@boopkit/cap-oauth-server 0.1.0

package/dist/redirect-uri.js

@@ -0,0 +1,249 @@
+"use strict";
+/**
+ * Redirect-URI policy: what may be registered, and what a registered entry
+ * accepts at the authorization endpoint.
+ *
+ * Both questions are answered from one classifier, `classifyRedirectUri`,
+ * because the two halves only work as a pair. A shape registration stores but
+ * the matcher will not parse is worse than a shape neither accepts: the client
+ * registers, believes it is connected, and then fails at the authorization
+ * endpoint with `redirect_uri is not registered`. Keeping the rule in one
+ * function is what makes that disagreement impossible rather than unlikely.
+ *
+ * ## The three shapes
+ *
+ * RFC 8252 (OAuth 2.0 for Native Apps) names exactly three ways a client may be
+ * called back, and this server accepts those three and nothing else:
+ *
+ *   `https`          an absolute https URL — §7.2, the claimed-https redirect
+ *                    a hosted connector such as Claude's web app uses.
+ *   `loopback-http`  `http` on `localhost` or `127.0.0.1` — §7.3, because a
+ *                    native app cannot terminate TLS on the loopback interface.
+ *   `private-use`    a hierarchical URI in an application's own scheme, such as
+ *                    `com.example.app:/oauth2redirect/cb` or
+ *                    `claude://oauth/callback` — §7.1, how a desktop or mobile
+ *                    app is handed the response by its operating system.
+ *
+ * ## The matching rule
+ *
+ * **Exact string match**, with exactly one exception: a registered
+ * `loopback-http` entry matches a presented URI that differs only in port. That
+ * is RFC 8252 §7.3, and it is what Claude Code's published Client ID Metadata
+ * Document requires — it binds an ephemeral loopback port at connect time, so
+ * the port it will present is not knowable at registration.
+ *
+ * The exception is scoped to `loopback-http` and not merely to a loopback
+ * *host*. A private-use scheme has no TCP port to be ephemeral: the operating
+ * system routes it by scheme name, so `myapp://localhost/cb` gets the plain
+ * exact rule even though its host happens to read as loopback.
+ *
+ * The exception lives here, in one function with its own test table, rather
+ * than being threaded through the authorization controller as a special case.
+ * A redirect-URI check that is spread across a controller is how the umbrella
+ * spec's "declared-but-unenforced redirect URI lists" defect happens: the list
+ * is stored, the comparison drifts, and nothing says so.
+ *
+ * Nothing here reads a database or a request. It compares two strings.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyRedirectUri = classifyRedirectUri;
+exports.matchRedirectUri = matchRedirectUri;
+exports.matchesAnyRedirectUri = matchesAnyRedirectUri;
+exports.isLoopbackHost = isLoopbackHost;
+/** Hosts RFC 8252 §7.3 lets a native app bind an ephemeral port on. */
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1']);
+/**
+ * Schemes a private-use redirect may not claim, on three separate grounds.
+ *
+ * **The WHATWG URL standard's "special" schemes** — `http`, `https`, `ws`,
+ * `wss`, `ftp`, `file`. These are network and filesystem locations rather than
+ * application callbacks, and `file:///etc/…` in particular parses into a
+ * perfectly well-formed hierarchical URL, so the hierarchy rule alone would
+ * admit it. `http` and `https` never reach this list today, because the branches
+ * above answer them first; they are named anyway so that reordering those
+ * branches cannot quietly re-offer `http://evil.example/cb` — a shape already
+ * refused as a non-loopback redirect — as a private-use URI.
+ *
+ * **Schemes whose payload is content or code rather than a location** —
+ * `javascript`, `vbscript`, `data`, `blob`, `about`, `filesystem`,
+ * `view-source`. A redirect URI is somewhere a browser is *sent*. Sending it to
+ * one of these runs script or renders attacker-supplied content in the
+ * response, which is the open-redirect defect with a cross-site scripting bug
+ * on top. The hierarchy rule below already refuses the usual spellings —
+ * `javascript:alert(1)` has an opaque path — but `javascript:/alert(1)` does
+ * not, and a security boundary should not rest on a URL-parsing detail.
+ *
+ * **Privileged browser origins** — `chrome`, `chrome-extension`,
+ * `moz-extension`, `resource`. Never a legitimate OAuth callback, and a
+ * redirect into one is a request to run inside a context this server has no
+ * business reaching.
+ */
+const RESERVED_SCHEMES = new Set([
+    // Special schemes (WHATWG URL).
+    'http',
+    'https',
+    'ws',
+    'wss',
+    'ftp',
+    'file',
+    // Content and code.
+    'javascript',
+    'vbscript',
+    'data',
+    'blob',
+    'about',
+    'filesystem',
+    'view-source',
+    // Privileged browser origins.
+    'chrome',
+    'chrome-extension',
+    'moz-extension',
+    'resource',
+]);
+const SHAPE_REASON = 'must be https, http on a loopback host, or a private-use scheme (RFC 8252 §7.1)';
+const HIERARCHY_REASON = 'uses a private-use scheme but is not a hierarchical URI, as in com.example.app:/callback';
+const refuse = (reason) => ({ accepted: false, reason });
+/**
+ * Is this URI hierarchical — does anything after the scheme start with `/`?
+ *
+ * This is the structural line between a redirect *location* and a URI whose
+ * body is an opaque payload. `claude://oauth/callback` and
+ * `com.example.app:/oauth2redirect/cb` are hierarchical;
+ * `urn:ietf:wg:oauth:2.0:oob`, `mailto:a@b.example` and `javascript:alert(1)`
+ * are not, and none of those names a place an operating system can deliver an
+ * authorization response to.
+ *
+ * Read off the serialized `href` rather than `pathname`, because a private-use
+ * URI may carry its target in the authority (`myapp://callback`, empty path) or
+ * in the path (`com.example.app:/callback`, empty host), and only the
+ * serialization sees both.
+ */
