@boopkit/cap-oauth-server 0.1.0

package/dist/token-controller.js

@@ -0,0 +1,207 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OFFLINE_ACCESS_SCOPE = void 0;
+exports.parseScopes = parseScopes;
+exports.createTokenHandlers = createTokenHandlers;
+exports.createTokenRouter = createTokenRouter;
+const express_1 = require("express");
+const body_field_js_1 = require("./body-field.js");
+const oauth_error_js_1 = require("./oauth-error.js");
+const pkce_js_1 = require("./pkce.js");
+const request_client_js_1 = require("./request-client.js");
+const token_service_js_1 = require("./token-service.js");
+const user_store_js_1 = require("./user-store.js");
+/** The scope that earns a refresh token, per the discovery document. */
+exports.OFFLINE_ACCESS_SCOPE = 'offline_access';
+/** Redemption failures, mapped to the wire. */
+const REDEEM_ERROR = {
+    unknown_code: 'the authorization code is unknown, expired or already used',
+    already_redeemed: 'the authorization code has already been redeemed',
+    expired: 'the authorization code has expired',
+    client_mismatch: 'the authorization code was issued to a different client',
+    redirect_uri_mismatch: 'redirect_uri does not match the one the code was issued for',
+};
+/** RFC 6749 §3.3: scopes are space-delimited. Tolerate any run of whitespace. */
+function parseScopes(raw) {
+    if (!raw)
+        return [];
+    return [...new Set(raw.split(/\s+/).filter(Boolean))];
+}
+function createTokenHandlers(deps) {
+    const { clientRegistry, tokenService, grantService, authorizationCodeService } = deps;
+    /** Shared with `/oauth/revoke`, so the two doors cannot disagree. */
+    const resolveClient = (body) => (0, request_client_js_1.resolveRequestClient)(clientRegistry, body);
+    /**
+     * End-date every token the grant holds, then the grant itself.
+     *
+     * The rows go first. The grant's `ended_at` is what the guard reads on the
+     * next request, so ending it first would leave a window in which the grant
+     * looked dead while its tokens were still resolvable to anyone reading the
+     * identity rows directly.
+     */
+    async function revokeGrant(userId, grant, reason) {
+        await tokenService.revokeTokensForClient(userId, grant.client_public_id);
+        await grantService.end(userId, grant.grant_id, reason);
+    }
+    /** Mint the pair and answer. One place, so the two grants cannot drift. */
+    async function issueTokens(userId, client, grant) {
+        const access = await tokenService.mint(userId, token_service_js_1.OAUTH_ACCESS_DOMAIN, client.publicId);
+        const response = {
+            access_token: access.token,
+            token_type: 'Bearer',
+            expires_in: tokenService.ttlSecondsFor(token_service_js_1.OAUTH_ACCESS_DOMAIN),
+            // The GRANT's scopes, not anything the request asked for. The token
+            // carries no copy and the guard reads the grant, so reporting anything
+            // else here would be describing a credential that does not exist.
+            scope: grant.scopes.join(' '),
+        };
+        if (grant.scopes.includes(exports.OFFLINE_ACCESS_SCOPE)) {
+            const refresh = await tokenService.mint(userId, token_service_js_1.OAUTH_REFRESH_DOMAIN, client.publicId);
+            // Recording the new key is what invalidates the old one: the previous
+            // token still resolves, and now takes the theft branch.
+            await grantService.setRefreshKey(userId, grant.grant_id, refresh.identityKey);
+            response.refresh_token = refresh.token;
+        }
+        return response;
+    }
+    async function authorizationCodeGrant(body) {
+        const client = await resolveClient(body);
+        const code = (0, body_field_js_1.required)(body, 'code');
+        const redirectUri = (0, body_field_js_1.required)(body, 'redirect_uri');
+        // PKCE is required, not optional: OAuth 2.1 requires it for public clients
+        // and every client here is public.
+        const verifier = (0, body_field_js_1.required)(body, 'code_verifier');
+        let redeemed;
+        try {
+            redeemed = await authorizationCodeService.redeem({
+                code,
+                clientId: client.clientId,
+                clientPublicId: client.publicId,
+                redirectUri,
+            });
+        }
+        catch (err) {
+            // The single-use claim is the property write, so losing its revision
+            // check means another request redeemed this code first.
