC,cAAc,4BAAa;QAL3B,UAAK,GAAL,KAAK,CAAY;QACjB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAY;QACjB,oBAAe,GAAf,eAAe,CAAiB;QAChC,gBAAW,GAAX,WAAW,CAAgB;IAC7C,CAAC;IAEM,iBAAiB,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;QAC1C,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAA;IACnD,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,OAAgB,EAChB,MAAc,EACd,OAAgB,EAChB,UAA+C,EAC/C,QAAc,EACd,SAAe,EACf,KAAiB;QAEjB,MAAM,MAAM,GAAgB;YAC1B,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,IAAA,qBAAW,EAAC,QAAQ,CAAC;YAC1B,GAAG,EAAE,IAAA,qBAAW,EAAC,SAAS,CAAC;YAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;YAEhB,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI;gBACzB,GAAG,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE;aAClC,CAAC;YAEF,0EAA0E;YAC1E,kBAAkB;YAClB,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,sCAAe,CAAC,SAAS,IAAI;gBACxD,KAAK;aACN,CAAC;YAEF,4DAA4D;YAC5D,SAAS,EAAE,MAAM,CAAC,EAAE;SACrB,CAAA;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE;YAChE,MAAM;YACN,OAAO;YACP,UAAU;YACV,MAAM;SACP,CAAC,CAAA;QAEF,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,cAAc,IAAI,MAAM,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,OAAgB,EAChB,QAAyB,EACzB,UAA+C,EAC/C,IAAU;QAEV,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;QAE9D,MAAM,OAAO,GAAG,MAAM,IAAA,6BAAe,GAAE,CAAA;QACvC,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC;YACxE,CAAC,CAAC,MAAM,IAAA,uCAAoB,GAAE;YAC9B,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc;aACpC,eAAe,CAAC,UAAU,CAAC,KAAM,CAAC;aAClC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,wBAAwB;YACxB,IAAI,GAAG,YAAY,+BAAgB,EAAE,CAAC;gBACpC,MAAM,IAAI,8CAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC;YAED,mBAAmB;YACnB,MAAM,GAAG,CAAA;QACX,CAAC,CAAC,CAAA;QAEJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAC9C,OAAO,EACP,MAAM,EACN,OAAO,EACP,UAAU,EACV,GAAG,EACH,SAAS,EACT,KAAK,CACN,CAAA;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CACtC,cAAc,CAAC,UAAU,CAAC,EAC1B,WAAW,EACX,YAAY,EACZ,SAAS,EACT,OAAO,CAAC,GAAG,EACX,KAAK,CACN,CAAA;QAED,MAAM,SAAS,GAAoB;YACjC,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,SAAS;YACT,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,UAAU;YACV,QAAQ;YACR,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU;YACV,OAAO,EAAE,IAAI;YACb,KAAK;YACL,IAAI;SACL,CAAA;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;QAE9D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE;gBAC1C,MAAM;gBACN,UAAU;gBACV,cAAc;gBACd,OAAO;gBACP,UAAU;aACX,CAAC,CAAA;YAEF,OAAO,QAAQ,CAAA;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,sBAAsB;YACtB,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAC/B,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAES,KAAK,CAAC,mBAAmB,CACjC,MAAc,EACd,UAAsB,EACtB,UAA+C;QAE/C,IAAI,MAAM,CAAC,QAAQ,CAAC,wBAAwB,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACrE,MAAM,IAAI,0CAAiB,CACzB,mDAAmD,CACpD,CAAA;QACH,CAAC;IACH,CAAC;IAES,kBAAkB,CAC1B,SAAyB,EACzB,WAA6B,EAC7B,YAAgC,EAChC,SAAe,EACf,GAAQ,EACR,KAAa;QAEb,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,SAAS;YACrB,aAAa,EAAE,YAAY;YAC3B,KAAK;YAEL,qEAAqE;YACrE,0EAA0E;YAC1E,IAAI,UAAU;gBACZ,OAAO,IAAA,+BAAqB,EAAC,SAAS,CAAC,CAAA;YACzC,CAAC;YAED,sEAAsE;YACtE,qEAAqE;YACrE,aAAa;YACb,GAAG;SACJ,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,SAAoB;QAEpB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;QACnC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;QAE3B,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;QAE9D,MAAM,WAAW,GAAG,MAAM,IAAA,6BAAe,GAAE,CAAA;QAC3C,MAAM,gBAAgB,GAAG,MAAM,IAAA,uCAAoB,GAAE,CAAA;QAErD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAE7C,oEAAoE;QACpE,wEAAwE;QACxE,iCAAiC;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,UAAU,CAAC,KAAM,CAAC,CAAA;QAE1E,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACxE,SAAS,EAAE,GAAG;YACd,SAAS;YACT,qEAAqE;YACrE,cAAc;YACd,qEAAqE;YACrE,kBAAkB;YAClB,mEAAmE;YACnE,aAAa;YACb,UAAU;YACV,KAAK;SACN,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAC9C,WAAW,EACX,MAAM,EACN,OAAO,EACP,UAAU,EACV,GAAG,EACH,SAAS,EACT,KAAK,CACN,CAAA;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CACtC,cAAc,CAAC,UAAU,CAAC,EAC1B,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,OAAO,CAAC,GAAG,EACX,KAAK,CACN,CAAA;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE;YAC5C,MAAM;YACN,UAAU;YACV,cAAc;YACd,OAAO;YACP,UAAU;SACX,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,SAAS,CAAC,KAAa;QAClC,IAAI,IAAA,uBAAS,EAAC,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QACjC,CAAC;aAAM,IAAI,IAAA,gBAAM,EAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAC/B,CAAC;aAAM,IAAI,IAAA,iCAAc,EAAC,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;aAAM,IAAI,IAAA,iBAAW,EAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,8CAAmB,CAAC,eAAe,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,KAAgB;QAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE;YAC7D,cAAc,EAAE,QAAQ;SACzB,CAAC,CAAA;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACtD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QAE3B,6CAA6C;QAC7C,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACpC,MAAM,IAAI,KAAK,CACb,gBAAgB,SAAS,CAAC,OAAO,CAAC,GAAG,+BAA+B,OAAO,CAAC,GAAG,GAAG,CACnF,CAAA;QACH,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,KAAmB;QAEnB,OAAO,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAA;IAClD,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,KAAmB;QAClD,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QAEvE,4EAA4E;QAC5E,eAAe;QACf,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnE,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;QACtD,CAAC;QAED,IAAI,SAAS,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACpC,MAAM,IAAI,0CAAiB,CAAC,wBAAwB,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,IAAU;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,OAAgB;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAgB;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACtC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,SAAyB,EACzB,YAAgC;QAEhC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAA;QAChC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC/D,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC9C,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,0CAAiB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QACzD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;QAEnC,0EAA0E;QAC1E,4EAA4E;QAC5E,uBAAuB;QACvB,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAC/B,MAAM,IAAI,0CAAiB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QACzD,CAAC;QAED,IAAI,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAC/B,MAAM,IAAI,0CAAiB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QACzD,CAAC;QAED,OAAO;YACL,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,IAAA,qBAAW,EAAC,IAAI,CAAC,SAAS,CAAC;YAChC,GAAG,EAAE,IAAA,qBAAW,EAAC,IAAI,CAAC,SAAS,CAAC;YAChC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK;YAC1C,4DAA4D;YAC5D,SAAS,EAAE,IAAI,CAAC,QAAQ;SACzB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAQ;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QACvD,OAAO,OAAO;aACX,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,aAAa;aAClE,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7D,CAAC;CACF;AAvXD,oCAuXC;AAED,SAAS,qBAAqB,CAAC,SAAoB;IACjD,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;AACxD,CAAC;AAED,SAAS,cAAc,CACrB,UAA+C;IAE/C,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC","sourcesContent":["import { SignedJwt, isSignedJwt } from '@atproto/jwk'\nimport { LexResolverError } from '@atproto/lex-resolver'\nimport type { Account } from '@atproto/oauth-provider-api'\nimport {\n  OAuthAccessToken,\n  OAuthAuthorizationRequestParameters,\n  OAuthScope,\n  OAuthTokenResponse,\n  OAuthTokenType,\n} from '@atproto/oauth-types'\nimport { AccessTokenMode } from '../access-token/access-token-mode.js'\nimport { ClientAuth } from '../client/client-auth.js'\nimport { Client } from '../client/client.js'\nimport { TOKEN_MAX_AGE } from '../constants.js'\nimport { DeviceId } from '../device/device-id.js'\nimport { InvalidGrantError } from '../errors/invalid-grant-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport { InvalidTokenError } from '../errors/invalid-token-error.js'\nimport { LexiconManager } from '../lexicon/lexicon-manager.js'\nimport { RequestMetadata } from '../lib/http/request.js'\nimport { dateToEpoch, dateToRelativeSeconds } from '../lib/util/date.js'\nimport { OAuthHooks } from '../oauth-hooks.js'\nimport { Sub } from '../oidc/sub.js'\nimport { Code, isCode } from '../request/code.js'\nimport { AccessTokenPayload } from '../signer/access-token-payload.js'\nimport { Signer } from '../signer/signer.js'\nimport {\n  RefreshToken,\n  generateRefreshToken,\n  isRefreshToken,\n} from './refresh-token.js'\nimport { TokenClaims } from './token-claims.js'\nimport { TokenId, generateTokenId, isTokenId } from './token-id.js'\nimport { CreateTokenData, TokenInfo, TokenStore } from './token-store.js'\n\nexport { AccessTokenMode, Signer }\nexport type { OAuthHooks, TokenStore }\n\nexport class TokenManager {\n  constructor(\n    protected readonly store: TokenStore,\n    protected readonly lexiconManager: LexiconManager,\n    protected readonly signer: Signer,\n    protected readonly hooks: OAuthHooks,\n    protected readonly accessTokenMode: AccessTokenMode,\n    protected readonly tokenMaxAge = TOKEN_MAX_AGE,\n  ) {}\n\n  protected createTokenExpiry(now = new Date()) {\n    return new Date(now.getTime() + this.tokenMaxAge)\n  }\n\n  protected async createAccessToken(\n    tokenId: TokenId,\n    client: Client,\n    account: Account,\n    parameters: OAuthAuthorizationRequestParameters,\n    issuedAt: Date,\n    expiresAt: Date,\n    scope: OAuthScope,\n  ): Promise<OAuthAccessToken> {\n    const claims: TokenClaims = {\n      jti: tokenId,\n      sub: account.sub,\n      iat: dateToEpoch(issuedAt),\n      exp: dateToEpoch(expiresAt),\n      aud: account.aud,\n\n      ...(parameters.dpop_jkt && {\n        cnf: { jkt: parameters.dpop_jkt },\n      }),\n\n      // Because tokens can end-up being quite big, we only include the scope in\n      // stateless mode.\n      ...(this.accessTokenMode === AccessTokenMode.stateless && {\n        scope,\n      }),\n\n      // https://datatracker.ietf.org/doc/html/rfc8693#section-4.3\n      client_id: client.id,\n    }\n\n    const claimsOverride = await this.hooks.onCreateToken?.call(null, {\n      client,\n      account,\n      parameters,\n      claims,\n    })\n\n    return this.signer.createAccessToken(claimsOverride ?? claims)\n  }\n\n  async createToken(\n    client: Client,\n    clientAuth: ClientAuth,\n    clientMetadata: RequestMetadata,\n    account: Account,\n    deviceId: null | DeviceId,\n    parameters: OAuthAuthorizationRequestParameters,\n    code: Code,\n  ): Promise<OAuthTokenResponse> {\n    await this.validateTokenParams(client, clientAuth, parameters)\n\n    const tokenId = await generateTokenId()\n    const refreshToken = client.metadata.grant_types.includes('refresh_token')\n      ? await generateRefreshToken()\n      : undefined\n\n    const now = new Date()\n    const expiresAt = this.createTokenExpiry(now)\n\n    const scope = await this.lexiconManager\n      .buildTokenScope(parameters.scope!)\n      .catch((err) => {\n        // Parse expected errors\n        if (err instanceof LexResolverError) {\n          throw new InvalidRequestError(err.message, err)\n        }\n\n        // Unexpected error\n        throw err\n      })\n\n    const accessToken = await this.createAccessToken(\n      tokenId,\n      client,\n      account,\n      parameters,\n      now,\n      expiresAt,\n      scope,\n    )\n\n    const response = this.buildTokenResponse(\n      inferTokenType(parameters),\n      accessToken,\n      refreshToken,\n      expiresAt,\n      account.sub,\n      scope,\n    )\n\n    const tokenData: CreateTokenData = {\n      createdAt: now,\n      updatedAt: now,\n      expiresAt,\n      clientId: client.id,\n      clientAuth,\n      deviceId,\n      sub: account.sub,\n      parameters,\n      details: null,\n      scope,\n      code,\n    }\n\n    await this.store.createToken(tokenId, tokenData, refreshToken)\n\n    try {\n      await this.hooks.onTokenCreated?.call(null, {\n        client,\n        clientAuth,\n        clientMetadata,\n        account,\n        parameters,\n      })\n\n      return response\n    } catch (err) {\n      // If the hook fails, we delete the token to avoid leaving a dangling\n      // token in the store.\n      await this.deleteToken(tokenId)\n      throw err\n    }\n  }\n\n  protected async validateTokenParams(\n    client: Client,\n    clientAuth: ClientAuth,\n    parameters: OAuthAuthorizationRequestParameters,\n  ): Promise<void> {\n    if (client.metadata.dpop_bound_access_tokens && !parameters.dpop_jkt) {\n      throw new InvalidGrantError(\n        `DPoP JKT is required for DPoP bound access tokens`,\n      )\n    }\n  }\n\n  protected buildTokenResponse(\n    tokenType: OAuthTokenType,\n    accessToken: OAuthAccessToken,\n    refreshToken: string | undefined,\n    expiresAt: Date,\n    sub: Sub,\n    scope: string,\n  ): OAuthTokenResponse {\n    return {\n      access_token: accessToken,\n      token_type: tokenType,\n      refresh_token: refreshToken,\n      scope,\n\n      // @NOTE using a getter so that the value gets computed when the JSON\n      // response is generated, allowing to value to be as accurate as possible.