@boopkit/cap-oauth-server 0.1.0

package/dist/bearer.js

@@ -0,0 +1,150 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_BEARER_CHALLENGE = void 0;
+exports.createOAuthTokenResolver = createOAuthTokenResolver;
+exports.createOAuthBearerMiddleware = createOAuthBearerMiddleware;
+exports.missingScopes = missingScopes;
+exports.requireOAuth = requireOAuth;
+exports.createOAuthResourceServer = createOAuthResourceServer;
+const cap_users_1 = require("@boopkit/cap-users");
+require("./express.js");
+const token_service_js_1 = require("./token-service.js");
+/**
+ * The lookup itself, exported so it can be tested without a request.
+ *
+ * Returns `null` for every reason a token is not usable — malformed, unknown,
+ * revoked, expired, or belonging to a grant that has been ended. The caller
+ * cannot tell them apart, and should not: the difference is only interesting to
+ * whoever stole the token.
+ */
+function createOAuthTokenResolver(options) {
+    const { tokenService, grantService, findUserById } = options;
+    return async function resolveOAuthToken(token) {
+        const resolved = await tokenService.resolve(token_service_js_1.OAUTH_ACCESS_DOMAIN, token);
+        if (!resolved)
+            return null;
+        const grant = await grantService.findActive(resolved.userId, resolved.clientPublicId);
+        if (!grant)
+            return null;
+        const user = await findUserById(resolved.userId);
+        if (!user)
+            return null;
+        return { user, grant, clientPublicId: resolved.clientPublicId };
+    };
+}
+/**
+ * The middleware an application mounts.
+ *
+ * cap-users' factory takes the lookup as a plain callback with no request in
+ * its signature — deliberately, since resolving a credential has no business
+ * reading one. But this capability has to hand the resolved grant to the
+ * handlers downstream, and the closure is the only place the two can meet, so
+ * the binding is made per request. That is a closure allocation, not work; the
+ * three reads inside it are the cost of the request either way.
+ */
+function createOAuthBearerMiddleware(deps, options) {
+    const resolveOAuthToken = createOAuthTokenResolver(options);
+    const challenge = options.challenge ?? 'Bearer';
+    return function oauthBearer(req, res, next) {
+        // Hand the challenge forward to whatever gate runs behind this. Written
+        // unconditionally, before any lookup, because the gate's 401 is for the
+        // caller who presented nothing at all — the path on which the resolver
+        // itself never refuses anybody.
+        req.oauthChallenge = challenge;
+        const middleware = (0, cap_users_1.createBearerMiddleware)(deps, {
+            strategy: 'oauth',
+            challenge,
+            resolve: async (token) => {
+                const resolved = await resolveOAuthToken(token);
+                if (!resolved)
+                    return null;
+                req.oauthGrant = resolved.grant;
+                return { user: resolved.user };
+            },
+        });
+        middleware(req, res, next);
+    };
+}
+/** The challenge sent when the request carried no usable OAuth token at all. */
+exports.DEFAULT_BEARER_CHALLENGE = 'Bearer';
+/**
+ * Which of the required scopes this grant does not cover.
+ *
+ * Set membership, so the comparison does not depend on the order either list
+ * happens to be in — a grant approved as `email profile` covers a route that
+ * asks for `profile email`. Duplicates in the requirement collapse, so the
+ * answer is stable enough to put in a header.
+ */
+function missingScopes(granted, required) {
+    const held = new Set(granted);
+    return [...new Set(required)].filter((scope) => !held.has(scope));
+}
+/**
+ * Quote a value we are about to place inside a `WWW-Authenticate` parameter.
+ *
+ * Scope names reach here from a route definition rather than from a request, so
+ * this is not defending against an attacker. It is defending against a header
+ * that silently stops parsing at a stray quote, which is the kind of fault that
+ * shows up as "the client ignores our error" three weeks later.
+ */
+function headerSafe(value) {
+    return value.replace(/[\\"]/g, '');
+}
+/**
+ * `requireOAuth(...scopes)` — the resource-server gate.