+            if ((0, user_store_js_1.isStaleWriteError)(err)) {
+                throw new oauth_error_js_1.OAuthError('invalid_grant', 'the authorization code has already been redeemed');
+            }
+            throw err;
+        }
+        if (!redeemed.ok) {
+            throw new oauth_error_js_1.OAuthError('invalid_grant', REDEEM_ERROR[redeemed.reason]);
+        }
+        const { record, userId } = redeemed;
+        if (!(0, pkce_js_1.verifyCodeChallenge)(verifier, record.code_challenge, record.code_challenge_method)) {
+            // The code is already spent at this point, and deliberately so: a failed
+            // verifier is a redemption attempt, and letting the code survive it would
+            // hand an attacker unlimited guesses at the challenge.
+            throw new oauth_error_js_1.OAuthError('invalid_grant', 'code_verifier does not match the code_challenge');
+        }
+        // The code's scopes become the grant's — replacing, never unioning. This is
+        // the write the whole consent screen exists to authorise.
+        const grant = await grantService.approve(userId, {
+            clientId: client.clientId,
+            clientPublicId: client.publicId,
+            scopes: record.scopes,
+            resource: record.resource,
+        });
+        return issueTokens(userId, client, grant);
+    }
+    async function refreshTokenGrant(body) {
+        const client = await resolveClient(body);
+        const presented = (0, body_field_js_1.required)(body, 'refresh_token');
+        const resolved = await tokenService.resolve(token_service_js_1.OAUTH_REFRESH_DOMAIN, presented);
+        // Unknown, malformed, expired (and swept), or revoked. All one answer.
+        if (!resolved) {
+            throw new oauth_error_js_1.OAuthError('invalid_grant', 'the refresh token is unknown, expired or revoked');
+        }
+        if (resolved.clientPublicId !== client.publicId) {
+            throw new oauth_error_js_1.OAuthError('invalid_grant', 'the refresh token was issued to a different client');
+        }
+        const grant = await grantService.findActive(resolved.userId, client.publicId);
+        if (!grant) {
+            throw new oauth_error_js_1.OAuthError('invalid_grant', 'this grant has been revoked');
+        }
+        if (grant.refresh_key !== resolved.identityKey) {
+            // Reuse of a rotated token. See the header for why the old row is still
+            // resolvable and why this is the whole grant's problem rather than this
+            // request's.
+            await revokeGrant(resolved.userId, grant, 'refresh_reuse');
+            throw new oauth_error_js_1.OAuthError('invalid_grant', 'this refresh token has already been rotated; the grant has been revoked');
+        }
+        // RFC 6749 §6 lets a client ask for a narrower scope on refresh. The grant
+        // remains the authority, so the request is validated as a subset and the
+        // response still reports the grant's set — a token that claimed a narrower
+        // audience than the guard will enforce would be a lie.
+        const requested = parseScopes((0, body_field_js_1.field)(body, 'scope'));
+        const exceeded = requested.filter((scope) => !grant.scopes.includes(scope));
+        if (exceeded.length > 0) {
+            throw new oauth_error_js_1.OAuthError('invalid_scope', `not covered by this grant: ${exceeded.join(' ')}`);
+        }
+        try {
+            const response = await issueTokens(resolved.userId, client, grant);
+            // The old row stays active on purpose — it is how the next presentation
+            // of this token is recognised as reuse rather than as a typo.
+            return response;
+        }
+        catch (err) {
+            if ((0, user_store_js_1.isStaleWriteError)(err)) {
+                // Somebody else moved the grant underneath us — a concurrent refresh,
+                // or a revoke landing at the same moment. Retryable, so say so rather
+                // than telling the client to throw its credentials away.
+                throw new oauth_error_js_1.OAuthError('temporarily_unavailable', 'the grant changed while refreshing');
+            }
+            throw err;
+        }
+    }
+    const token = async (req, res, next) => {
+        // §5.1 and §5.2 both: a token response must never be cached, whichever way
+        // it turned out.
+        res.set('Cache-Control', 'no-store');
+        res.set('Pragma', 'no-cache');
+        try {
+            const grantType = (0, body_field_js_1.required)(req.body, 'grant_type');
+            let response;
+            if (grantType === 'authorization_code') {
+                response = await authorizationCodeGrant(req.body);
+            }
+            else if (grantType === 'refresh_token') {
+                response = await refreshTokenGrant(req.body);
+            }
+            else {
+                throw new oauth_error_js_1.OAuthError('unsupported_grant_type', `this server issues tokens for authorization_code and refresh_token, not ${grantType}`);
+            }
+            res.status(200).json(response);
+        }
+        catch (err) {
+            if ((0, oauth_error_js_1.isOAuthError)(err)) {
+                if (err.error === 'invalid_client') {
+                    // §5.2: a 401 here needs a challenge, or a client cannot tell an
+                    // authentication failure from a malformed request.
