@boopkit/cap-oauth-server 0.1.4 → 0.3.0

package/dist/client-prune.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createClientInUsePredicate = createClientInUsePredicate;
+exports.createClientPruneJob = createClientPruneJob;
+const client_registry_service_js_1 = require("./client-registry-service.js");
+const grant_service_js_1 = require("./grant-service.js");
+/**
+ * The real `isInUse` predicate: is anybody still connected to this client?
+ *
+ * Suitable for passing straight to `pruneAbandonedClients`. It is `false` for a
+ * client nobody ever connected and for one every user has disconnected, and
+ * `true` the moment one live grant names the client's `publicId`.
+ */
+function createClientInUsePredicate(options) {
+    const { grantService, tokenService } = options;
+    return async function isInUse(client) {
+        const userIds = await tokenService.findUserIdsForClient(client.publicId);
+        for (const userId of userIds) {
+            const grants = await grantService.list(userId);
+            // The full `client_public_id`, never a prefix of it: a `startsWith` here
+            // would let a neighbouring client's live grant keep this row alive, which
+            // is the same too-broad match `revokeClient` refuses for the same reason.
+            const connected = grants.some((grant) => grant.client_public_id === client.publicId && (0, grant_service_js_1.isGrantActive)(grant));
+            if (connected)
+                return true;
+        }
+        return false;
+    };
+}
+/**
+ * The scheduled sweep, as one callable object.
+ *
+ * A job rather than a loose function because the thing that was missing was a
+ * *call site*: a scaffolded application schedules `run()` — from its own cron,
+ * from Heroku Scheduler, or from a cap-background-jobs consumer — and the
+ * capability owns which rows go and which stay.
+ */
+function createClientPruneJob(options) {
+    const { clientRegistry } = options;
+    const ttlMs = options.ttlMs ?? client_registry_service_js_1.DEFAULT_ABANDONED_CLIENT_TTL_MS;
+    const now = options.now ?? (() => new Date());
+    const isInUse = createClientInUsePredicate(options);
+    return {
+        async run() {
+            const before = new Date(now().getTime() - ttlMs);
+            const removed = await clientRegistry.pruneAbandonedClients({ before, isInUse });
+            return { before, removed };
+        },
+    };
+}
+//# sourceMappingURL=client-prune.js.map

package/dist/client-prune.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-prune.js","sourceRoot":"","sources":["../src/client-prune.ts"],"names":[],"mappings":";;AA0EA,gEAqBC;AAkCD,oDAaC;AA7ID,6EAA+E;AAC/E,yDAAsE;AAiEtE;;;;;;GAMG;AACH,SAAgB,0BAA0B,CACxC,OAA2B;IAE3B,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAE/C,OAAO,KAAK,UAAU,OAAO,CAAC,MAAmB;QAC/C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEzE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/C,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,KAAK,MAAM,CAAC,QAAQ,IAAI,IAAA,gCAAa,EAAC,KAAK,CAAC,CAC9E,CAAC;YACF,IAAI,SAAS;gBAAE,OAAO,IAAI,CAAC;QAC7B,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AA0BD;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAAC,OAA2B;IAC9D,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,4DAA+B,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAEpD,OAAO;QACL,KAAK,CAAC,GAAG;YACP,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAChF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client-registry-service.d.ts

@@ -1,5 +1,5 @@
 import { type FetchLike } from './metadata-document.js';
-import type { ClientMetadataInput, OauthClient, OauthClientDelegate, StaticClientInput } from './types.js';
+import type { ClientMetadataInput, ClientMode, OauthClient, OauthClientDelegate, StaticClientInput } from './types.js';
 /**
  * The client registry — who is asking, and what they are allowed to ask for.
  *
@@ -26,6 +26,11 @@ import type { ClientMetadataInput, OauthClient, OauthClientDelegate, StaticClien
  * `redirect_uris` required and validated at registration, a ceiling on total
  * rows, per-IP rate limiting at the transport, and a prune for rows that never
  * went anywhere.
+ *
+ * All four cover `metadata_document` as well as `dynamic`, because both modes
+ * are written on behalf of somebody nobody authenticated. Scoping them to
+ * `dynamic` is the shape of boop-jd4x: the CIMD path wrote an uncounted,
+ * unlimited, uncollected row per distinct URL a caller named.