\n      get expires_in() {\n        return dateToRelativeSeconds(expiresAt)\n      },\n\n      // ATPROTO extension: add the sub claim to the token response to allow\n      // clients to resolve the PDS url (audience) using the did resolution\n      // mechanism.\n      sub,\n    }\n  }\n\n  async rotateToken(\n    client: Client,\n    clientAuth: ClientAuth,\n    clientMetadata: RequestMetadata,\n    tokenInfo: TokenInfo,\n  ): Promise<OAuthTokenResponse> {\n    const { account, data } = tokenInfo\n    const { parameters } = data\n\n    await this.validateTokenParams(client, clientAuth, parameters)\n\n    const nextTokenId = await generateTokenId()\n    const nextRefreshToken = await generateRefreshToken()\n\n    const now = new Date()\n    const expiresAt = this.createTokenExpiry(now)\n\n    // @NOTE since the permission sets are stored in a persistent store,\n    // it's fine to propagate a 500 (server_error) here as the values should\n    // be retrievable from the store.\n    const scope = await this.lexiconManager.buildTokenScope(parameters.scope!)\n\n    await this.store.rotateToken(tokenInfo.id, nextTokenId, nextRefreshToken, {\n      updatedAt: now,\n      expiresAt,\n      // @NOTE Normally, the clientAuth not change over time. There are two\n      // exceptions:\n      // - Upgrade from a legacy representation of client authentication to\n      //   a modern one.\n      // - Allow clients to become \"confidential\" if they were previously\n      //   \"public\"\n      clientAuth,\n      scope,\n    })\n\n    const accessToken = await this.createAccessToken(\n      nextTokenId,\n      client,\n      account,\n      parameters,\n      now,\n      expiresAt,\n      scope,\n    )\n\n    const response = this.buildTokenResponse(\n      inferTokenType(parameters),\n      accessToken,\n      nextRefreshToken,\n      expiresAt,\n      account.sub,\n      scope,\n    )\n\n    await this.hooks.onTokenRefreshed?.call(null, {\n      client,\n      clientAuth,\n      clientMetadata,\n      account,\n      parameters,\n    })\n\n    return response\n  }\n\n  /**\n   * @note The token validity is not guaranteed. The caller must ensure that the\n   * token is valid before using the returned token info.\n   */\n  public async findToken(token: string): Promise<null | TokenInfo> {\n    if (isTokenId(token)) {\n      return this.getTokenInfo(token)\n    } else if (isCode(token)) {\n      return this.findByCode(token)\n    } else if (isRefreshToken(token)) {\n      return this.findByRefreshToken(token)\n    } else if (isSignedJwt(token)) {\n      return this.findByAccessToken(token)\n    } else {\n      throw new InvalidRequestError(`Invalid token`)\n    }\n  }\n\n  public async findByAccessToken(token: SignedJwt): Promise<null | TokenInfo> {\n    const { payload } = await this.signer.verifyAccessToken(token, {\n      clockTolerance: Infinity,\n    })\n\n    const tokenInfo = await this.getTokenInfo(payload.jti)\n    if (!tokenInfo) return null\n\n    // Fool-proof: Invalid store implementation ?\n    if (payload.sub !== tokenInfo.account.sub) {\n      await this.deleteToken(tokenInfo.id)\n      throw new Error(\n        `Account sub (${tokenInfo.account.sub}) does not match token sub (${payload.sub})`,\n      )\n    }\n\n    return tokenInfo\n  }\n\n  protected async findByRefreshToken(\n    token: RefreshToken,\n  ): Promise<null | TokenInfo> {\n    return this.store.findTokenByRefreshToken(token)\n  }\n\n  public async consumeRefreshToken(token: RefreshToken): Promise<TokenInfo> {\n    // @NOTE concurrent refreshes of the same refresh token could theoretically\n    // lead to two new tokens (access & refresh) being created. This is deemed\n    // acceptable for now (as the mechanism can only be used once since only one\n    // of the two refresh token created will be valid, and any future refresh\n    // attempts from outdated tokens will cause the entire session to be\n    // invalidated). Ideally, the store should be able to handle this case by\n    // atomically consuming the refresh token and returning the token info.\n\n    // @TODO Add another store method that atomically consumes the refresh token\n    // with a lock.\n    const tokenInfo = await this.findByRefreshToken(token).catch((err) => {\n      throw InvalidGrantError.from(err, `Invalid refresh token`)\n    })\n\n    if (!tokenInfo) {\n      throw new InvalidGrantError(`Invalid refresh token`)\n    }\n\n    if (tokenInfo.currentRefreshToken !== token) {\n      await this.deleteToken(tokenInfo.id)\n      throw new InvalidGrantError(`Refresh token replayed`)\n    }\n\n    return tokenInfo\n  }\n\n  public async findByCode(code: Code): Promise<null | TokenInfo> {\n    return this.store.findTokenByCode(code)\n  }\n\n  public async deleteToken(tokenId: TokenId): Promise<void> {\n    return this.store.deleteToken(tokenId)\n  }\n\n  async getTokenInfo(tokenId: TokenId): Promise<null | TokenInfo> {\n    return this.store.readToken(tokenId)\n  }\n\n  /**\n   * This method is called to when decoding a token that was encoded in\n   * {@link AccessTokenMode.light} mode, using data from the store to fill the\n   * data that was omitted in the token itself.\n   */\n  async loadTokenClaims(\n    tokenType: OAuthTokenType,\n    tokenPayload: AccessTokenPayload,\n  ): Promise<TokenClaims> {\n    const tokenId = tokenPayload.jti\n    const tokenInfo = await this.getTokenInfo(tokenId).catch((err) => {\n      throw InvalidTokenError.from(err, tokenType)\n    })\n\n    if (!tokenInfo) {\n      throw new InvalidTokenError(tokenType, `Invalid token`)\n    }\n\n    const { account, data } = tokenInfo\n\n    // Fool proof, make sure that the database & token payload are consistent.\n    // These should both be either undefined or a string so it's safe to compare\n    // the values directly.\n    if (tokenPayload.cnf?.jkt !== data.parameters.dpop_jkt) {\n      await this.deleteToken(tokenId)\n      throw new InvalidTokenError(tokenType, `Invalid token`)\n    }\n\n    if (isCurrentTokenExpired(tokenInfo)) {\n      await this.deleteToken(tokenId)\n      throw new InvalidTokenError(tokenType, `Token expired`)\n    }\n\n    return {\n      jti: tokenId,\n      sub: account.sub,\n      iat: dateToEpoch(data.updatedAt),\n      exp: dateToEpoch(data.expiresAt),\n      aud: account.aud,\n      scope: data.scope ?? data.parameters.scope,\n      // https://datatracker.ietf.org/doc/html/rfc8693#section-4.3\n      client_id: data.clientId,\n    }\n  }\n\n  async listAccountTokens(sub: Sub): Promise<TokenInfo[]> {\n    const results = await this.store.listAccountTokens(sub)\n    return results\n      .filter((tokenInfo) => tokenInfo.account.sub === sub) // Fool proof\n      .filter((tokenInfo) => !isCurrentTokenExpired(tokenInfo))\n  }\n}\n\nfunction isCurrentTokenExpired(tokenInfo: TokenInfo): boolean {\n  return tokenInfo.data.expiresAt.getTime() < Date.now()\n}\n\nfunction inferTokenType(\n  parameters: OAuthAuthorizationRequestParameters,\n): OAuthTokenType {\n  if (parameters.dpop_jkt) {\n    return 'DPoP'\n  }\n  return 'Bearer'\n}\n"]}