+                    res.set('WWW-Authenticate', 'Bearer');
+                }
+                res.status(err.status).json(err.toBody());
+                return;
+            }
+            next(err);
+        }
+    };
+    return { token };
+}
+/**
+ * `POST /oauth/token`, with both body parsers attached.
+ *
+ * The router parses its own body rather than relying on an app-level
+ * `express.urlencoded()`, so the endpoint behaves the same whatever order the
+ * host application mounts its middleware in — and so the limit here is the one
+ * that applies.
+ */
+function createTokenRouter(options) {
+    const handlers = createTokenHandlers(options);
+    const router = (0, express_1.Router)();
+    const limit = options.bodyLimit ?? '16kb';
+    router.post('/oauth/token', (0, express_1.urlencoded)({ extended: false, limit }), (0, express_1.json)({ limit }), handlers.token);
+    return router;
+}
+//# sourceMappingURL=token-controller.js.map

package/dist/token-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-controller.js","sourceRoot":"","sources":["../src/token-controller.ts"],"names":[],"mappings":";;;AAsFA,kCAGC;AAED,kDAiMC;AAeD,8CAaC;AAxTD,qCAAqG;AAGrG,mDAAkD;AAGlD,qDAA4D;AAC5D,uCAAgD;AAChD,2DAA2D;AAC3D,yDAI4B;AAE5B,mDAAoD;AA0DpD,wEAAwE;AAC3D,QAAA,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,+CAA+C;AAC/C,MAAM,YAAY,GAAkC;IAClD,YAAY,EAAE,4DAA4D;IAC1E,gBAAgB,EAAE,kDAAkD;IACpE,OAAO,EAAE,oCAAoC;IAC7C,eAAe,EAAE,yDAAyD;IAC1E,qBAAqB,EAAE,6DAA6D;CACrF,CAAC;AAEF,iFAAiF;AACjF,SAAgB,WAAW,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAsB;IACxD,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,wBAAwB,EAAE,GAAG,IAAI,CAAC;IAEtF,qEAAqE;IACrE,MAAM,aAAa,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,IAAA,wCAAoB,EAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAEpF;;;;;;;OAOG;IACH,KAAK,UAAU,WAAW,CACxB,MAAc,EACd,KAAuB,EACvB,MAAc;QAEd,MAAM,YAAY,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,2EAA2E;IAC3E,KAAK,UAAU,WAAW,CACxB,MAAc,EACd,MAAmB,EACnB,KAAuB;QAEvB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,sCAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAErF,MAAM,QAAQ,GAAkB;YAC9B,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,YAAY,CAAC,aAAa,CAAC,sCAAmB,CAAC;YAC3D,oEAAoE;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SAC9B,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAAoB,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,uCAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvF,sEAAsE;YACtE,wDAAwD;YACxD,MAAM,YAAY,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC9E,QAAQ,CAAC,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;QACzC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,sBAAsB,CAAC,IAAa;QACjD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,WAAW,GAAG,IAAA,wBAAQ,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACnD,2EAA2E;QAC3E,mCAAmC;QACnC,MAAM,QAAQ,GAAG,IAAA,wBAAQ,EAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAEjD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC;gBAC/C,IAAI;gBACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,cAAc,EAAE,MAAM,CAAC,QAAQ;gBAC/B,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,wDAAwD;YACxD,IAAI,IAAA,iCAAiB,EAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAA,6BAAmB,EAAC,QAAQ,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACxF,yEAAyE;YACzE,0EAA0E;YAC1E,uDAAuD;YACvD,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,iDAAiD,CAAC,CAAC;QAC3F,CAAC;QAED,4EAA4E;QAC5E,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE;YAC/C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,IAAa;QAC5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAA,wBAAQ,EAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAElD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,uCAAoB,EAAE,SAAS,CAAC,CAAC;QAC7E,uEAAuE;QACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,QAAQ,CAAC,cAAc,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC/C,wEAAwE;YACxE,wEAAwE;YACxE,aAAa;YACb,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;YAC3D,MAAM,IAAI,2BAAU,CAClB,eAAe,EACf,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAA,qBAAK,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,8BAA8B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACnE,wEAAwE;YACxE,8DAA8D;YAC9D,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAA,iCAAiB,EAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,sEAAsE;gBACtE,sEAAsE;gBACtE,yDAAyD;gBACzD,MAAM,IAAI,2BAAU,CAAC,yBAAyB,EAAE,oCAAoC,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAmB,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAI,EAAE,EAAE;QACxE,2EAA2E;QAC3E,iBAAiB;QACjB,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,wBAAQ,EAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAEnD,IAAI,QAAuB,CAAC;YAC5B,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;gBACvC,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBACzC,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,2BAAU,CAClB,wBAAwB,EACxB,2EAA2E,SAAS,EAAE,CACvF,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAA,6BAAY,EAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,IAAI,GAAG,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;oBACnC,iEAAiE;oBACjE,mDAAmD;oBACnD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;gBACxC,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAOD;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IACxB,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE1C,MAAM,CAAC,IAAI,CACT,cAAc,EACd,IAAA,oBAAU,EAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EACtC,IAAA,cAAI,EAAC,EAAE,KAAK,EAAE,CAAC,EACf,QAAQ,CAAC,KAAK,CACf,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/token-service.d.ts

@@ -0,0 +1,175 @@
+import type { IdentityStore, StoredIdentity } from './user-store.js';
+/**
+ * Minting, parsing and resolving the three OAuth credentials.