+ *
+ * The request must have arrived on an OAuth access token backed by a live
+ * grant, and that grant must cover every named scope. Both refusals are RFC
+ * 6750:
+ *
+ *   - **401** with `WWW-Authenticate: <challenge>` when there is no usable
+ *     token. The challenge is the resolver's — see the file header — so it
+ *     carries RFC 9728's `resource_metadata` pointer and an unauthenticated
+ *     caller can find its way to the document that says where to go. Claude
+ *     does not honour that header on a 200, so the 401 is the only place it can
+ *     arrive.
+ *   - **403** with `error="insufficient_scope"` and the required `scope`, in
+ *     the header per §3.1 and in the body so a client that reads JSON errors
+ *     rather than headers gets the same answer.
+ *
+ * The **grant** is the authority, not the token: a token minted under a wider
+ * consent is bound by a narrowed grant on its very next request, with no
+ * revocation involved.
+ *
+ * Mount it behind `resolveBearer`. `createOAuthResourceServer` pairs the two so
+ * an application cannot mount one without the other.
+ */
+function requireOAuth(...requiredScopes) {
+    const required = [...new Set(requiredScopes)];
+    return function oauthGate(req, res, next) {
+        const challenge = req.oauthChallenge ?? exports.DEFAULT_BEARER_CHALLENGE;
+        const grant = req.oauthGrant;
+        if (req.authStrategy !== 'oauth' || !grant) {
+            res.set('WWW-Authenticate', challenge).status(401).json({
+                error: 'invalid_token',
+                error_description: 'a valid OAuth access token is required',
+            });
+            return;
+        }
+        const missing = missingScopes(grant.scopes, required);
+        if (missing.length > 0) {
+            const scope = required.join(' ');
+            const description = `this connection was not approved for: ${missing.join(' ')}`;
+            res
+                .set('WWW-Authenticate', `${challenge}, error="insufficient_scope", ` +
+                `error_description="${headerSafe(description)}", scope="${headerSafe(scope)}"`)
+                .status(403)
+                .json({ error: 'insufficient_scope', error_description: description, scope });
+            return;
+        }
+        next();
+    };
+}
+function createOAuthResourceServer(deps, options) {
+    const challenge = options.challenge ?? exports.DEFAULT_BEARER_CHALLENGE;
+    return {
+        resolveBearer: createOAuthBearerMiddleware(deps, { ...options, challenge }),
+        requireOAuth,
+    };
+}
+//# sourceMappingURL=bearer.js.map

package/dist/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../src/bearer.ts"],"names":[],"mappings":";;;AAgFA,4DAiBC;AAYD,kEA2BC;AAaD,sCAGC;AAsCD,oCAgCC;AAyBD,8DASC;AA/PD,kDAA4D;AAG5D,wBAAsB;AAEtB,yDAA4E;AAkE5E;;;;;;;GAOG;AACH,SAAgB,wBAAwB,CACtC,OAA2B;IAE3B,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAE7D,OAAO,KAAK,UAAU,iBAAiB,CAAC,KAAK;QAC3C,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,sCAAmB,EAAE,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;IAClE,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,2BAA2B,CACzC,IAAwB,EACxB,OAA2B;IAE3B,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAEhD,OAAO,SAAS,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,gCAAgC;QAChC,GAAG,CAAC,cAAc,GAAG,SAAS,CAAC;QAE/B,MAAM,UAAU,GAAG,IAAA,kCAAsB,EAAC,IAAI,EAAE;YAC9C,QAAQ,EAAE,OAAO;YACjB,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACvB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAChD,IAAI,CAAC,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAC3B,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC;gBAChC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;YACjC,CAAC;SACF,CAAC,CAAC;QAEH,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AACnE,QAAA,wBAAwB,GAAG,QAAQ,CAAC;AAEjD;;;;;;;GAOG;AACH,SAAgB,aAAa,CAAC,OAA0B,EAAE,QAA2B;IACnF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAgB,YAAY,CAAC,GAAG,cAAwB;IACtD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAE9C,OAAO,SAAS,SAAS,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACvE,MAAM,SAAS,GAAG,GAAG,CAAC,cAAc,IAAI,gCAAwB,CAAC;QACjE,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;QAE7B,IAAI,GAAG,CAAC,YAAY,KAAK,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3C,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACtD,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,wCAAwC;aAC5D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,yCAAyC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjF,GAAG;iBACA,GAAG,CACF,kBAAkB,EAClB,GAAG,SAAS,gCAAgC;gBAC1C,sBAAsB,UAAU,CAAC,WAAW,CAAC,aAAa,UAAU,CAAC,KAAK,CAAC,GAAG,CACjF;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAyBD,SAAgB,yBAAyB,CACvC,IAAwB,EACxB,OAA2B;IAE3B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gCAAwB,CAAC;IAChE,OAAO;QACL,aAAa,EAAE,2BAA2B,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC;QAC3E,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/body-field.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Reading one string field off a body that arrived as a form or as JSON.