+function isHierarchical(url) {
+    return url.href.slice(url.protocol.length).startsWith('/');
+}
+/**
+ * Classify one redirect URI, or say why it is refused.
+ *
+ * The single source of the policy. `validateRedirectUris` in the client
+ * registry calls it to decide whether a URI may be **stored**; `matchRedirectUri`
+ * below calls it to decide whether a stored or presented URI may be
+ * **compared**.
+ */
+function classifyRedirectUri(value) {
+    if (typeof value !== 'string' || value === '')
+        return refuse('is not an absolute URI');
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return refuse('is not an absolute URI');
+    }
+    // RFC 6749 §3.1.2 forbids a fragment on a redirection endpoint, and the
+    // fragment is where an implicit-style authorization response's own parameters
+    // would land.
+    if (url.hash !== '')
+        return refuse('must not carry a fragment');
+    // `url.protocol` is `scheme:`, already lowercased and already known to match
+    // RFC 3986 scheme syntax — `new URL` would have thrown otherwise.
+    const scheme = url.protocol.slice(0, -1);
+    if (scheme === 'https') {
+        if (!url.hostname)
+            return refuse(SHAPE_REASON);
+        return { accepted: true, shape: 'https', url };
+    }
+    if (scheme === 'http') {
+        if (!isLoopbackHost(url.hostname))
+            return refuse(SHAPE_REASON);
+        return { accepted: true, shape: 'loopback-http', url };
+    }
+    // Everything remaining is a candidate private-use scheme (RFC 8252 §7.1).
+    // A one-character scheme is refused because `c:/Users/…` parses as scheme `c`
+    // with path `/Users/…`, and a Windows path is not a callback.
+    if (scheme.length < 2 || RESERVED_SCHEMES.has(scheme))
+        return refuse(SHAPE_REASON);
+    if (!isHierarchical(url))
+        return refuse(HIERARCHY_REASON);
+    // `claude://` parses, is hierarchical, and names nowhere at all.
+    if (!url.hostname && !url.pathname)
+        return refuse(HIERARCHY_REASON);
+    return { accepted: true, shape: 'private-use', url };
+}
+/**
+ * Parse, or refuse.
+ *
+ * A registry row that is not an acceptable redirect URI is a registration bug
+ * rather than a match question, and `matchRedirectUri` answers it the same way
+ * it answers a hostile input: no. Routing this through the same classifier
+ * registration uses means a row that should never have been written cannot be
+ * matched even by an exact string comparison, which is the case that would
+ * otherwise sail through the fast path below.
+ */
+function parse(value) {
+    const verdict = classifyRedirectUri(value);
+    return verdict.accepted ? { shape: verdict.shape, url: verdict.url } : undefined;
+}
+/**
+ * Does `presented` satisfy the registered entry `registered`?
+ *
+ * @param registered one entry from the client's `redirect_uris`
+ * @param presented  the `redirect_uri` the authorization request carried
+ */
+function matchRedirectUri(registered, presented) {
+    const registeredUri = parse(registered);
+    const presentedUri = parse(presented);
+    // Both must be acceptable redirect URIs before either the fast path or the
+    // exception applies. Checking this *before* the string comparison is
+    // deliberate: two identical strings that are not acceptable redirect URIs —
+    // `javascript:alert(1)` against itself, say — must not match, because a row
+    // like that should never have been written and matching it would hide the
+    // fact that it was.
+    if (!registeredUri || !presentedUri)
+        return false;
+    // The rule. Everything below is the one exception to it.
+    if (registered === presented)
+        return true;
+    // The exception is about an ephemeral *TCP port*, and a private-use scheme
+    // has none: the operating system routes it by scheme name. So
+    // `myapp://localhost/cb` is matched exactly, loopback-looking authority or
+    // not. Written as a refusal of the new shape rather than as a requirement of
+    // `loopback-http`, because keying it on `loopback-http` would also drop the
+    // relaxation `https://localhost/cb` gets today — a narrowing this change has
+    // no business making on its way past.
+    if (registeredUri.shape === 'private-use')
+        return false;
+    const registeredUrl = registeredUri.url;
+    const presentedUrl = presentedUri.url;
+    if (!isLoopbackHost(registeredUrl.hostname))
+        return false;
+    // The intent to use an ephemeral port is declared by the *registration*. A
+    // registration for a public host is not relaxed because the presented value
+    // happens to be a loopback address, so the hosts must agree — and `localhost`
+    // and `127.0.0.1` are two different hosts, since RFC 8252 relaxes the port
+    // rather than name resolution.
+    if (registeredUrl.hostname !== presentedUrl.hostname)
+        return false;
+    // Only the port may differ. Everything else is compared through the parsed
+    // URL rather than the raw string, because at this point the two strings are
+    // already known to differ and the port is what is allowed to account for it.
+    return (registeredUrl.protocol === presentedUrl.protocol &&
+        registeredUrl.username === presentedUrl.username &&
+        registeredUrl.password === presentedUrl.password &&
+        registeredUrl.pathname === presentedUrl.pathname &&
+        registeredUrl.search === presentedUrl.search &&
+        registeredUrl.hash === presentedUrl.hash);
+}
+/**
+ * Does any registered entry accept the presented URI?
+ *
+ * The authorization controller's actual question, kept next to the rule it is
+ * built from so a caller never has to write the loop itself.
+ */
+function matchesAnyRedirectUri(registered, presented) {
+    return registered.some((entry) => matchRedirectUri(entry, presented));
+}
+/** Is this host one the loopback exception applies to? */
+function isLoopbackHost(host) {
+    return LOOPBACK_HOSTS.has(host);
+}
+//# sourceMappingURL=redirect-uri.js.map