+ *
+ * ## The wire format, and why it has a prefix at all
+ *
+ * `<client publicId>.<generateToken(partition)>`. Splitting on the **first**
+ * `.` yields the client that the token was issued to before any database is
+ * touched, which is what makes client-wide revocation a key-prefix scan
+ * (`key LIKE '<publicId>|%'`) instead of a full table walk. `publicId` is
+ * twelve lowercase base36 characters precisely so that neither separator can
+ * appear in it — see `public-id.ts`.
+ *
+ * The stored identity key is `"<publicId>|<sha256 of the whole token>"`. The
+ * raw token is never stored anywhere, in either half of the two-read model:
+ * `tests/packages/cap-oauth-server-credentials-at-rest.test.ts` runs a complete
+ * flow and reads both property rows back to prove it.
+ *
+ * ## Expiry is `createdAt + ttl`, and the sweep is not an optimisation
+ *
+ * The plan corrects both the spec and the findings here, and the correction is
+ * the load-bearing part of this file. cap-users' `endedAt` is a **tombstone,
+ * not a scheduled expiry**: `findByDomainAndKey` returns `null` whenever
+ * `endedAt !== null`, so a *future* `endedAt` would read as already ended, and
+ * `endDate(domain, key)` takes no timestamp and always writes `new Date()`.
+ * A token's lifetime therefore has no home on the identity row.
+ *
+ * So a token is expired when `identity.createdAt + ttl < now`, where the TTL is
+ * configuration. That comparison is retroactive — it changes its answer for
+ * every existing row the moment the configuration changes — which is why
+ * `resolve` **writes `endedAt` on the first expired read**. Without that write,
+ * lengthening `OAUTH_ACCESS_TOKEN_TTL_SECONDS` would resurrect every token that
+ * had expired but whose row nobody had happened to look at. With it, the row is
+ * permanently dead the first time anybody notices, whatever the configuration
+ * does afterwards.
+ *
+ * Rotation then gives the refresh token a sliding window for free: each
+ * rotation mints a new row with a fresh `createdAt`, so a connector in daily use
+ * never expires and an abandoned one does.
+ *
+ * ## The authorization code is not governed by this rule
+ *
+ * Its `oauth-codes` property entry carries an explicit `expires_at` and that
+ * field stays the authority. The 120 seconds below is what writes it.
+ */
+/** The three identity domains the settled data model fixes. */
+export declare const OAUTH_CODE_DOMAIN = "oauth-code";
+export declare const OAUTH_ACCESS_DOMAIN = "oauth-access";
+export declare const OAUTH_REFRESH_DOMAIN = "oauth-refresh";
+export type OAuthTokenDomain = typeof OAUTH_CODE_DOMAIN | typeof OAUTH_ACCESS_DOMAIN | typeof OAUTH_REFRESH_DOMAIN;
+/**
+ * 120 seconds, and deliberately not an environment variable.
+ *
+ * The OAuth 2.1 draft caps the code at ten minutes and the security BCP
+ * recommends about sixty seconds. Every legitimate redemption is a back-channel
+ * POST made within a second of the redirect — but Claude's hosted callback puts
+ * a third-party server-side hop in the middle whose latency we do not control,
+ * and a code that is a little too short reads as a compliance bug and gets
+ * debugged as one. Two minutes doubles the BCP's number and stays an order of
+ * magnitude under the ceiling.
+ *
+ * It is not configuration because no application legitimately wants a longer
+ * window, and a code TTL is exactly the number that gets raised to "fix" an
+ * unrelated bug. The service option below exists so tests can force expiry
+ * without waiting; it is not wired to any `env` entry.