+ *
+ * ## Why this is a module rather than a helper in each controller
+ *
+ * Two endpoints — `POST /oauth/token` and `POST /oauth/revoke` — mount both
+ * body parsers and accept either encoding, for the reason the token
+ * controller's header gives: the specification says form, and real clients send
+ * JSON. Both therefore need the same answer to one awkward question, which is
+ * what counts as *present*.
+ *
+ * That answer is not obvious and it is not the same as truthiness. A form body
+ * turns an omitted field into `""` rather than into `undefined`, and Express
+ * hands back an **array** when a field is repeated — `token=a&token=b` arrives
+ * as `['a', 'b']`, which a naive read would pass along to a database query as
+ * an object. So: only a `string` counts, it is trimmed, and an empty result is
+ * absence. A second copy of that rule is a second place that has to be right
+ * about it, and the copy that drifts is the one that lets an array through.
+ */
+/** A single string off a body Express may have handed us an array for. */
+export declare function field(body: unknown, name: string): string | undefined;
+/** The same, refusing with RFC 6749 §5.2's `invalid_request` when absent. */
+export declare function required(body: unknown, name: string): string;
+//# sourceMappingURL=body-field.d.ts.map

package/dist/body-field.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-field.d.ts","sourceRoot":"","sources":["../src/body-field.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,0EAA0E;AAC1E,wBAAgB,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMrE;AAED,6EAA6E;AAC7E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAM5D"}

package/dist/body-field.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.field = field;
+exports.required = required;
+const oauth_error_js_1 = require("./oauth-error.js");
+/**
+ * Reading one string field off a body that arrived as a form or as JSON.
+ *
+ * ## Why this is a module rather than a helper in each controller
+ *
+ * Two endpoints — `POST /oauth/token` and `POST /oauth/revoke` — mount both
+ * body parsers and accept either encoding, for the reason the token
+ * controller's header gives: the specification says form, and real clients send
+ * JSON. Both therefore need the same answer to one awkward question, which is
+ * what counts as *present*.
+ *
+ * That answer is not obvious and it is not the same as truthiness. A form body
+ * turns an omitted field into `""` rather than into `undefined`, and Express
+ * hands back an **array** when a field is repeated — `token=a&token=b` arrives
+ * as `['a', 'b']`, which a naive read would pass along to a database query as
+ * an object. So: only a `string` counts, it is trimmed, and an empty result is
+ * absence. A second copy of that rule is a second place that has to be right
+ * about it, and the copy that drifts is the one that lets an array through.
+ */
+/** A single string off a body Express may have handed us an array for. */
+function field(body, name) {
+    if (typeof body !== 'object' || body === null)
+        return undefined;
+    const value = body[name];
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed === '' ? undefined : trimmed;
+}
+/** The same, refusing with RFC 6749 §5.2's `invalid_request` when absent. */
+function required(body, name) {
+    const value = field(body, name);
+    if (value === undefined) {
+        throw new oauth_error_js_1.OAuthError('invalid_request', `${name} is required`);
+    }
+    return value;
+}
+//# sourceMappingURL=body-field.js.map

package/dist/body-field.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-field.js","sourceRoot":"","sources":["../src/body-field.ts"],"names":[],"mappings":";;AAuBA,sBAMC;AAGD,4BAMC;AAtCD,qDAA8C;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AAEH,0EAA0E;AAC1E,SAAgB,KAAK,CAAC,IAAa,EAAE,IAAY;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,KAAK,GAAI,IAAgC,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9C,CAAC;AAED,6EAA6E;AAC7E,SAAgB,QAAQ,CAAC,IAAa,EAAE,IAAY;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,2BAAU,CAAC,iBAAiB,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/client-registry-service.d.ts

@@ -0,0 +1,120 @@
+import { type FetchLike } from './metadata-document.js';
+import type { ClientMetadataInput, OauthClient, OauthClientDelegate, StaticClientInput } from './types.js';
+/**
+ * The client registry — who is asking, and what they are allowed to ask for.