  */
 /** Sensible RFC 7591 defaults for a client that asked for nothing specific. */
 export declare const DEFAULT_GRANT_TYPES: string[];
@@ -36,6 +41,22 @@ export declare const DEFAULT_METADATA_MAX_AGE_MS: number;
 export declare const DEFAULT_ABANDONED_CLIENT_TTL_MS: number;
 /** How many rows open registration may create before it starts refusing. */
 export declare const DEFAULT_MAX_REGISTERED_CLIENTS = 1000;
+/**
+ * The modes the ceiling and the prune are about: every row a stranger caused.
+ *
+ * `dynamic` is the obvious one — `POST /oauth/register` is an unauthenticated
+ * write. `metadata_document` is the one that was missed, and it is the same
+ * thing wearing a different hat: an unauthenticated `GET /oauth/authorize`
+ * naming an https `client_id` nobody vetted writes a permanent row too. Scoping
+ * the abuse controls to `dynamic` left that path with no ceiling, no limiter and
+ * no collector, so a loop over `?client_id=https://attacker.example/c?n=<N>`
+ * filled the table one row at a time (boop-jd4x).
+ *
+ * `static` is deliberately absent. An operator wrote those rows, and letting
+ * them consume the ceiling would let an operator's own seed script lock open
+ * registration shut.
+ */
+export declare const STRANGER_CREATED_MODES: readonly ClientMode[];
 export interface ClientRegistryServiceOptions {
     /**
      * The HTTP boundary for metadata documents. Required only if
@@ -43,22 +64,47 @@ export interface ClientRegistryServiceOptions {
      * never calls it.
      */
     fetch?: FetchLike;
-    /** Ceiling on `dynamic` rows. `Infinity` disables the check. */
+    /**
+     * Ceiling on rows a stranger caused — `dynamic` *and* `metadata_document`.
+     * `Infinity` disables the check. See `STRANGER_CREATED_MODES`.
+     */
     maxRegisteredClients?: number;
     /** Cache age past which a metadata document is re-fetched. */
     metadataMaxAgeMs?: number;
     metadataTimeoutMs?: number;
     metadataMaxBytes?: number;
     metadataMaxRedirects?: number;
+    /**
+     * Resolve a hostname to the addresses it points at, so that a *name* aimed at
+     * the internal network is refused like a literal address is.
+     *
+     * Optional and injected because this package has no business importing
+     * `node:dns` — the scaffold wires `dns.promises.lookup`. Without it the guard
+     * still refuses every literal private, loopback and link-local target; with
+     * it, `internal.example` resolving to `10.0.0.5` is refused too.
+     */
+    metadataResolveHost?: (hostname: string) => Promise<string[]>;
     /** Scopes a client may be granted, if it named none. */
     defaultScopes?: string[];
+    /**
+     * Every scope this server advertises — the ceiling on what any registration
+     * may claim, whoever wrote it.
+     *
+     * Registration is unauthenticated, so `scope` on the way in is a string a
+     * stranger chose. Storing it unfiltered makes the discovery document's
+     * `scopes_supported` untrue and puts an undescribed word in front of a user
+     * on the consent screen. Defaults to `defaultScopes`, which for a correctly
+     * wired server is the same list; an empty list bounds nothing, which is what
+     * a registry built with no scope configuration at all has always done.
+     */
+    scopesSupported?: string[];
     /** Injectable clock, so expiry and cache-age tests do not sleep. */
     now?: () => Date;
     /** Called when a re-fetch fails and the cached copy is used instead. */
     onMetadataRefreshFailed?(clientId: string, err: unknown): void;
 }
 export interface PruneOptions {
-    /** Delete abandoned `dynamic` rows created before this instant. */
+    /** Delete abandoned stranger-created rows created before this instant. */
     before?: Date;
     /**
      * Is this row still in use?
@@ -91,13 +137,38 @@ export interface ClientRegistryService {
     suspend(clientId: string): Promise<OauthClient>;
     /** Re-enable a suspended client. */
     unsuspend(clientId: string): Promise<OauthClient>;
-    /** Registration-surface update. Refuses a `static` row. */
+    /**
+     * Amend a registered client's metadata. Refuses a `static` row.