+ */
+export declare const AUTHORIZATION_CODE_TTL_SECONDS = 120;
+/** A freshly minted credential: the raw value, and where it now lives. */
+export interface MintedToken {
+    /** The value handed to the client. Never stored, never logged. */
+    token: string;
+    /** `"<publicId>|<sha256>"` — the `user_identities.key` that was written. */
+    identityKey: string;
+    clientPublicId: string;
+    domain: OAuthTokenDomain;
+    identity: StoredIdentity;
+    /** `createdAt + ttl`, computed for the caller's `expires_in`. */
+    expiresAt: Date;
+}
+/** A presented token that resolved to a live row. */
+export interface ResolvedToken {
+    userId: number;
+    clientPublicId: string;
+    identityKey: string;
+    identity: StoredIdentity;
+    expiresAt: Date;
+}
+export interface TokenServiceOptions {
+    identityStore: IdentityStore;
+    /** Seconds. Clamped at construction; see `clampTtlSeconds`. */
+    accessTokenTtlSeconds: number;
+    /** Seconds. Clamped at construction. Sliding, by way of rotation. */
+    refreshTokenTtlSeconds: number;
+    /**
+     * Seconds. Defaults to `AUTHORIZATION_CODE_TTL_SECONDS`; a test sets it to
+     * zero to force expiry rather than sleeping for two minutes.
+     */
+    authorizationCodeTtlSeconds?: number;
+    /**
+     * Rows per page in the client-wide identity scan. Defaults to cap-users'
+     * own page size.
+     *
+     * The seam exists so a test can prove the scan keeps reading past the end of
+     * a page without standing up a hundred users; no `env` entry sets it.
+     */
+    clientScanPageSize?: number;
+    /** Injectable clock, so expiry tests do not sleep. */
+    now?: () => Date;
+    /** Where a clamp is announced. Once, at construction. */
+    warn?(message: string): void;
+}
+export interface TokenService {
+    /** `<publicId>.<random>`. Exposed for tests and for the format's own tests. */
+    formatToken(clientPublicId: string, secret: string): string;
+    /** Split on the first `.`, or answer that this is not one of our tokens. */
+    parseToken(raw: string): {
+        clientPublicId: string;
+        secret: string;
+    } | null;
+    /** `"<publicId>|<sha256 of the whole token>"`. */
+    identityKeyFor(raw: string): string | null;
+    /** Seconds this species of token lives for. Read once, at construction. */
+    ttlSecondsFor(domain: OAuthTokenDomain): number;
+    /** Mint, hash, and write the identity row. */
+    mint(userId: number, domain: OAuthTokenDomain, clientPublicId: string): Promise<MintedToken>;
+    /**
+     * Resolve a presented token, applying the expiry rule and sweeping an expired
+     * row's `endedAt` on the way past. `null` means "not a live credential" for
+     * every reason: malformed, unknown, revoked, or expired.
+     */
+    resolve(domain: OAuthTokenDomain, raw: string): Promise<ResolvedToken | null>;
+    /** End-date a token's row by its raw value. Idempotent enough to retry. */
+    revoke(domain: OAuthTokenDomain, raw: string): Promise<void>;
+    /** End-date a token's row by its stored key — the revocation path's shape. */
+    revokeByKey(domain: OAuthTokenDomain, identityKey: string): Promise<void>;
+    /**
+     * Every live token row this user holds for this client, across both token
+     * domains. The enumeration revocation needs, since `endDate` is keyed on
+     * `(domain, key)` and cannot take a predicate.
+     */
+    findTokensForClient(userId: number, clientPublicId: string): Promise<StoredIdentity[]>;
+    /**
+     * End-date every live access and refresh row this user holds for this client,
+     * and answer with the rows that were ended.
+     *
+     * The revocation half of `findTokensForClient`. It lives here rather than in a
+     * caller because the `"<publicId>|"` key prefix and the two token domains are
+     * this file's knowledge — a caller that reproduced the prefix scan would be
+     * the second place that has to be right about the wire format, and a prefix
+     * one character too short is exactly the bug that ends one user's *other*
+     * connections.
+     */
+    revokeTokensForClient(userId: number, clientPublicId: string): Promise<StoredIdentity[]>;
+    /**
+     * Every user this client ever held a token for — the enumeration behind
+     * client-wide revocation, and the reason the wire format puts the client
+     * first.
+     *
+     * **Ended rows count.** An idle connection whose access and refresh rows have
+     * both been swept by the expiry rule is still a live grant and still a person
+     * who has this client connected; reading live rows only would answer that
+     * nobody uses a client half the deployment uses. The rows are never deleted,
+     * so "ever issued a token" is the honest question to ask of them, and the
+     * grant record — read by the caller, per user — is what decides whether there
+     * is anything left to revoke.