package/dist/redirect-uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-uri.js","sourceRoot":"","sources":["../src/redirect-uri.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;;AAuGH,kDAsCC;AAuBD,4CA+CC;AAQD,sDAEC;AAGD,wCAEC;AAhOD,uEAAuE;AACvE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,gCAAgC;IAChC,MAAM;IACN,OAAO;IACP,IAAI;IACJ,KAAK;IACL,KAAK;IACL,MAAM;IACN,oBAAoB;IACpB,YAAY;IACZ,UAAU;IACV,MAAM;IACN,MAAM;IACN,OAAO;IACP,YAAY;IACZ,aAAa;IACb,8BAA8B;IAC9B,QAAQ;IACR,kBAAkB;IAClB,eAAe;IACf,UAAU;CACX,CAAC,CAAC;AAgBH,MAAM,YAAY,GAChB,iFAAiF,CAAC;AAEpF,MAAM,gBAAgB,GACpB,0FAA0F,CAAC;AAE7F,MAAM,MAAM,GAAG,CAAC,MAAc,EAA6B,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAE5F;;;;;;;;;;;;;;GAcG;AACH,SAAS,cAAc,CAAC,GAAQ;IAC9B,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAEvF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC1C,CAAC;IAED,wEAAwE;IACxE,8EAA8E;IAC9E,cAAc;IACd,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAEhE,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;IACzD,CAAC;IAED,0EAA0E;IAC1E,8EAA8E;IAC9E,8DAA8D;IAC9D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;IACnF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1D,iEAAiE;IACjE,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAEpE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,KAAK,CAAC,KAAa;IAC1B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,UAAkB,EAAE,SAAiB;IACpE,MAAM,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IAEtC,2EAA2E;IAC3E,qEAAqE;IACrE,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,oBAAoB;IACpB,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAElD,yDAAyD;IACzD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAE1C,2EAA2E;IAC3E,8DAA8D;IAC9D,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,sCAAsC;IACtC,IAAI,aAAa,CAAC,KAAK,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IAExD,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC;IACxC,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC;IAEtC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1D,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,+BAA+B;IAC/B,IAAI,aAAa,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEnE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,OAAO,CACL,aAAa,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;QAChD,aAAa,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;QAChD,aAAa,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;QAChD,aAAa,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;QAChD,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;QAC5C,aAAa,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,CACzC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,UAA6B,EAAE,SAAiB;IACpF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,0DAA0D;AAC1D,SAAgB,cAAc,CAAC,IAAY;IACzC,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/dist/registration-controller.d.ts