+     *
+     * There is no HTTP route behind this and there is not meant to be: RFC 7592
+     * client management is deliberately not implemented (see the note on
+     * `refuseStatic`). This is the host application's own management API — what
+     * an admin screen or a support script calls — and it validates exactly what
+     * `registerDynamic` validates, so a client cannot reach a value through an
+     * amendment that it could not have registered in the first place.
+     */
     updateRegistration(clientId: string, input: ClientMetadataInput): Promise<OauthClient>;
-    /** Registration-surface delete. Refuses a `static` row. */
+    /**
+     * Remove a registered client. Refuses a `static` row.
+     *
+     * The same host-application surface as `updateRegistration`, and the blunt
+     * instrument of the two: it drops the row, and with it the `publicId` that
+     * every live token for that client carries as its prefix. Prefer `suspend`
+     * for a client that may still have tokens outstanding — see
+     * `pruneAbandonedClients`, which asks `isInUse` before deleting anything.
+     */
     deleteRegistration(clientId: string): Promise<void>;
-    /** How many rows the ceiling counts. */
+    /** How many rows the ceiling counts — see `STRANGER_CREATED_MODES`. */
     countRegistered(): Promise<number>;
-    /** Garbage-collect abandoned dynamic rows. Returns the client ids removed. */
+    /**
+     * Garbage-collect abandoned stranger-created rows. Returns the client ids
+     * removed.
+     *
+     * A `metadata_document` row is swept on the same terms as a `dynamic` one.
+     * Its metadata is re-fetchable, so re-creating it costs one request; what is
+     * not re-creatable is its `publicId`, which is the prefix every live token for
+     * that client carries — and that is exactly what `isInUse` is for.
+     */
     pruneAbandonedClients(options?: PruneOptions): Promise<string[]>;
 }
 /**

package/dist/client-registry-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-registry-service.d.ts","sourceRoot":"","sources":["../src/client-registry-service.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,SAAS,EACf,MAAM,wBAAwB,CAAC;AAGhC,OAAO,KAAK,EAEV,mBAAmB,EAEnB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,UAA0C,CAAC;AAC3E,eAAO,MAAM,sBAAsB,UAAW,CAAC;AAE/C,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,QAAsB,CAAC;AAE/D,gFAAgF;AAChF,eAAO,MAAM,+BAA+B,QAA2B,CAAC;AAExE,4EAA4E;AAC5E,eAAO,MAAM,8BAA8B,OAAQ,CAAC;AAEpD,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,gEAAgE;IAChE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wDAAwD;IACxD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,wEAAwE;IACxE,uBAAuB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC;CAChE;AAED,MAAM,WAAW,YAAY;IAC3B,mEAAmE;IACnE,MAAM,CAAC,EAAE,IAAI,CAAC;IACd;;;;;;;OAOG;IACH,OAAO,CAAC,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,eAAe,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClE;;;OAGG;IACH,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChE,2EAA2E;IAC3E,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrE;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D,gEAAgE;IAChE,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChD,oCAAoC;IACpC,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClD,2DAA2D;IAC3D,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACvF,2DAA2D;IAC3D,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,wCAAwC;IACxC,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,8EAA8E;IAC9E,qBAAqB,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAClE;AAYD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CA0B7D;AAsFD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,GAAE,4BAAiC,GACzC,qBAAqB,CAiPvB"}