+     *
+     * It is the caller's job to do something with the answer, not this file's: a
+     * user id here means a token was minted once, nothing more.
+     */
+    findUserIdsForClient(clientPublicId: string): Promise<number[]>;
+}
+/** The key half of the wire format, kept next to the token half. */
+export declare function buildIdentityKey(clientPublicId: string, rawToken: string): string;
+export declare function createTokenService(options: TokenServiceOptions): TokenService;
+//# sourceMappingURL=token-service.d.ts.map

package/dist/token-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-service.d.ts","sourceRoot":"","sources":["../src/token-service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAC9C,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAClD,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AAEpD,MAAM,MAAM,gBAAgB,GACxB,OAAO,iBAAiB,GACxB,OAAO,mBAAmB,GAC1B,OAAO,oBAAoB,CAAC;AAShC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,iEAAiE;IACjE,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,aAAa,CAAC;IAC7B,+DAA+D;IAC/D,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,yDAAyD;IACzD,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5D,4EAA4E;IAC5E,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,kDAAkD;IAClD,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3C,2EAA2E;IAC3E,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAChD,8CAA8C;IAC9C,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7F;;;;OAIG;IACH,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC9E,2EAA2E;IAC3E,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,8EAA8E;IAC9E,WAAW,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E;;;;OAIG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACvF;;;;;;;;;;OAUG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACzF;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACjE;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAwM7E"}

package/dist/token-service.js

@@ -0,0 +1,251 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTHORIZATION_CODE_TTL_SECONDS = exports.OAUTH_REFRESH_DOMAIN = exports.OAUTH_ACCESS_DOMAIN = exports.OAUTH_CODE_DOMAIN = void 0;
+exports.buildIdentityKey = buildIdentityKey;
+exports.createTokenService = createTokenService;
+const cap_users_1 = require("@boopkit/cap-users");
+const config_js_1 = require("./config.js");
+const public_id_js_1 = require("./public-id.js");
+/**
+ * Minting, parsing and resolving the three OAuth credentials.
+ *
+ * ## The wire format, and why it has a prefix at all
+ *
+ * `<client publicId>.<generateToken(partition)>`. Splitting on the **first**
+ * `.` yields the client that the token was issued to before any database is
+ * touched, which is what makes client-wide revocation a key-prefix scan
+ * (`key LIKE '<publicId>|%'`) instead of a full table walk. `publicId` is
+ * twelve lowercase base36 characters precisely so that neither separator can
+ * appear in it — see `public-id.ts`.
+ *
+ * The stored identity key is `"<publicId>|<sha256 of the whole token>"`. The
+ * raw token is never stored anywhere, in either half of the two-read model:
+ * `tests/packages/cap-oauth-server-credentials-at-rest.test.ts` runs a complete
+ * flow and reads both property rows back to prove it.
+ *
+ * ## Expiry is `createdAt + ttl`, and the sweep is not an optimisation
+ *
+ * The plan corrects both the spec and the findings here, and the correction is
+ * the load-bearing part of this file. cap-users' `endedAt` is a **tombstone,
+ * not a scheduled expiry**: `findByDomainAndKey` returns `null` whenever
+ * `endedAt !== null`, so a *future* `endedAt` would read as already ended, and
+ * `endDate(domain, key)` takes no timestamp and always writes `new Date()`.
+ * A token's lifetime therefore has no home on the identity row.
+ *
+ * So a token is expired when `identity.createdAt + ttl < now`, where the TTL is
+ * configuration. That comparison is retroactive — it changes its answer for
+ * every existing row the moment the configuration changes — which is why
+ * `resolve` **writes `endedAt` on the first expired read**. Without that write,
+ * lengthening `OAUTH_ACCESS_TOKEN_TTL_SECONDS` would resurrect every token that
+ * had expired but whose row nobody had happened to look at. With it, the row is
+ * permanently dead the first time anybody notices, whatever the configuration
+ * does afterwards.
+ *
+ * Rotation then gives the refresh token a sliding window for free: each
+ * rotation mints a new row with a fresh `createdAt`, so a connector in daily use
+ * never expires and an abandoned one does.
+ *
+ * ## The authorization code is not governed by this rule
+ *
+ * Its `oauth-codes` property entry carries an explicit `expires_at` and that
+ * field stays the authority. The 120 seconds below is what writes it.