+{"version":3,"file":"token-manager.js","sourceRoot":"","sources":["../../src/token/token-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,WAAW,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AASxD,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAA;AAGtE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AAGpE,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAGxE,OAAO,EAAQ,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EAEL,oBAAoB,EACpB,cAAc,GACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAW,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAGnE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;AAGlC,MAAM,OAAO,YAAY;IACvB,YACqB,KAAiB,EACjB,cAA8B,EAC9B,MAAc,EACd,KAAiB,EACjB,eAAgC,EAChC,cAAc,aAAa;QAL3B,UAAK,GAAL,KAAK,CAAY;QACjB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAY;QACjB,oBAAe,GAAf,eAAe,CAAiB;QAChC,gBAAW,GAAX,WAAW,CAAgB;IAC7C,CAAC;IAEM,iBAAiB,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;QAC1C,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAA;IACnD,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,OAAgB,EAChB,MAAc,EACd,OAAgB,EAChB,UAA+C,EAC/C,QAAc,EACd,SAAe,EACf,KAAiB;QAEjB,MAAM,MAAM,GAAgB;YAC1B,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC;YAC1B,GAAG,EAAE,WAAW,CAAC,SAAS,CAAC;YAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;YAEhB,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI;gBACzB,GAAG,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE;aAClC,CAAC;YAEF,0EAA0E;YAC1E,kBAAkB;YAClB,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,eAAe,CAAC,SAAS,IAAI;gBACxD,KAAK;aACN,CAAC;YAEF,4DAA4D;YAC5D,SAAS,EAAE,MAAM,CAAC,EAAE;SACrB,CAAA;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE;YAChE,MAAM;YACN,OAAO;YACP,UAAU;YACV,MAAM;SACP,CAAC,CAAA;QAEF,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,cAAc,IAAI,MAAM,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,OAAgB,EAChB,QAAyB,EACzB,UAA+C,EAC/C,IAAU;QAEV,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;QAE9D,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAA;QACvC,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC;YACxE,CAAC,CAAC,MAAM,oBAAoB,EAAE;YAC9B,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc;aACpC,eAAe,CAAC,UAAU,CAAC,KAAM,CAAC;aAClC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,wBAAwB;YACxB,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC;YAED,mBAAmB;YACnB,MAAM,GAAG,CAAA;QACX,CAAC,CAAC,CAAA;QAEJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAC9C,OAAO,EACP,MAAM,EACN,OAAO,EACP,UAAU,EACV,GAAG,EACH,SAAS,EACT,KAAK,CACN,CAAA;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CACtC,cAAc,CAAC,UAAU,CAAC,EAC1B,WAAW,EACX,YAAY,EACZ,SAAS,EACT,OAAO,CAAC,GAAG,EACX,KAAK,CACN,CAAA;QAED,MAAM,SAAS,GAAoB;YACjC,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,SAAS;YACT,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,UAAU;YACV,QAAQ;YACR,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU;YACV,OAAO,EAAE,IAAI;YACb,KAAK;YACL,IAAI;SACL,CAAA;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;QAE9D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE;gBAC1C,MAAM;gBACN,UAAU;gBACV,cAAc;gBACd,OAAO;gBACP,UAAU;aACX,CAAC,CAAA;YAEF,OAAO,QAAQ,CAAA;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,sBAAsB;YACtB,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAC/B,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAES,KAAK,CAAC,mBAAmB,CACjC,MAAc,EACd,UAAsB,EACtB,UAA+C;QAE/C,IAAI,MAAM,CAAC,QAAQ,CAAC,wBAAwB,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACrE,MAAM,IAAI,iBAAiB,CACzB,mDAAmD,CACpD,CAAA;QACH,CAAC;IACH,CAAC;IAES,kBAAkB,CAC1B,SAAyB,EACzB,WAA6B,EAC7B,YAAgC,EAChC,SAAe,EACf,GAAQ,EACR,KAAa;QAEb,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,SAAS;YACrB,aAAa,EAAE,YAAY;YAC3B,KAAK;YAEL,qEAAqE;YACrE,0EAA0E;YAC1E,IAAI,UAAU;gBACZ,OAAO,qBAAqB,CAAC,SAAS,CAAC,CAAA;YACzC,CAAC;YAED,sEAAsE;YACtE,qEAAqE;YACrE,aAAa;YACb,GAAG;SACJ,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,SAAoB;QAEpB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;QACnC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;QAE3B,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;QAE9D,MAAM,WAAW,GAAG,MAAM,eAAe,EAAE,CAAA;QAC3C,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,EAAE,CAAA;QAErD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAE7C,oEAAoE;QACpE,wEAAwE;QACxE,iCAAiC;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,UAAU,CAAC,KAAM,CAAC,CAAA;QAE1E,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACxE,SAAS,EAAE,GAAG;YACd,SAAS;YACT,qEAAqE;YACrE,cAAc;YACd,qEAAqE;YACrE,kBAAkB;YAClB,mEAAmE;YACnE,aAAa;YACb,UAAU;YACV,KAAK;SACN,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAC9C,WAAW,EACX,MAAM,EACN,OAAO,EACP,UAAU,EACV,GAAG,EACH,SAAS,EACT,KAAK,CACN,CAAA;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CACtC,cAAc,CAAC,UAAU,CAAC,EAC1B,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,OAAO,CAAC,GAAG,EACX,KAAK,CACN,CAAA;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE;YAC5C,MAAM;YACN,UAAU;YACV,cAAc;YACd,OAAO;YACP,UAAU;SACX,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,SAAS,CAAC,KAAa;QAClC,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QACjC,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAC/B,CAAC;aAAM,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;aAAM,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,KAAgB;QAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE;YAC7D,cAAc,EAAE,QAAQ;SACzB,CAAC,CAAA;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACtD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QAE3B,6CAA6C;QAC7C,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACpC,MAAM,IAAI,KAAK,CACb,gBAAgB,SAAS,CAAC,OAAO,CAAC,GAAG,+BAA+B,OAAO,CAAC,GAAG,GAAG,CACnF,CAAA;QACH,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,KAAmB;QAEnB,OAAO,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAA;IAClD,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,KAAmB;QAClD,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QAEvE,4EAA4E;QAC5E,eAAe;QACf,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnE,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAA;QACtD,CAAC;QAED,IAAI,SAAS,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACpC,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,IAAU;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,OAAgB;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAgB;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACtC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,SAAyB,EACzB,YAAgC;QAEhC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAA;QAChC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC/D,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC9C,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QACzD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;QAEnC,0EAA0E;QAC1E,4EAA4E;QAC5E,uBAAuB;QACvB,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAC/B,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QACzD,CAAC;QAED,IAAI,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAC/B,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QACzD,CAAC;QAED,OAAO;YACL,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;YAChC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;YAChC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK;YAC1C,4DAA4D;YAC5D,SAAS,EAAE,IAAI,CAAC,QAAQ;SACzB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAQ;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QACvD,OAAO,OAAO;aACX,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,aAAa;aAClE,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7D,CAAC;CACF;AAED,SAAS,qBAAqB,CAAC,SAAoB;IACjD,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;AACxD,CAAC;AAED,SAAS,cAAc,CACrB,UAA+C;IAE/C,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC","sourcesContent":["import { SignedJwt, isSignedJwt } from '@atproto/jwk'\nimport { LexResolverError } from '@atproto/lex-resolver'\nimport type { Account } from '@atproto/oauth-provider-api'\nimport {\n  OAuthAccessToken,\n  OAuthAuthorizationRequestParameters,\n  OAuthScope,\n  OAuthTokenResponse,\n  OAuthTokenType,\n} from '@atproto/oauth-types'\nimport { AccessTokenMode } from '../access-token/access-token-mode.js'\nimport { ClientAuth } from '../client/client-auth.js'\nimport { Client } from '../client/client.js'\nimport { TOKEN_MAX_AGE } from '../constants.js'\nimport { DeviceId } from '../device/device-id.js'\nimport { InvalidGrantError } from '../errors/invalid-grant-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport { InvalidTokenError } from '../errors/invalid-token-error.js'\nimport { LexiconManager } from '../lexicon/lexicon-manager.js'\nimport { RequestMetadata } from '../lib/http/request.js'\nimport { dateToEpoch, dateToRelativeSeconds } from '../lib/util/date.js'\nimport { OAuthHooks } from '../oauth-hooks.js'\nimport { Sub } from '../oidc/sub.js'\nimport { Code, isCode } from '../request/code.js'\nimport { AccessTokenPayload } from '../signer/access-token-payload.js'\nimport { Signer } from '../signer/signer.js'\nimport {\n  RefreshToken,\n  generateRefreshToken,\n  isRefreshToken,\n} from './refresh-token.js'\nimport { TokenClaims } from './token-claims.js'\nimport { TokenId, generateTokenId, isTokenId } from './token-id.js'\nimport { CreateTokenData, TokenInfo, TokenStore } from './token-store.js'\n\nexport { AccessTokenMode, Signer }\nexport type { OAuthHooks, TokenStore }\n\nexport class TokenManager {\n  constructor(\n    protected readonly store: TokenStore,\n    protected readonly lexiconManager: LexiconManager,\n    protected readonly signer: Signer,\n    protected readonly hooks: OAuthHooks,\n    protected readonly accessTokenMode: AccessTokenMode,\n    protected readonly tokenMaxAge = TOKEN_MAX_AGE,\n  ) {}\n\n  protected createTokenExpiry(now = new Date()) {\n    return new Date(now.getTime() + this.tokenMaxAge)\n  }\n\n  protected async createAccessToken(\n    tokenId: TokenId,\n    client: Client,\n    account: Account,\n    parameters: OAuthAuthorizationRequestParameters,\n    issuedAt: Date,\n    expiresAt: Date,\n    scope: OAuthScope,\n  ): Promise<OAuthAccessToken> {\n    const claims: TokenClaims = {\n      jti: tokenId,\n      sub: account.sub,\n      iat: dateToEpoch(issuedAt),\n      exp: dateToEpoch(expiresAt),\n      aud: account.aud,\n\n      ...(parameters.dpop_jkt && {\n        cnf: { jkt: parameters.dpop_jkt },\n      }),\n\n      // Because tokens can end-up being quite big, we only include the scope in\n      // stateless mode.\n      ...(this.accessTokenMode === AccessTokenMode.stateless && {\n        scope,\n      }),\n\n      // https://datatracker.ietf.org/doc/html/rfc8693#section-4.3\n      client_id: client.id,\n    }\n\n    const claimsOverride = await this.hooks.onCreateToken?.call(null, {\n      client,\n      account,\n      parameters,\n      claims,\n    })\n\n    return this.signer.createAccessToken(claimsOverride ?? claims)\n  }\n\n  async createToken(\n    client: Client,\n    clientAuth: ClientAuth,\n    clientMetadata: RequestMetadata,\n    account: Account,\n    deviceId: null | DeviceId,\n    parameters: OAuthAuthorizationRequestParameters,\n    code: Code,\n  ): Promise<OAuthTokenResponse> {\n    await this.validateTokenParams(client, clientAuth, parameters)\n\n    const tokenId = await generateTokenId()\n    const refreshToken = client.metadata.grant_types.includes('refresh_token')\n      ? await generateRefreshToken()\n      : undefined\n\n    const now = new Date()\n    const expiresAt = this.createTokenExpiry(now)\n\n    const scope = await this.lexiconManager\n      .buildTokenScope(parameters.scope!)\n      .catch((err) => {\n        // Parse expected errors\n        if (err instanceof LexResolverError) {\n          throw new InvalidRequestError(err.message, err)\n        }\n\n        // Unexpected error\n        throw err\n      })\n\n    const accessToken = await this.createAccessToken(\n      tokenId,\n      client,\n      account,\n      parameters,\n      now,\n      expiresAt,\n      scope,\n    )\n\n    const response = this.buildTokenResponse(\n      inferTokenType(parameters),\n      accessToken,\n      refreshToken,\n      expiresAt,\n      account.sub,\n      scope,\n    )\n\n    const tokenData: CreateTokenData = {\n      createdAt: now,\n      updatedAt: now,\n      expiresAt,\n      clientId: client.id,\n      clientAuth,\n      deviceId,\n      sub: account.sub,\n      parameters,\n      details: null,\n      scope,\n      code,\n    }\n\n    await this.store.createToken(tokenId, tokenData, refreshToken)\n\n    try {\n      await this.hooks.onTokenCreated?.call(null, {\n        client,\n        clientAuth,\n        clientMetadata,\n        account,\n        parameters,\n      })\n\n      return response\n    } catch (err) {\n      // If the hook fails, we delete the token to avoid leaving a dangling\n      // token in the store.