+{"version":3,"file":"client-registry-service.d.ts","sourceRoot":"","sources":["../src/client-registry-service.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,SAAS,EACf,MAAM,wBAAwB,CAAC;AAGhC,OAAO,KAAK,EAEV,mBAAmB,EACnB,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,UAA0C,CAAC;AAC3E,eAAO,MAAM,sBAAsB,UAAW,CAAC;AAE/C,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,QAAsB,CAAC;AAE/D,gFAAgF;AAChF,eAAO,MAAM,+BAA+B,QAA2B,CAAC;AAExE,4EAA4E;AAC5E,eAAO,MAAM,8BAA8B,OAAQ,CAAC;AAEpD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,UAAU,EAAqC,CAAC;AAE9F,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,wDAAwD;IACxD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,wEAAwE;IACxE,uBAAuB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC;CAChE;AAED,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,MAAM,CAAC,EAAE,IAAI,CAAC;IACd;;;;;;;OAOG;IACH,OAAO,CAAC,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,eAAe,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClE;;;OAGG;IACH,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChE,2EAA2E;IAC3E,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrE;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D,gEAAgE;IAChE,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChD,oCAAoC;IACpC,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClD;;;;;;;;;OASG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACvF;;;;;;;;OAQG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,uEAAuE;IACvE,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC;;;;;;;;OAQG;IACH,qBAAqB,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAClE;AAYD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CA0B7D;AA2ID,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,GAAE,4BAAiC,GACzC,qBAAqB,CAsSvB"}

package/dist/client-registry-service.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_MAX_REGISTERED_CLIENTS = exports.DEFAULT_ABANDONED_CLIENT_TTL_MS = exports.DEFAULT_METADATA_MAX_AGE_MS = exports.DEFAULT_RESPONSE_TYPES = exports.DEFAULT_GRANT_TYPES = void 0;
+exports.STRANGER_CREATED_MODES = exports.DEFAULT_MAX_REGISTERED_CLIENTS = exports.DEFAULT_ABANDONED_CLIENT_TTL_MS = exports.DEFAULT_METADATA_MAX_AGE_MS = exports.DEFAULT_RESPONSE_TYPES = exports.DEFAULT_GRANT_TYPES = void 0;
 exports.validateRedirectUris = validateRedirectUris;
 exports.createClientRegistryService = createClientRegistryService;
 const errors_js_1 = require("./errors.js");
@@ -33,6 +33,11 @@ const redirect_uri_js_1 = require("./redirect-uri.js");
  * `redirect_uris` required and validated at registration, a ceiling on total
  * rows, per-IP rate limiting at the transport, and a prune for rows that never
  * went anywhere.
+ *
+ * All four cover `metadata_document` as well as `dynamic`, because both modes
+ * are written on behalf of somebody nobody authenticated. Scoping them to
+ * `dynamic` is the shape of boop-jd4x: the CIMD path wrote an uncounted,
+ * unlimited, uncollected row per distinct URL a caller named.
  */
 /** Sensible RFC 7591 defaults for a client that asked for nothing specific. */
 exports.DEFAULT_GRANT_TYPES = ['authorization_code', 'refresh_token'];
@@ -43,6 +48,22 @@ exports.DEFAULT_METADATA_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 exports.DEFAULT_ABANDONED_CLIENT_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 /** How many rows open registration may create before it starts refusing. */
 exports.DEFAULT_MAX_REGISTERED_CLIENTS = 1000;
+/**
+ * The modes the ceiling and the prune are about: every row a stranger caused.
+ *
+ * `dynamic` is the obvious one — `POST /oauth/register` is an unauthenticated
+ * write. `metadata_document` is the one that was missed, and it is the same
+ * thing wearing a different hat: an unauthenticated `GET /oauth/authorize`
+ * naming an https `client_id` nobody vetted writes a permanent row too. Scoping
+ * the abuse controls to `dynamic` left that path with no ceiling, no limiter and
+ * no collector, so a loop over `?client_id=https://attacker.example/c?n=<N>`
+ * filled the table one row at a time (boop-jd4x).
+ *
+ * `static` is deliberately absent. An operator wrote those rows, and letting
+ * them consume the ceiling would let an operator's own seed script lock open
+ * registration shut.
+ */
+exports.STRANGER_CREATED_MODES = ['dynamic', 'metadata_document'];
 // ---------------------------------------------------------------------------
 // Validation
 // ---------------------------------------------------------------------------
@@ -95,6 +116,39 @@ function optionalString(value, field, maxLength = 2048) {
         throw invalidMetadata(`${field} is longer than ${maxLength}`);
     return value;
 }
+/**
+ * A display URI a stranger supplies, which this server will later put in a page.