@@ -0,0 +1,62 @@
+import { Router, type RequestHandler } from 'express';
+import type { ClientRegistryService } from './client-registry-service.js';
+import { type RateLimiterOptions } from './rate-limit.js';
+import type { OauthClient } from './types.js';
+/**
+ * `POST /oauth/register` — RFC 7591 open dynamic client registration.
+ *
+ * ## The one shape that lifts from the donor, and everything that does not
+ *
+ * Paywalls' `/oauth/register` contributes its response vocabulary: `client_id`,
+ * `client_id_issued_at`, the echoed metadata, `grant_types`,
+ * `token_endpoint_auth_method`, `response_types` and `scope`. That is about
+ * twenty-five lines' worth of shape and it is reproduced below.
+ *
+ * Its authentication model inverts and is discarded whole. Paywalls reads
+ * `req.user`, refuses anyone who is not a `service-user`, looks up that user's
+ * account, and creates a row owned by it. Open registration has no caller and
+ * no account, so what replaces that gate had to be written fresh:
+ * `redirect_uris` required and validated (paywalls never accepts the field at
+ * all), a per-IP rate limit here, and a row ceiling in the registry.
+ *
+ * ## Thin dispatch
+ *
+ * Parse, call, format. Every rule about what a client may register lives in
+ * `ClientRegistryService`, so the seed script and this endpoint cannot disagree
+ * about what a valid client is.
+ */
+export interface RegistrationHandlerDeps {
+    clientRegistry: ClientRegistryService;
+}
+/**
+ * The RFC 7591 registration response.
+ *
+ * `client_secret` is deliberately absent rather than null: this server issues
+ * only public clients, and a client that found the field would try to use it.
+ */
+export declare function toRegistrationResponse(client: OauthClient): Record<string, unknown>;
+export declare function createRegistrationHandlers(deps: RegistrationHandlerDeps): {
+    register: RequestHandler;
+};
+export interface RegistrationRouterOptions extends RegistrationHandlerDeps {
+    /**
+     * Rate-limiter settings, or `false` to mount none.
+     *
+     * `false` exists for an app that puts its own limiter in front — a shared
+     * one across instances, say. It is not a convenience: an unlimited
+     * unauthenticated write endpoint is exactly what the abuse controls are for,
+     * so turning this off means taking on the job elsewhere.
+     */
+    rateLimit?: RateLimiterOptions | false;
+    /** Maximum accepted body size. A registration document is small. */
+    bodyLimit?: string;
+}
+/**
+ * `POST /oauth/register`, with its abuse controls attached.
+ *
+ * The router parses its own JSON body rather than relying on an app-level
+ * `express.json()`, so the endpoint works whatever order the host app mounts
+ * its middleware in — and so the body limit here is the one that applies.
+ */
+export declare function createRegistrationRouter(options: RegistrationRouterOptions): Router;
+//# sourceMappingURL=registration-controller.d.ts.map