\n      await this.deleteToken(tokenId)\n      throw err\n    }\n  }\n\n  protected async validateTokenParams(\n    client: Client,\n    clientAuth: ClientAuth,\n    parameters: OAuthAuthorizationRequestParameters,\n  ): Promise<void> {\n    if (client.metadata.dpop_bound_access_tokens && !parameters.dpop_jkt) {\n      throw new InvalidGrantError(\n        `DPoP JKT is required for DPoP bound access tokens`,\n      )\n    }\n  }\n\n  protected buildTokenResponse(\n    tokenType: OAuthTokenType,\n    accessToken: OAuthAccessToken,\n    refreshToken: string | undefined,\n    expiresAt: Date,\n    sub: Sub,\n    scope: string,\n  ): OAuthTokenResponse {\n    return {\n      access_token: accessToken,\n      token_type: tokenType,\n      refresh_token: refreshToken,\n      scope,\n\n      // @NOTE using a getter so that the value gets computed when the JSON\n      // response is generated, allowing to value to be as accurate as possible.\n      get expires_in() {\n        return dateToRelativeSeconds(expiresAt)\n      },\n\n      // ATPROTO extension: add the sub claim to the token response to allow\n      // clients to resolve the PDS url (audience) using the did resolution\n      // mechanism.\n      sub,\n    }\n  }\n\n  async rotateToken(\n    client: Client,\n    clientAuth: ClientAuth,\n    clientMetadata: RequestMetadata,\n    tokenInfo: TokenInfo,\n  ): Promise<OAuthTokenResponse> {\n    const { account, data } = tokenInfo\n    const { parameters } = data\n\n    await this.validateTokenParams(client, clientAuth, parameters)\n\n    const nextTokenId = await generateTokenId()\n    const nextRefreshToken = await generateRefreshToken()\n\n    const now = new Date()\n    const expiresAt = this.createTokenExpiry(now)\n\n    // @NOTE since the permission sets are stored in a persistent store,\n    // it's fine to propagate a 500 (server_error) here as the values should\n    // be retrievable from the store.\n    const scope = await this.lexiconManager.buildTokenScope(parameters.scope!)\n\n    await this.store.rotateToken(tokenInfo.id, nextTokenId, nextRefreshToken, {\n      updatedAt: now,\n      expiresAt,\n      // @NOTE Normally, the clientAuth not change over time. There are two\n      // exceptions:\n      // - Upgrade from a legacy representation of client authentication to\n      //   a modern one.\n      // - Allow clients to become \"confidential\" if they were previously\n      //   \"public\"\n      clientAuth,\n      scope,\n    })\n\n    const accessToken = await this.createAccessToken(\n      nextTokenId,\n      client,\n      account,\n      parameters,\n      now,\n      expiresAt,\n      scope,\n    )\n\n    const response = this.buildTokenResponse(\n      inferTokenType(parameters),\n      accessToken,\n      nextRefreshToken,\n      expiresAt,\n      account.sub,\n      scope,\n    )\n\n    await this.hooks.onTokenRefreshed?.call(null, {\n      client,\n      clientAuth,\n      clientMetadata,\n      account,\n      parameters,\n    })\n\n    return response\n  }\n\n  /**\n   * @note The token validity is not guaranteed. The caller must ensure that the\n   * token is valid before using the returned token info.\n   */\n  public async findToken(token: string): Promise<null | TokenInfo> {\n    if (isTokenId(token)) {\n      return this.getTokenInfo(token)\n    } else if (isCode(token)) {\n      return this.findByCode(token)\n    } else if (isRefreshToken(token)) {\n      return this.findByRefreshToken(token)\n    } else if (isSignedJwt(token)) {\n      return this.findByAccessToken(token)\n    } else {\n      throw new InvalidRequestError(`Invalid token`)\n    }\n  }\n\n  public async findByAccessToken(token: SignedJwt): Promise<null | TokenInfo> {\n    const { payload } = await this.signer.verifyAccessToken(token, {\n      clockTolerance: Infinity,\n    })\n\n    const tokenInfo = await this.getTokenInfo(payload.jti)\n    if (!tokenInfo) return null\n\n    // Fool-proof: Invalid store implementation ?\n    if (payload.sub !== tokenInfo.account.sub) {\n      await this.deleteToken(tokenInfo.id)\n      throw new Error(\n        `Account sub (${tokenInfo.account.sub}) does not match token sub (${payload.sub})`,\n      )\n    }\n\n    return tokenInfo\n  }\n\n  protected async findByRefreshToken(\n    token: RefreshToken,\n  ): Promise<null | TokenInfo> {\n    return this.store.findTokenByRefreshToken(token)\n  }\n\n  public async consumeRefreshToken(token: RefreshToken): Promise<TokenInfo> {\n    // @NOTE concurrent refreshes of the same refresh token could theoretically\n    // lead to two new tokens (access & refresh) being created. This is deemed\n    // acceptable for now (as the mechanism can only be used once since only one\n    // of the two refresh token created will be valid, and any future refresh\n    // attempts from outdated tokens will cause the entire session to be\n    // invalidated). Ideally, the store should be able to handle this case by\n    // atomically consuming the refresh token and returning the token info.\n\n    // @TODO Add another store method that atomically consumes the refresh token\n    // with a lock.\n    const tokenInfo = await this.findByRefreshToken(token).catch((err) => {\n      throw InvalidGrantError.from(err, `Invalid refresh token`)\n    })\n\n    if (!tokenInfo) {\n      throw new InvalidGrantError(`Invalid refresh token`)\n    }\n\n    if (tokenInfo.currentRefreshToken !== token) {\n      await this.deleteToken(tokenInfo.id)\n      throw new InvalidGrantError(`Refresh token replayed`)\n    }\n\n    return tokenInfo\n  }\n\n  public async findByCode(code: Code): Promise<null | TokenInfo> {\n    return this.store.findTokenByCode(code)\n  }\n\n  public async deleteToken(tokenId: TokenId): Promise<void> {\n    return this.store.deleteToken(tokenId)\n  }\n\n  async getTokenInfo(tokenId: TokenId): Promise<null | TokenInfo> {\n    return this.store.readToken(tokenId)\n  }\n\n  /**\n   * This method is called to when decoding a token that was encoded in\n   * {@link AccessTokenMode.light} mode, using data from the store to fill the\n   * data that was omitted in the token itself.\n   */\n  async loadTokenClaims(\n    tokenType: OAuthTokenType,\n    tokenPayload: AccessTokenPayload,\n  ): Promise<TokenClaims> {\n    const tokenId = tokenPayload.jti\n    const tokenInfo = await this.getTokenInfo(tokenId).catch((err) => {\n      throw InvalidTokenError.from(err, tokenType)\n    })\n\n    if (!tokenInfo) {\n      throw new InvalidTokenError(tokenType, `Invalid token`)\n    }\n\n    const { account, data } = tokenInfo\n\n    // Fool proof, make sure that the database & token payload are consistent.\n    // These should both be either undefined or a string so it's safe to compare\n    // the values directly.\n    if (tokenPayload.cnf?.jkt !== data.parameters.dpop_jkt) {\n      await this.deleteToken(tokenId)\n      throw new InvalidTokenError(tokenType, `Invalid token`)\n    }\n\n    if (isCurrentTokenExpired(tokenInfo)) {\n      await this.deleteToken(tokenId)\n      throw new InvalidTokenError(tokenType, `Token expired`)\n    }\n\n    return {\n      jti: tokenId,\n      sub: account.sub,\n      iat: dateToEpoch(data.updatedAt),\n      exp: dateToEpoch(data.expiresAt),\n      aud: account.aud,\n      scope: data.scope ?? data.parameters.scope,\n      // https://datatracker.ietf.org/doc/html/rfc8693#section-4.3\n      client_id: data.clientId,\n    }\n  }\n\n  async listAccountTokens(sub: Sub): Promise<TokenInfo[]> {\n    const results = await this.store.listAccountTokens(sub)\n    return results\n      .filter((tokenInfo) => tokenInfo.account.sub === sub) // Fool proof\n      .filter((tokenInfo) => !isCurrentTokenExpired(tokenInfo))\n  }\n}\n\nfunction isCurrentTokenExpired(tokenInfo: TokenInfo): boolean {\n  return tokenInfo.data.expiresAt.getTime() < Date.now()\n}\n\nfunction inferTokenType(\n  parameters: OAuthAuthorizationRequestParameters,\n): OAuthTokenType {\n  if (parameters.dpop_jkt) {\n    return 'DPoP'\n  }\n  return 'Bearer'\n}\n"]}