+ *
+ * `https` or absent. The consent screen renders `logo_uri` in an `<img src>` and
+ * `client_uri`, `policy_uri` and `tos_uri` in an `<a href>`, and template
+ * escaping leaves a scheme alone — `javascript:` reaches the href intact. The
+ * page sanitises on the way out as well (`safeHttpsUri`), which is what protects
+ * rows written before this rule existed; refusing here is what tells the
+ * registrant, who would otherwise watch their privacy-policy link silently fail
+ * to appear.
+ *
+ * Not applied by `registerStaticClient`. That input comes from the people who
+ * run the site, through their own seed script rather than over the network, and
+ * it is the seam the consent screen's render-time defence is tested through.
+ */
+function optionalHttpsUri(value, field) {
+    const text = optionalString(value, field);
+    if (text === null)
+        return null;
+    let url;
+    try {
+        url = new URL(text);
+    }
+    catch {
+        throw invalidMetadata(`${field} must be an https URL`);
+    }
+    if (url.protocol !== 'https:') {
+        throw invalidMetadata(`${field} must be an https URL; got ${url.protocol}`);
+    }
+    // The raw spelling, not the parsed URL's serialization — this is a value we
+    // display back to the person who registered it, not one we match against.
+    return text;
+}
 function optionalStringArray(value, field) {
     if (value === undefined || value === null)
         return [];
@@ -106,14 +160,31 @@ function optionalStringArray(value, field) {
         return entry;
     });
 }
-/** RFC 6749 §3.3: `scope` on the wire is one space-delimited string. */
-function parseScope(value, fallback) {
+/**
+ * RFC 6749 §3.3: `scope` on the wire is one space-delimited string.
+ *
+ * Narrowed to what the server advertises, the way `grant_types` is: RFC 7591
+ * §3.2.1 lets us register a client with a scope list that differs from the one
+ * it asked for, and the registration response carries what was stored, so the
+ * client is told. A list that narrows to nothing is refused rather than allowed
+ * to fall back — falling back would hand a registrant that asked only for
+ * scopes we do not advertise the full default set, which is the opposite of
+ * narrowing.
+ */
+function parseScope(value, fallback, supported) {
+    const bound = (scopes) => supported.length > 0 ? scopes.filter((scope) => supported.includes(scope)) : scopes;
     if (value === undefined || value === null || value === '')
-        return [...fallback];
+        return bound([...fallback]);
     if (typeof value !== 'string')
         throw invalidMetadata('scope must be a space-delimited string');
     const scopes = value.split(/\s+/).filter(Boolean);
-    return scopes.length > 0 ? scopes : [...fallback];
+    if (scopes.length === 0)
+        return bound([...fallback]);
+    const narrowed = bound(scopes);
+    if (narrowed.length === 0) {
+        throw invalidMetadata(`scope names nothing this server advertises: ${scopes.join(' ')}`);
+    }
+    return narrowed;
 }
 /**
  * Only public clients, v1.
@@ -169,22 +240,33 @@ function toClient(row) {
 function createClientRegistryService(model, options = {}) {
     const now = options.now ?? (() => new Date());
     const defaultScopes = options.defaultScopes ?? [];
+    const scopesSupported = options.scopesSupported ?? defaultScopes;
     const maxRegisteredClients = options.maxRegisteredClients ?? exports.DEFAULT_MAX_REGISTERED_CLIENTS;
     const metadataMaxAgeMs = options.metadataMaxAgeMs ?? exports.DEFAULT_METADATA_MAX_AGE_MS;
     const fetchLimits = {
         timeoutMs: options.metadataTimeoutMs ?? metadata_document_js_1.DEFAULT_METADATA_TIMEOUT_MS,
         maxBytes: options.metadataMaxBytes ?? metadata_document_js_1.DEFAULT_METADATA_MAX_BYTES,
         maxRedirects: options.metadataMaxRedirects ?? metadata_document_js_1.DEFAULT_METADATA_MAX_REDIRECTS,
+        resolveHost: options.metadataResolveHost,
     };
+    /**
+     * The ceiling, asked by both paths that write a stranger's row.
+     *
+     * One function rather than a check at each call site, because the defect this
+     * closes was precisely two call sites where only one carried the check.