package/dist/registration-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-controller.d.ts","sourceRoot":"","sources":["../src/registration-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAQ,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAE5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1E,OAAO,EAAiC,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,qBAAqB,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBnF;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,uBAAuB,GAAG;IACzE,QAAQ,EAAE,cAAc,CAAC;CAC1B,CA6BA;AAED,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IACxE;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,kBAAkB,GAAG,KAAK,CAAC;IACvC,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAYnF"}

package/dist/registration-controller.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toRegistrationResponse = toRegistrationResponse;
+exports.createRegistrationHandlers = createRegistrationHandlers;
+exports.createRegistrationRouter = createRegistrationRouter;
+const express_1 = require("express");
+const errors_js_1 = require("./errors.js");
+const rate_limit_js_1 = require("./rate-limit.js");
+/**
+ * The RFC 7591 registration response.
+ *
+ * `client_secret` is deliberately absent rather than null: this server issues
+ * only public clients, and a client that found the field would try to use it.
+ */
+function toRegistrationResponse(client) {
+    return {
+        client_id: client.clientId,
+        client_id_issued_at: Math.floor(client.createdAt.getTime() / 1000),
+        client_name: client.name ?? undefined,
+        client_uri: client.clientUri ?? undefined,
+        logo_uri: client.logoUri ?? undefined,
+        contacts: client.contacts.length > 0 ? client.contacts : undefined,
+        policy_uri: client.policyUri ?? undefined,
+        tos_uri: client.tosUri ?? undefined,
+        software_id: client.softwareId ?? undefined,
+        software_version: client.softwareVersion ?? undefined,
+        redirect_uris: client.redirectUris,
+        grant_types: client.grantTypes,
+        response_types: client.responseTypes,
+        token_endpoint_auth_method: client.tokenEndpointAuthMethod,
+        scope: client.scopes.join(' '),
+    };
+}
+function createRegistrationHandlers(deps) {
+    const { clientRegistry } = deps;
+    const register = async (req, res, next) => {
+        const body = req.body;
+        if (typeof body !== 'object' || body === null || Array.isArray(body)) {
+            res.status(400).json({
+                error: 'invalid_client_metadata',
+                error_description: 'the request body must be a JSON object',
+            });
+            return;
+        }
+        try {
+            const client = await clientRegistry.registerDynamic(body);
+            res.status(201).json(toRegistrationResponse(client));
+        }
+        catch (err) {
+            // RFC 7591 §3.2.2 error bodies. Translated here rather than left to the
+            // global handler, because the registry's refusals are part of this
+            // endpoint's contract and a 500 would tell a client to retry.
+            if ((0, errors_js_1.isClientRegistryError)(err)) {
+                res.status(err.status).json({ error: err.code, error_description: err.message });
+                return;
+            }
+            next(err);
+        }
+    };
+    return { register };
+}
+/**
+ * `POST /oauth/register`, with its abuse controls attached.
+ *
+ * The router parses its own JSON body rather than relying on an app-level
+ * `express.json()`, so the endpoint works whatever order the host app mounts
+ * its middleware in — and so the body limit here is the one that applies.
+ */
+function createRegistrationRouter(options) {
+    const handlers = createRegistrationHandlers(options);
+    const router = (0, express_1.Router)();
+    const middleware = [(0, express_1.json)({ limit: options.bodyLimit ?? '16kb' })];
+    if (options.rateLimit !== false) {
+        middleware.push((0, rate_limit_js_1.createRegistrationRateLimiter)(options.rateLimit ?? {}).middleware);
+    }
+    router.post('/oauth/register', ...middleware, handlers.register);
+    return router;
+}
+//# sourceMappingURL=registration-controller.js.map