+ *
+ * One table, one lookup path, three registration modes. A mode says where a
+ * client's *authoritative* metadata lives, and almost nothing else:
+ *
+ *   `dynamic`            open RFC 7591 registration; we own the metadata
+ *   `metadata_document`  the `client_id` is an https URL; the client owns it
+ *   `static`             an operator wrote the row; only an operator changes it
+ *
+ * ## What is not here
+ *
+ * Nothing user- or account-shaped. A client is software; the record tying a
+ * client to a *person* is the grant, which lives in cap-users' user properties
+ * and belongs to Slice 2. The registry never learns who consented.
+ *
+ * ## The abuse controls, and why they are fresh work
+ *
+ * Neither donor has an unauthenticated registration endpoint. Paywalls'
+ * `/oauth/register` requires a caller of user type `service-user` and creates a
+ * row owned by that caller's account; open registration has no caller and no
+ * account, so the gate that made paywalls' endpoint safe has nothing to map
+ * onto. What replaces it is here and in `createRegistrationRateLimiter`:
+ * `redirect_uris` required and validated at registration, a ceiling on total
+ * rows, per-IP rate limiting at the transport, and a prune for rows that never
+ * went anywhere.
+ */
+/** Sensible RFC 7591 defaults for a client that asked for nothing specific. */
+export declare const DEFAULT_GRANT_TYPES: string[];
+export declare const DEFAULT_RESPONSE_TYPES: string[];
+/** 24 hours. A cached metadata document older than this is re-fetched lazily. */
+export declare const DEFAULT_METADATA_MAX_AGE_MS: number;
+/** 30 days, per the plan: a dynamic row that never went anywhere is garbage. */
+export declare const DEFAULT_ABANDONED_CLIENT_TTL_MS: number;
+/** How many rows open registration may create before it starts refusing. */
+export declare const DEFAULT_MAX_REGISTERED_CLIENTS = 1000;
+export interface ClientRegistryServiceOptions {
+    /**
+     * The HTTP boundary for metadata documents. Required only if
+     * `metadata_document` clients are in play; a registry that never sees one
+     * never calls it.
+     */
+    fetch?: FetchLike;
+    /** Ceiling on `dynamic` rows. `Infinity` disables the check. */
+    maxRegisteredClients?: number;
+    /** Cache age past which a metadata document is re-fetched. */
+    metadataMaxAgeMs?: number;
+    metadataTimeoutMs?: number;
+    metadataMaxBytes?: number;
+    metadataMaxRedirects?: number;
+    /** Scopes a client may be granted, if it named none. */
+    defaultScopes?: string[];
+    /** Injectable clock, so expiry and cache-age tests do not sleep. */
+    now?: () => Date;
+    /** Called when a re-fetch fails and the cached copy is used instead. */
+    onMetadataRefreshFailed?(clientId: string, err: unknown): void;
+}
+export interface PruneOptions {
+    /** Delete abandoned `dynamic` rows created before this instant. */
+    before?: Date;
+    /**
+     * Is this row still in use?
+     *
+     * Slice 1 has no grants, so the default answer is "no" and the prune is safe
+     * to run only against a registry whose clients have not connected yet.
+     * Slice 3 owns grants and injects the real predicate; until it does, the
+     * scaffold does not schedule this.
+     */
+    isInUse?(client: OauthClient): Promise<boolean>;
+}
+export interface ClientRegistryService {
+    /** RFC 7591 open registration. Generates the `publicId` and the `client_id`. */
+    registerDynamic(input: ClientMetadataInput): Promise<OauthClient>;
+    /**
+     * Resolve a Client ID Metadata Document client, fetching and caching the
+     * document on first sight and lazily re-fetching a stale copy.