+     */
+    async function assertCapacity() {
+        if (!Number.isFinite(maxRegisteredClients))
+            return;
+        const registered = await model.count({ where: { mode: { in: [...exports.STRANGER_CREATED_MODES] } } });
+        if (registered >= maxRegisteredClients) {
+            throw new errors_js_1.ClientRegistryError('boop_registration_capacity', 'the client registry has reached its configured ceiling');
+        }
+    }
     const service = {
         async registerDynamic(input) {
             const redirectUris = validateRedirectUris(input.redirect_uris);
-            if (Number.isFinite(maxRegisteredClients)) {
-                const registered = await model.count({ where: { mode: 'dynamic' } });
-                if (registered >= maxRegisteredClients) {
-                    throw new errors_js_1.ClientRegistryError('boop_registration_capacity', 'the client registry has reached its configured ceiling');
-                }
-            }
+            await assertCapacity();
             const publicId = (0, public_id_js_1.generateClientPublicId)();
             const row = await model.create({
                 data: {
@@ -198,17 +280,17 @@ function createClientRegistryService(model, options = {}) {
                     status: 'enabled',
                     name: optionalString(input.client_name, 'client_name', 255),
                     description: null,
-                    logoUri: optionalString(input.logo_uri, 'logo_uri'),
-                    clientUri: optionalString(input.client_uri, 'client_uri'),
+                    logoUri: optionalHttpsUri(input.logo_uri, 'logo_uri'),
+                    clientUri: optionalHttpsUri(input.client_uri, 'client_uri'),
                     contacts: optionalStringArray(input.contacts, 'contacts'),
                     softwareId: optionalString(input.software_id, 'software_id', 255),
                     softwareVersion: optionalString(input.software_version, 'software_version', 255),
-                    policyUri: optionalString(input.policy_uri, 'policy_uri'),
-                    tosUri: optionalString(input.tos_uri, 'tos_uri'),
+                    policyUri: optionalHttpsUri(input.policy_uri, 'policy_uri'),
+                    tosUri: optionalHttpsUri(input.tos_uri, 'tos_uri'),
                     redirectUris,
                     grantTypes: normaliseGrantTypes(input.grant_types),
                     responseTypes: normaliseResponseTypes(input.response_types),
-                    scopes: parseScope(input.scope, defaultScopes),
+                    scopes: parseScope(input.scope, defaultScopes, scopesSupported),
                     tokenEndpointAuthMethod: parseAuthMethod(input.token_endpoint_auth_method),
                 },
             });
@@ -227,21 +309,52 @@ function createClientRegistryService(model, options = {}) {
             // because there is nothing to fall back to and consent would otherwise
             // show a nameless client.
             if (!existing) {
+                // The ceiling, **before** the fetch rather than before the write. A
+                // caller past it must not still be able to make this server issue one
+                // outbound request per attempt — that half of the abuse is a
+                // request-amplification probe whether or not a row comes of it.
+                //
+                // Only this branch is gated. A client that already has a row is served
+                // past the ceiling, including its lazy re-fetch: bounding new rows must
+                // not break consent for every connection at once the moment the table
+                // fills up.
+                await assertCapacity();
                 const doc = await (0, metadata_document_js_1.fetchMetadataDocument)(clientId, fetchImpl, fetchLimits);
-                const fields = readMetadataDocument(doc, defaultScopes);
-                const row = await model.create({
-                    data: {
-                        publicId: (0, public_id_js_1.generateClientPublicId)(),
-                        clientId,
-                        mode: 'metadata_document',
-                        status: 'enabled',
-                        metadataUri: clientId,
-                        metadataFetchedAt: now(),
-                        description: null,
-                        ...fields,
-                    },
-                });
-                return toClient(row);
+                const fields = readMetadataDocument(doc, defaultScopes, scopesSupported);
+                try {
+                    const row = await model.create({
+                        data: {
+                            publicId: (0, public_id_js_1.generateClientPublicId)(),
+                            clientId,
+                            mode: 'metadata_document',
+                            status: 'enabled',
+                            metadataUri: clientId,
+                            metadataFetchedAt: now(),
+                            description: null,
+                            ...fields,
+                        },
+                    });
+                    return toClient(row);
+                }
+                catch (err) {
+                    // The widest race in the registry: the fetch above is a network
+                    // round-trip sitting between the lookup and this write, so two
+                    // authorization requests naming the same new `client_id` overlap for
+                    // as long as the client's server takes to answer. The loser used to
+                    // surface a `P2002` as a 500 on `/oauth/authorize`.