package/dist/registration-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-controller.js","sourceRoot":"","sources":["../src/registration-controller.ts"],"names":[],"mappings":";;AAyCA,wDAkBC;AAED,gEA+BC;AAuBD,4DAYC;AA/HD,qCAA4D;AAG5D,2CAAoD;AACpD,mDAAyF;AA+BzF;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,MAAmB;IACxD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAClE,WAAW,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;QACrC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;QACzC,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAClE,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;QACzC,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;QACnC,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,SAAS;QAC3C,gBAAgB,EAAE,MAAM,CAAC,eAAe,IAAI,SAAS;QACrD,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,cAAc,EAAE,MAAM,CAAC,aAAa;QACpC,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;QAC1D,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CAAC,IAA6B;IAGtE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAEhC,MAAM,QAAQ,GAAmB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,yBAAyB;gBAChC,iBAAiB,EAAE,wCAAwC;aAC5D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,IAA+B,CAAC,CAAC;YACrF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,mEAAmE;YACnE,8DAA8D;YAC9D,IAAI,IAAA,iCAAqB,EAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAgBD;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,OAAkC;IACzE,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,MAAM,UAAU,GAAqB,CAAC,IAAA,cAAI,EAAC,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAChC,UAAU,CAAC,IAAI,CAAC,IAAA,6CAA6B,EAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEjE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/request-client.d.ts

@@ -0,0 +1,19 @@
+import type { ClientRegistryService } from './client-registry-service.js';
+import type { OauthClient } from './types.js';
+/**
+ * Authenticating the client behind a back-channel POST.
+ *
+ * Every client this server issues to is public, so `token_endpoint_auth_method`
+ * is `none` and "authentication" here is nothing more than a `client_id` that
+ * names a registered, enabled client. That is a small rule with two edges worth
+ * keeping in one place: an unknown id and a **suspended** one both answer `401
+ * invalid_client`, and the suspension check is the whole reason the `status`
+ * column exists — a client whose row is still pointed at by live tokens is
+ * stopped here rather than deleted.
+ *
+ * `POST /oauth/token` and `POST /oauth/revoke` both begin this way. A second
+ * copy of the check is the one that would forget suspension, and then a retired
+ * client could still reach one of the two endpoints.
+ */
+export declare function resolveRequestClient(clientRegistry: ClientRegistryService, body: unknown): Promise<OauthClient>;
+//# sourceMappingURL=request-client.d.ts.map