+ */
+/** The three identity domains the settled data model fixes. */
+exports.OAUTH_CODE_DOMAIN = 'oauth-code';
+exports.OAUTH_ACCESS_DOMAIN = 'oauth-access';
+exports.OAUTH_REFRESH_DOMAIN = 'oauth-refresh';
+/** `generateToken`'s partition segment, one per credential species. */
+const PARTITION = {
+    [exports.OAUTH_CODE_DOMAIN]: 'AC',
+    [exports.OAUTH_ACCESS_DOMAIN]: 'AT',
+    [exports.OAUTH_REFRESH_DOMAIN]: 'RT',
+};
+/**
+ * 120 seconds, and deliberately not an environment variable.
+ *
+ * The OAuth 2.1 draft caps the code at ten minutes and the security BCP
+ * recommends about sixty seconds. Every legitimate redemption is a back-channel
+ * POST made within a second of the redirect — but Claude's hosted callback puts
+ * a third-party server-side hop in the middle whose latency we do not control,
+ * and a code that is a little too short reads as a compliance bug and gets
+ * debugged as one. Two minutes doubles the BCP's number and stays an order of
+ * magnitude under the ceiling.
+ *
+ * It is not configuration because no application legitimately wants a longer
+ * window, and a code TTL is exactly the number that gets raised to "fix" an
+ * unrelated bug. The service option below exists so tests can force expiry
+ * without waiting; it is not wired to any `env` entry.
+ */
+exports.AUTHORIZATION_CODE_TTL_SECONDS = 120;
+/** The key half of the wire format, kept next to the token half. */
+function buildIdentityKey(clientPublicId, rawToken) {
+    return `${clientPublicId}|${(0, cap_users_1.hashToken)(rawToken)}`;
+}
+function createTokenService(options) {
+    const { identityStore, clientScanPageSize } = options;
+    const now = options.now ?? (() => new Date());
+    const warn = options.warn ?? ((message) => console.warn(`[cap-oauth-server] ${message}`));
+    // Read once, here, rather than per request: a running process must have one
+    // answer, and a clamp that fires per request is a log line nobody reads.
+    const ttlSeconds = {
+        [exports.OAUTH_ACCESS_DOMAIN]: (0, config_js_1.clampTtlSeconds)(options.accessTokenTtlSeconds, config_js_1.ACCESS_TOKEN_TTL_BOUNDS, 'OAUTH_ACCESS_TOKEN_TTL_SECONDS', warn),
+        [exports.OAUTH_REFRESH_DOMAIN]: (0, config_js_1.clampTtlSeconds)(options.refreshTokenTtlSeconds, config_js_1.REFRESH_TOKEN_TTL_BOUNDS, 'OAUTH_REFRESH_TOKEN_TTL_SECONDS', warn),
+        // Not clamped and not configurable — see the constant's note. The option is
+        // the test seam, and a test that asks for zero means zero.
+        [exports.OAUTH_CODE_DOMAIN]: options.authorizationCodeTtlSeconds ?? exports.AUTHORIZATION_CODE_TTL_SECONDS,
+    };
+    function formatToken(clientPublicId, secret) {
+        return `${clientPublicId}.${secret}`;
+    }
+    function parseToken(raw) {
+        if (typeof raw !== 'string')
+            return null;
+        // The FIRST dot. `generateToken` produces hyphens, never dots, so today
+        // there is only one — but splitting on the last would turn a future format
+        // change into a silent misparse rather than a loud one.
+        const dot = raw.indexOf('.');
+        if (dot <= 0)
+            return null;
+        const clientPublicId = raw.slice(0, dot);
+        const secret = raw.slice(dot + 1);
+        // A prefix that is not a well-formed publicId cannot be one of ours, and
+        // rejecting it here keeps a hostile prefix out of the `LIKE` scan revocation
+        // is built on.
+        if (!(0, public_id_js_1.isValidClientPublicId)(clientPublicId))
+            return null;
+        if (secret === '')
+            return null;
+        return { clientPublicId, secret };
+    }
+    function identityKeyFor(raw) {
+        const parsed = parseToken(raw);
+        if (!parsed)
+            return null;
+        return buildIdentityKey(parsed.clientPublicId, raw);
+    }
+    function expiryOf(domain, createdAt) {
+        return new Date(createdAt.getTime() + ttlSeconds[domain] * 1000);
+    }
+    /**
+     * Every live token row this user holds for this client.
+     *
+     * The prefix is `"<publicId>|"` with the separator, never the bare publicId:
+     * publicIds are fixed-length so no one is a prefix of another today, but a
+     * scan that leaned on that would end a different client's tokens the moment
+     * the length ever changed.