+                    //
+                    // Both callers fetched the same document, so the winner's row is the
+                    // answer to this caller's question too. Re-read rather than write:
+                    // the row that won might be `static` or `dynamic` — somebody racing
+                    // an operator's seed of the same URL — and overwriting one of those
+                    // is exactly what the mode check below this refuses to do.
+                    if (!(0, errors_js_1.isUniqueConstraintViolation)(err, 'clientId'))
+                        throw err;
+                    const won = await model.findUnique({ where: { clientId } });
+                    if (!won)
+                        throw err;
+                    return toClient(won);
+                }
             }
             const cached = toClient(existing);
             if (cached.mode !== 'metadata_document') {
@@ -260,7 +373,7 @@ function createClientRegistryService(model, options = {}) {
             // is metadata we validated ourselves the last time it was reachable.
             try {
                 const doc = await (0, metadata_document_js_1.fetchMetadataDocument)(cached.metadataUri ?? clientId, fetchImpl, fetchLimits);
-                const fields = readMetadataDocument(doc, defaultScopes);
+                const fields = readMetadataDocument(doc, defaultScopes, scopesSupported);
                 const row = await model.update({
                     where: { clientId },
                     data: { ...fields, metadataFetchedAt: now() },
@@ -305,10 +418,23 @@ function createClientRegistryService(model, options = {}) {
                 const row = await model.update({ where: { clientId: input.clientId }, data });
                 return toClient(row);
             }
-            const row = await model.create({
-                data: { publicId: (0, public_id_js_1.generateClientPublicId)(), clientId: input.clientId, ...data },
-            });
-            return toClient(row);
+            try {
+                const row = await model.create({
+                    data: { publicId: (0, public_id_js_1.generateClientPublicId)(), clientId: input.clientId, ...data },
+                });
+                return toClient(row);
+            }
+            catch (err) {
+                // "Safe to run twice" has to mean twice *at once*: two app instances
+                // booting together run the same seed, and the lookup above is a whole
+                // `await` away from this write. The loser converges on the winner's row
+                // rather than crashing a boot — and `data` carries no `publicId`, so
+                // the winner's prefix is what survives, which is the point.
+                if (!(0, errors_js_1.isUniqueConstraintViolation)(err, 'clientId'))
+                    throw err;
+                const row = await model.update({ where: { clientId: input.clientId }, data });
+                return toClient(row);
+            }
         },
         async findByClientId(clientId) {
             if (typeof clientId !== 'string' || clientId === '')
@@ -343,17 +469,17 @@ function createClientRegistryService(model, options = {}) {
                 data.name = optionalString(input.client_name, 'client_name', 255);
             }
             if (input.client_uri !== undefined)
-                data.clientUri = optionalString(input.client_uri, 'client_uri');
+                data.clientUri = optionalHttpsUri(input.client_uri, 'client_uri');
             if (input.logo_uri !== undefined)
-                data.logoUri = optionalString(input.logo_uri, 'logo_uri');
+                data.logoUri = optionalHttpsUri(input.logo_uri, 'logo_uri');
             if (input.contacts !== undefined)
                 data.contacts = optionalStringArray(input.contacts, 'contacts');
             if (input.policy_uri !== undefined)
-                data.policyUri = optionalString(input.policy_uri, 'policy_uri');
+                data.policyUri = optionalHttpsUri(input.policy_uri, 'policy_uri');
             if (input.tos_uri !== undefined)
-                data.tosUri = optionalString(input.tos_uri, 'tos_uri');
+                data.tosUri = optionalHttpsUri(input.tos_uri, 'tos_uri');
             if (input.scope !== undefined)
-                data.scopes = parseScope(input.scope, defaultScopes);
+                data.scopes = parseScope(input.scope, defaultScopes, scopesSupported);
             const row = await model.update({ where: { clientId }, data });
             return toClient(row);
         },
@@ -363,13 +489,13 @@ function createClientRegistryService(model, options = {}) {
             await model.delete({ where: { clientId } });
         },
         async countRegistered() {
-            return model.count({ where: { mode: 'dynamic' } });
+            return model.count({ where: { mode: { in: [...exports.STRANGER_CREATED_MODES] } } });
         },
         async pruneAbandonedClients(pruneOptions = {}) {
             const before = pruneOptions.before ?? new Date(now().getTime() - exports.DEFAULT_ABANDONED_CLIENT_TTL_MS);
             const isInUse = pruneOptions.isInUse ?? (async () => false);
             const rows = await model.findMany({
-                where: { mode: 'dynamic', createdAt: { lt: before } },
+                where: { mode: { in: [...exports.STRANGER_CREATED_MODES] }, createdAt: { lt: before } },
             });
             const removed = [];
             for (const row of rows) {
@@ -394,10 +520,32 @@ async function requireClient(model, clientId) {
  * A `static` row belongs to the operator who wrote it.