package/dist/request-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-client.d.ts","sourceRoot":"","sources":["../src/request-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,qBAAqB,EACrC,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,WAAW,CAAC,CAUtB"}

package/dist/request-client.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveRequestClient = resolveRequestClient;
+const body_field_js_1 = require("./body-field.js");
+const oauth_error_js_1 = require("./oauth-error.js");
+/**
+ * Authenticating the client behind a back-channel POST.
+ *
+ * Every client this server issues to is public, so `token_endpoint_auth_method`
+ * is `none` and "authentication" here is nothing more than a `client_id` that
+ * names a registered, enabled client. That is a small rule with two edges worth
+ * keeping in one place: an unknown id and a **suspended** one both answer `401
+ * invalid_client`, and the suspension check is the whole reason the `status`
+ * column exists — a client whose row is still pointed at by live tokens is
+ * stopped here rather than deleted.
+ *
+ * `POST /oauth/token` and `POST /oauth/revoke` both begin this way. A second
+ * copy of the check is the one that would forget suspension, and then a retired
+ * client could still reach one of the two endpoints.
+ */
+async function resolveRequestClient(clientRegistry, body) {
+    const clientId = (0, body_field_js_1.required)(body, 'client_id');
+    const client = await clientRegistry.findByClientId(clientId);
+    if (!client) {
+        throw new oauth_error_js_1.OAuthError('invalid_client', 'unknown client_id');
+    }
+    if (client.status !== 'enabled') {
+        throw new oauth_error_js_1.OAuthError('invalid_client', 'this client is suspended');
+    }
+    return client;
+}
+//# sourceMappingURL=request-client.js.map

package/dist/request-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-client.js","sourceRoot":"","sources":["../src/request-client.ts"],"names":[],"mappings":";;AAoBA,oDAaC;AAjCD,mDAA2C;AAE3C,qDAA8C;AAG9C;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,oBAAoB,CACxC,cAAqC,EACrC,IAAa;IAEb,MAAM,QAAQ,GAAG,IAAA,wBAAQ,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,2BAAU,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,2BAAU,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/revocation-controller.d.ts

@@ -0,0 +1,28 @@
+import { Router, type RequestHandler } from 'express';
+import type { ClientRegistryService } from './client-registry-service.js';
+import { type RevocationService } from './revocation-service.js';
+import { type TokenService } from './token-service.js';
+export interface RevocationHandlerDeps {
+    clientRegistry: ClientRegistryService;
+    tokenService: TokenService;
+    revocationService: RevocationService;
+}
+export interface RevocationHandlers {
+    revoke: RequestHandler;
+}
+export declare function createRevocationHandlers(deps: RevocationHandlerDeps): RevocationHandlers;
+export interface RevocationRouterOptions extends RevocationHandlerDeps {
+    /** Maximum accepted body size. A revocation request is three fields. */
+    bodyLimit?: string;
+}
+/**
+ * `POST /oauth/revoke`, with both body parsers attached.
+ *
+ * Form and JSON, for the reason `createTokenRouter` mounts both: the RFC says
+ * form and the ecosystem sends JSON, and a client that gets this wrong on the
+ * revocation endpoint has already got it right on the token endpoint. The
+ * router parses its own body so the endpoint behaves the same whatever order the
+ * host application mounts its middleware in.
+ */
+export declare function createRevocationRouter(options: RevocationRouterOptions): Router;
+//# sourceMappingURL=revocation-controller.d.ts.map

package/dist/revocation-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation-controller.d.ts","sourceRoot":"","sources":["../src/revocation-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkC,KAAK,cAAc,EAAiB,MAAM,SAAS,CAAC;AAGrG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAG1E,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAwF5B,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,qBAAqB,CAAC;IACtC,YAAY,EAAE,YAAY,CAAC;IAC3B,iBAAiB,EAAE,iBAAiB,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,qBAAqB,GAAG,kBAAkB,CAiFxF;AAED,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB;IACpE,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAa/E"}