package/dist/token/token-store.js

@@ -1,27 +1,9 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTokenStore = void 0;
-exports.asTokenStore = asTokenStore;
-const type_js_1 = require("../lib/util/type.js");
+import { buildInterfaceChecker } from '../lib/util/type.js';
 // Export all types needed to implement the TokenStore interface
-__exportStar(require("./refresh-token.js"), exports);
-__exportStar(require("./token-data.js"), exports);
-__exportStar(require("./token-id.js"), exports);
-exports.isTokenStore = (0, type_js_1.buildInterfaceChecker)([
+export * from './refresh-token.js';
+export * from './token-data.js';
+export * from './token-id.js';
+export const isTokenStore = buildInterfaceChecker([
     'createToken',
     'readToken',
     'deleteToken',
@@ -30,8 +12,8 @@ exports.isTokenStore = (0, type_js_1.buildInterfaceChecker)([
     'findTokenByCode',
     'listAccountTokens',
 ]);
-function asTokenStore(implementation) {
-    if (!implementation || !(0, exports.isTokenStore)(implementation)) {
+export function asTokenStore(implementation) {
+    if (!implementation || !isTokenStore(implementation)) {
         throw new Error('Invalid TokenStore implementation');
     }
     return implementation;

package/dist/token/token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/token/token-store.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAgFA,oCAOC;AAtFD,iDAAsE;AAOtE,gEAAgE;AAChE,qDAAkC;AAClC,kDAA+B;AAC/B,gDAA6B;AA2DhB,QAAA,YAAY,GAAG,IAAA,+BAAqB,EAAa;IAC5D,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,yBAAyB;IACzB,iBAAiB;IACjB,mBAAmB;CACpB,CAAC,CAAA;AAEF,SAAgB,YAAY,CAC1B,cAAkB;IAElB,IAAI,CAAC,cAAc,IAAI,CAAC,IAAA,oBAAY,EAAC,cAAc,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,cAAc,CAAA;AACvB,CAAC","sourcesContent":["import type { Account } from '@atproto/oauth-provider-api'\nimport { Awaitable, buildInterfaceChecker } from '../lib/util/type.js'\nimport { Sub } from '../oidc/sub.js'\nimport { Code } from '../request/code.js'\nimport { RefreshToken } from './refresh-token.js'\nimport { TokenData } from './token-data.js'\nimport { TokenId } from './token-id.js'\n\n// Export all types needed to implement the TokenStore interface\nexport * from './refresh-token.js'\nexport * from './token-data.js'\nexport * from './token-id.js'\nexport type { Account, Awaitable, Sub }\n\nexport type TokenInfo = {\n  id: TokenId\n  data: TokenData\n  account: Account\n  currentRefreshToken: null | RefreshToken\n}\n\nexport type NewTokenData = {\n  clientAuth: TokenData['clientAuth']\n  expiresAt: TokenData['expiresAt']\n  updatedAt: TokenData['updatedAt']\n  scope: NonNullable<TokenData['scope']>\n}\n\nexport type CreateTokenData = TokenData & {\n  scope: NonNullable<TokenData['scope']>\n}\n\n/**\n * @param data historically, {@link TokenData.scope} was not present in\n * {@link TokenData}, causing it to be \"nullable\" when returned from\n * {@link TokenStore.readToken}. We use {@link CreateTokenData} here to allow\n * the store implementation to expect its presence.\n */\nexport interface TokenStore {\n  createToken(\n    tokenId: TokenId,\n    data: CreateTokenData,\n    refreshToken?: RefreshToken,\n  ): Awaitable<void>\n\n  readToken(tokenId: TokenId): Awaitable<null | TokenInfo>\n\n  deleteToken(tokenId: TokenId): Awaitable<void>\n\n  rotateToken(\n    tokenId: TokenId,\n    newTokenId: TokenId,\n    newRefreshToken: RefreshToken,\n    newData: NewTokenData,\n  ): Awaitable<void>\n\n  /**\n   * Find a token by its refresh token. Note that previous refresh tokens\n   * should also return the token. The data model is responsible for storing\n   * old refresh tokens when a new one is issued.\n   */\n  findTokenByRefreshToken(\n    refreshToken: RefreshToken,\n  ): Awaitable<null | TokenInfo>\n\n  findTokenByCode(code: Code): Awaitable<null | TokenInfo>\n\n  listAccountTokens(sub: Sub): Awaitable<TokenInfo[]>\n}\n\nexport const isTokenStore = buildInterfaceChecker<TokenStore>([\n  'createToken',\n  'readToken',\n  'deleteToken',\n  'rotateToken',\n  'findTokenByRefreshToken',\n  'findTokenByCode',\n  'listAccountTokens',\n])\n\nexport function asTokenStore<V extends Partial<TokenStore>>(\n  implementation?: V,\n): V & TokenStore {\n  if (!implementation || !isTokenStore(implementation)) {\n    throw new Error('Invalid TokenStore implementation')\n  }\n  return implementation\n}\n"]}
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/token/token-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAOtE,gEAAgE;AAChE,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,eAAe,CAAA;AA2D7B,MAAM,CAAC,MAAM,YAAY,GAAG,qBAAqB,CAAa;IAC5D,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,yBAAyB;IACzB,iBAAiB;IACjB,mBAAmB;CACpB,CAAC,CAAA;AAEF,MAAM,UAAU,YAAY,CAC1B,cAAkB;IAElB,IAAI,CAAC,cAAc,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,cAAc,CAAA;AACvB,CAAC","sourcesContent":["import type { Account } from '@atproto/oauth-provider-api'\nimport { Awaitable, buildInterfaceChecker } from '../lib/util/type.js'\nimport { Sub } from '../oidc/sub.js'\nimport { Code } from '../request/code.js'\nimport { RefreshToken } from './refresh-token.js'\nimport { TokenData } from './token-data.js'\nimport { TokenId } from './token-id.js'\n\n// Export all types needed to implement the TokenStore interface\nexport * from './refresh-token.js'\nexport * from './token-data.js'\nexport * from './token-id.js'\nexport type { Account, Awaitable, Sub }\n\nexport type TokenInfo = {\n  id: TokenId\n  data: TokenData\n  account: Account\n  currentRefreshToken: null | RefreshToken\n}\n\nexport type NewTokenData = {\n  clientAuth: TokenData['clientAuth']\n  expiresAt: TokenData['expiresAt']\n  updatedAt: TokenData['updatedAt']\n  scope: NonNullable<TokenData['scope']>\n}\n\nexport type CreateTokenData = TokenData & {\n  scope: NonNullable<TokenData['scope']>\n}\n\n/**\n * @param data historically, {@link TokenData.scope} was not present in\n * {@link TokenData}, causing it to be \"nullable\" when returned from\n * {@link TokenStore.readToken}. We use {@link CreateTokenData} here to allow\n * the store implementation to expect its presence.