+     */
+    async function findTokensForClient(userId, clientPublicId) {
+        const prefix = `${clientPublicId}|`;
+        const rows = await identityStore.findAllByUser(userId);
+        return rows.filter((row) => (row.domain === exports.OAUTH_ACCESS_DOMAIN || row.domain === exports.OAUTH_REFRESH_DOMAIN) &&
+            row.key.startsWith(prefix));
+    }
+    /**
+     * Every user id with a token row under this client's prefix, ended or not.
+     *
+     * Paged, and deliberately: this is the one read here that is bounded by a
+     * client rather than by a person, so a deployment's whole token history for a
+     * popular client can sit behind it.
+     */
+    async function findUserIdsForClient(clientPublicId) {
+        // The same guard `parseToken` applies to a presented token, for the same
+        // reason: this value is about to anchor a `LIKE` scan across the identity
+        // table, and a value that was never one of our public ids has no business
+        // being what it is anchored on.
+        if (!(0, public_id_js_1.isValidClientPublicId)(clientPublicId)) {
+            throw new TypeError(`Unable to find the users of client "${clientPublicId}": that is not a well-formed client public id. ` +
+                'Pass the twelve-character publicId from the client registry, not the client_id URL.');
+        }
+        const prefix = `${clientPublicId}|`;
+        const userIds = new Set();
+        // Both token domains, because a row in either is proof this client reached
+        // this person, and neither domain is guaranteed to still hold one.
+        for (const domain of [exports.OAUTH_ACCESS_DOMAIN, exports.OAUTH_REFRESH_DOMAIN]) {
+            let after;
+            for (;;) {
+                const page = await identityStore.findAllByDomainAndKeyPrefix(domain, prefix, {
+                    includeEnded: true,
+                    limit: clientScanPageSize,
+                    after,
+                });
+                for (const row of page.identities) {
+                    userIds.add(row.userId);
+                }
+                if (page.nextCursor == null)
+                    break;
+                after = page.nextCursor;
+            }
+        }
+        return [...userIds];
+    }
+    return {
+        formatToken,
+        parseToken,
+        identityKeyFor,
+        ttlSecondsFor(domain) {
+            return ttlSeconds[domain];
+        },
+        async mint(userId, domain, clientPublicId) {
+            const token = formatToken(clientPublicId, (0, cap_users_1.generateToken)(PARTITION[domain]));
+            const identityKey = buildIdentityKey(clientPublicId, token);
+            const identity = await identityStore.create(userId, domain, identityKey);
+            return {
+                token,
+                identityKey,
+                clientPublicId,
+                domain,
+                identity,
+                expiresAt: expiryOf(domain, identity.createdAt),
+            };
+        },
+        async resolve(domain, raw) {
+            const parsed = parseToken(raw);
+            if (!parsed)
+                return null;
+            const identityKey = buildIdentityKey(parsed.clientPublicId, raw);
+            const identity = await identityStore.findByDomainAndKey(domain, identityKey);
+            // Active-only, so this covers revoked as well as unknown. Nothing here
+            // distinguishes the two for the caller, and nothing should: telling a
+            // client which of the two it hit is telling it whether the token was ever
+            // real.
+            if (!identity)
+                return null;
+            const expiresAt = expiryOf(domain, identity.createdAt);
+            if (expiresAt.getTime() < now().getTime()) {
+                // The sweep. Correctness, not housekeeping — see the header.
+                await identityStore.endDate(domain, identityKey);
+                return null;
+            }
+            return {
+                userId: identity.userId,
+                clientPublicId: parsed.clientPublicId,
+                identityKey,
+                identity,
+                expiresAt,
+            };
+        },
+        async revoke(domain, raw) {
+            const identityKey = identityKeyFor(raw);
+            if (!identityKey)
+                return;
+            await identityStore.endDate(domain, identityKey);
+        },
+        async revokeByKey(domain, identityKey) {
+            await identityStore.endDate(domain, identityKey);
+        },
+        findTokensForClient,
+        findUserIdsForClient,
+        async revokeTokensForClient(userId, clientPublicId) {
+            // Active rows only, so an already-ended row keeps the `endedAt` it has
+            // rather than being restamped with this moment. It also means this sweeps
+            // the rows rotation left behind: a superseded refresh row stays active on
+            // purpose, and so does the access token from before the last refresh.
+            const rows = await findTokensForClient(userId, clientPublicId);
+            for (const row of rows) {
+                await identityStore.endDate(row.domain, row.key);
+            }
+            return rows;
+        },
+    };
+}
+//# sourceMappingURL=token-service.js.map