  *
  * This is a check in the service rather than a convention anyone remembers,
- * because the thing it prevents — an unauthenticated registration surface
- * rewriting the redirect URIs of a client the operator vouched for — is exactly
- * the kind of hole a convention leaves open the first time someone adds a
- * route.
+ * because the thing it prevents — something rewriting the redirect URIs of a
+ * client the operator vouched for — is exactly the kind of hole a convention
+ * leaves open the first time someone adds a route.
+ *
+ * ## The route it is waiting for does not exist, and the guard is still the
+ * right place for this
+ *
+ * RFC 7592 client management (`PUT`/`DELETE /oauth/register/:client_id`) is not
+ * implemented here, and that is a decision rather than a slice that has not
+ * landed yet. Authenticating those endpoints takes a
+ * `registration_access_token`: a third credential kind, with its own hashing,
+ * rotation and revocation story, bought so that a client can amend a
+ * registration it can re-create with one unauthenticated `POST`. Nothing in the
+ * Claude ecosystem checklist asks for it. So the registration response omits
+ * the token, the discovery document advertises no management surface, and the
+ * endpoints are absent rather than unauthenticated — which is what makes them
+ * safe, since an unauthenticated mount would let any caller rewrite any dynamic
+ * client's redirect URIs.
+ *
+ * What is left in front of this guard, then, is the host application's own
+ * management code — `updateRegistration` and `deleteRegistration` called from
+ * an admin screen or a support script. That code has a caller and can be
+ * trusted to be an operator; what it must still not be able to do is quietly
+ * unpick a seeded client by going through the same door a dynamic one uses.
+ * And if the decision above is ever reversed, this guard is already standing
+ * where the new route would land.
  */
 function refuseStatic(client, verb) {
     if (client.mode === 'static') {
@@ -479,18 +627,18 @@ function intersectSupported(requested, supported) {
  * validation the registration endpoint applies runs here too — in particular
  * `redirect_uris`, which is the field an attacker would want to control.
  */
-function readMetadataDocument(doc, defaultScopes) {
+function readMetadataDocument(doc, defaultScopes, scopesSupported) {
     return {
         name: optionalString(doc.client_name, 'client_name', 255),
-        logoUri: optionalString(doc.logo_uri, 'logo_uri'),
-        clientUri: optionalString(doc.client_uri, 'client_uri'),
+        logoUri: optionalHttpsUri(doc.logo_uri, 'logo_uri'),
+        clientUri: optionalHttpsUri(doc.client_uri, 'client_uri'),
         contacts: optionalStringArray(doc.contacts, 'contacts'),
-        policyUri: optionalString(doc.policy_uri, 'policy_uri'),
-        tosUri: optionalString(doc.tos_uri, 'tos_uri'),
+        policyUri: optionalHttpsUri(doc.policy_uri, 'policy_uri'),
+        tosUri: optionalHttpsUri(doc.tos_uri, 'tos_uri'),
         redirectUris: validateRedirectUris(doc.redirect_uris),
         grantTypes: normaliseGrantTypes(doc.grant_types),
         responseTypes: normaliseResponseTypes(doc.response_types),
-        scopes: parseScope(doc.scope, defaultScopes),
+        scopes: parseScope(doc.scope, defaultScopes, scopesSupported),
         tokenEndpointAuthMethod: parseAuthMethod(doc.token_endpoint_auth_method),
     };
 }