\n */\nexport interface TokenStore {\n  createToken(\n    tokenId: TokenId,\n    data: CreateTokenData,\n    refreshToken?: RefreshToken,\n  ): Awaitable<void>\n\n  readToken(tokenId: TokenId): Awaitable<null | TokenInfo>\n\n  deleteToken(tokenId: TokenId): Awaitable<void>\n\n  rotateToken(\n    tokenId: TokenId,\n    newTokenId: TokenId,\n    newRefreshToken: RefreshToken,\n    newData: NewTokenData,\n  ): Awaitable<void>\n\n  /**\n   * Find a token by its refresh token. Note that previous refresh tokens\n   * should also return the token. The data model is responsible for storing\n   * old refresh tokens when a new one is issued.\n   */\n  findTokenByRefreshToken(\n    refreshToken: RefreshToken,\n  ): Awaitable<null | TokenInfo>\n\n  findTokenByCode(code: Code): Awaitable<null | TokenInfo>\n\n  listAccountTokens(sub: Sub): Awaitable<TokenInfo[]>\n}\n\nexport const isTokenStore = buildInterfaceChecker<TokenStore>([\n  'createToken',\n  'readToken',\n  'deleteToken',\n  'rotateToken',\n  'findTokenByRefreshToken',\n  'findTokenByCode',\n  'listAccountTokens',\n])\n\nexport function asTokenStore<V extends Partial<TokenStore>>(\n  implementation?: V,\n): V & TokenStore {\n  if (!implementation || !isTokenStore(implementation)) {\n    throw new Error('Invalid TokenStore implementation')\n  }\n  return implementation\n}\n"]}

package/dist/types/authorization-response-error.js

@@ -1,21 +1,17 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authorizationResponseErrorSchema = void 0;
-exports.isAuthorizationResponseError = isAuthorizationResponseError;
-const zod_1 = require("zod");
-const oauth_types_1 = require("@atproto/oauth-types");
-exports.authorizationResponseErrorSchema = zod_1.z.union([
-    oauth_types_1.oauthAuthorizationResponseErrorSchema,
+import { z } from 'zod';
+import { oauthAuthorizationResponseErrorSchema, oidcAuthorizationResponseErrorSchema, } from '@atproto/oauth-types';
+export const authorizationResponseErrorSchema = z.union([
+    oauthAuthorizationResponseErrorSchema,
     // OIDC authentication error response are not part of the ATproto flavoured
     // OAuth but we allow them because they provide better feedback to the client
     // (in particular when SSO is used).
-    oauth_types_1.oidcAuthorizationResponseErrorSchema,
+    oidcAuthorizationResponseErrorSchema,
     // This error is defined by rfc9396 (not part of the OAuth 2.1 or OIDC). But
     // since, in ATproto flavoured OAuth, client registration is a dynamic part of
     // the authorization process, we allow it.
-    zod_1.z.literal('invalid_authorization_details'),
+    z.literal('invalid_authorization_details'),
 ]);
-function isAuthorizationResponseError(value) {
-    return exports.authorizationResponseErrorSchema.safeParse(value).success;
+export function isAuthorizationResponseError(value) {
+    return authorizationResponseErrorSchema.safeParse(value).success;
 }
 //# sourceMappingURL=authorization-response-error.js.map

package/dist/types/authorization-response-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-response-error.js","sourceRoot":"","sources":["../../src/types/authorization-response-error.ts"],"names":[],"mappings":";;;AAsBA,oEAIC;AA1BD,6BAAuB;AACvB,sDAG6B;AAEhB,QAAA,gCAAgC,GAAG,OAAC,CAAC,KAAK,CAAC;IACtD,mDAAqC;IACrC,2EAA2E;IAC3E,6EAA6E;IAC7E,oCAAoC;IACpC,kDAAoC;IACpC,4EAA4E;IAC5E,8EAA8E;IAC9E,0CAA0C;IAC1C,OAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC;CAC3C,CAAC,CAAA;AAMF,SAAgB,4BAA4B,CAC1C,KAAQ;IAER,OAAO,wCAAgC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAA;AAClE,CAAC","sourcesContent":["import { z } from 'zod'\nimport {\n  oauthAuthorizationResponseErrorSchema,\n  oidcAuthorizationResponseErrorSchema,\n} from '@atproto/oauth-types'\n\nexport const authorizationResponseErrorSchema = z.union([\n  oauthAuthorizationResponseErrorSchema,\n  // OIDC authentication error response are not part of the ATproto flavoured\n  // OAuth but we allow them because they provide better feedback to the client\n  // (in particular when SSO is used).\n  oidcAuthorizationResponseErrorSchema,\n  // This error is defined by rfc9396 (not part of the OAuth 2.1 or OIDC). But\n  // since, in ATproto flavoured OAuth, client registration is a dynamic part of\n  // the authorization process, we allow it.\n  z.literal('invalid_authorization_details'),\n])\n\nexport type AuthorizationResponseError = z.infer<\n  typeof authorizationResponseErrorSchema\n>\n\nexport function isAuthorizationResponseError<T>(\n  value: T,\n): value is T & AuthorizationResponseError {\n  return authorizationResponseErrorSchema.safeParse(value).success\n}\n"]}
+{"version":3,"file":"authorization-response-error.js","sourceRoot":"","sources":["../../src/types/authorization-response-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACL,qCAAqC,EACrC,oCAAoC,GACrC,MAAM,sBAAsB,CAAA;AAE7B,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC;IACtD,qCAAqC;IACrC,2EAA2E;IAC3E,6EAA6E;IAC7E,oCAAoC;IACpC,oCAAoC;IACpC,4EAA4E;IAC5E,8EAA8E;IAC9E,0CAA0C;IAC1C,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC;CAC3C,CAAC,CAAA;AAMF,MAAM,UAAU,4BAA4B,CAC1C,KAAQ;IAER,OAAO,gCAAgC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAA;AAClE,CAAC","sourcesContent":["import { z } from 'zod'\nimport {\n  oauthAuthorizationResponseErrorSchema,\n  oidcAuthorizationResponseErrorSchema,\n} from '@atproto/oauth-types'\n\nexport const authorizationResponseErrorSchema = z.union([\n  oauthAuthorizationResponseErrorSchema,\n  // OIDC authentication error response are not part of the ATproto flavoured\n  // OAuth but we allow them because they provide better feedback to the client\n  // (in particular when SSO is used).\n  oidcAuthorizationResponseErrorSchema,\n  // This error is defined by rfc9396 (not part of the OAuth 2.1 or OIDC). But\n  // since, in ATproto flavoured OAuth, client registration is a dynamic part of\n  // the authorization process, we allow it.\n  z.literal('invalid_authorization_details'),\n])\n\nexport type AuthorizationResponseError = z.infer<\n  typeof authorizationResponseErrorSchema\n>\n\nexport function isAuthorizationResponseError<T>(\n  value: T,\n): value is T & AuthorizationResponseError {\n  return authorizationResponseErrorSchema.safeParse(value).success\n}\n"]}

package/dist/types/color-hue.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.colorHueSchema = void 0;
-const zod_1 = require("zod");
-exports.colorHueSchema = zod_1.z.number().min(0).max(360);
+import { z } from 'zod';
+export const colorHueSchema = z.number().min(0).max(360);
 //# sourceMappingURL=color-hue.js.map