+     */
+    resolveMetadataDocument(clientId: string): Promise<OauthClient>;
+    /** Operator-configured client. Idempotent, so a seed script may re-run. */
+    registerStaticClient(input: StaticClientInput): Promise<OauthClient>;
+    /**
+     * The authorization endpoint's lookup: a raw `client_id` string off a query
+     * parameter, which for a CIMD client is a URL.
+     */
+    findByClientId(clientId: string): Promise<OauthClient | null>;
+    /** Lookup by the token prefix, for the resource-server path. */
+    findByPublicId(publicId: string): Promise<OauthClient | null>;
+    /** Suspend without deleting a row that live tokens carry the prefix of. */
+    suspend(clientId: string): Promise<OauthClient>;
+    /** Re-enable a suspended client. */
+    unsuspend(clientId: string): Promise<OauthClient>;
+    /** Registration-surface update. Refuses a `static` row. */
+    updateRegistration(clientId: string, input: ClientMetadataInput): Promise<OauthClient>;
+    /** Registration-surface delete. Refuses a `static` row. */
+    deleteRegistration(clientId: string): Promise<void>;
+    /** How many rows the ceiling counts. */
+    countRegistered(): Promise<number>;
+    /** Garbage-collect abandoned dynamic rows. Returns the client ids removed. */
+    pruneAbandonedClients(options?: PruneOptions): Promise<string[]>;
+}
+/**
+ * The redirect-URI rule at *registration*, which is the other half of
+ * `matchRedirectUri`. The matcher decides whether a presented URI satisfies a
+ * stored one; this decides whether a URI may be stored at all.
+ *
+ * Both halves read `classifyRedirectUri`, and that is the point: a URI this
+ * function stores is by construction a URI the matcher will compare. The three
+ * shapes it admits — claimed https, loopback http, and an application's own
+ * private-use scheme — and the grounds each is admitted or refused on live in
+ * `redirect-uri.ts` next to the matching rule they have to agree with.
+ *
+ * This is the umbrella spec's "declared-but-unenforced redirect URI lists"
+ * defect closed at the point of entry: a list that was never validated going in
+ * cannot be enforced coming out, whatever the matcher does.
+ */
+export declare function validateRedirectUris(value: unknown): string[];
+export declare function createClientRegistryService(model: OauthClientDelegate, options?: ClientRegistryServiceOptions): ClientRegistryService;
+//# sourceMappingURL=client-registry-service.d.ts.map

package/dist/client-registry-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-registry-service.d.ts","sourceRoot":"","sources":["../src/client-registry-service.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,SAAS,EACf,MAAM,wBAAwB,CAAC;AAGhC,OAAO,KAAK,EAEV,mBAAmB,EAEnB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,UAA0C,CAAC;AAC3E,eAAO,MAAM,sBAAsB,UAAW,CAAC;AAE/C,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,QAAsB,CAAC;AAE/D,gFAAgF;AAChF,eAAO,MAAM,+BAA+B,QAA2B,CAAC;AAExE,4EAA4E;AAC5E,eAAO,MAAM,8BAA8B,OAAQ,CAAC;AAEpD,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,gEAAgE;IAChE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wDAAwD;IACxD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,wEAAwE;IACxE,uBAAuB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC;CAChE;AAED,MAAM,WAAW,YAAY;IAC3B,mEAAmE;IACnE,MAAM,CAAC,EAAE,IAAI,CAAC;IACd;;;;;;;OAOG;IACH,OAAO,CAAC,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,eAAe,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClE;;;OAGG;IACH,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChE,2EAA2E;IAC3E,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrE;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D,gEAAgE;IAChE,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChD,oCAAoC;IACpC,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClD,2DAA2D;IAC3D,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACvF,2DAA2D;IAC3D,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,wCAAwC;IACxC,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,8EAA8E;IAC9E,qBAAqB,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAClE;AAYD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CA0B7D;AAsFD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,GAAE,4BAAiC,GACzC,qBAAqB,CAiPvB"}