@boopkit/cap-oauth-server 0.1.4 → 0.3.1

package/dist/request-client.js

@@ -4,24 +4,42 @@ exports.resolveRequestClient = resolveRequestClient;
 const body_field_js_1 = require("./body-field.js");
 const oauth_error_js_1 = require("./oauth-error.js");
 /**
- * Authenticating the client behind a back-channel POST.
+ * The fields a client can authenticate itself with in a request body.
  *
- * Every client this server issues to is public, so `token_endpoint_auth_method`
- * is `none` and "authentication" here is nothing more than a `client_id` that
- * names a registered, enabled client. That is a small rule with two edges worth
- * keeping in one place: an unknown id and a **suspended** one both answer `401
- * invalid_client`, and the suspension check is the whole reason the `status`
- * column exists — a client whose row is still pointed at by live tokens is
- * stopped here rather than deleted.
+ * `client_id` is the only one read. The other two are RFC 7523's signed
+ * assertion, which a client whose document declared `private_key_jwt` may send
+ * and may send *in place of* `client_id`.
+ */
+const CLIENT_AUTH_FIELDS = ['client_id', 'client_assertion', 'client_assertion_type'];
+/**
+ * Say, to the operator, which of those fields a refused request carried.
  *
- * `POST /oauth/token` and `POST /oauth/revoke` both begin this way. A second
- * copy of the check is the one that would forget suspension, and then a retired
- * client could still reach one of the two endpoints.
+ * Names only, never values. A client registered from a `private_key_jwt`
+ * document is stored as a public client (see `parseAuthMethod`), and whether it
+ * then sends `client_id` at all is a fact about that client which nobody can
+ * read off this code. When it does not, the caller is told `client_id is
+ * required` and the person connecting sees a failure with no cause; this line
+ * is what lets the operator tell "sent an assertion instead" from "sent
+ * nothing". The assertion is a signed credential and a `client_id` may be a
+ * URL somebody else chose, so neither is repeated here.
  */
-async function resolveRequestClient(clientRegistry, body) {
-    const clientId = (0, body_field_js_1.required)(body, 'client_id');
+function reportUnidentified(report, body, why) {
+    const carried = CLIENT_AUTH_FIELDS.filter((name) => (0, body_field_js_1.field)(body, name) !== undefined);
+    report.warn(`${report.endpoint} refused: ${why}. The request ` +
+        (carried.length > 0
+            ? `carried ${carried.join(', ')}`
+            : `carried none of ${CLIENT_AUTH_FIELDS.join(', ')}`) +
+        `.`);
+}
+async function resolveRequestClient(clientRegistry, body, report) {
+    const clientId = (0, body_field_js_1.field)(body, 'client_id');
+    if (clientId === undefined) {
+        reportUnidentified(report, body, 'no client_id in the request');
+        throw new oauth_error_js_1.OAuthError('invalid_request', 'client_id is required');
+    }
     const client = await clientRegistry.findByClientId(clientId);
     if (!client) {
+        reportUnidentified(report, body, 'client_id names no registered client');
         throw new oauth_error_js_1.OAuthError('invalid_client', 'unknown client_id');
     }
     if (client.status !== 'enabled') {

package/dist/request-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-client.js","sourceRoot":"","sources":["../src/request-client.ts"],"names":[],"mappings":";;AAoBA,oDAaC;AAjCD,mDAA2C;AAE3C,qDAA8C;AAG9C;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,oBAAoB,CACxC,cAAqC,EACrC,IAAa;IAEb,MAAM,QAAQ,GAAG,IAAA,wBAAQ,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,2BAAU,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,2BAAU,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"request-client.js","sourceRoot":"","sources":["../src/request-client.ts"],"names":[],"mappings":";;AA4DA,oDAmBC;AA/ED,mDAAwC;AAExC,qDAA8C;AA0B9C;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,CAAC,WAAW,EAAE,kBAAkB,EAAE,uBAAuB,CAAU,CAAC;AAE/F;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CAAC,MAA2B,EAAE,IAAa,EAAE,GAAW;IACjF,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,qBAAK,EAAC,IAAI,EAAE,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IACrF,MAAM,CAAC,IAAI,CACT,GAAG,MAAM,CAAC,QAAQ,aAAa,GAAG,gBAAgB;QAChD,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACjC,CAAC,CAAC,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,GAAG,CACN,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,oBAAoB,CACxC,cAAqC,EACrC,IAAa,EACb,MAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAA,qBAAK,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,6BAA6B,CAAC,CAAC;QAChE,MAAM,IAAI,2BAAU,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,sCAAsC,CAAC,CAAC;QACzE,MAAM,IAAI,2BAAU,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,2BAAU,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/revocation-controller.d.ts

@@ -6,6 +6,11 @@ export interface RevocationHandlerDeps {
     clientRegistry: ClientRegistryService;
     tokenService: TokenService;
     revocationService: RevocationService;
+    /**
+     * Where a request refused for an unidentifiable client is reported. Defaults
+     * to `console.warn`. See `resolveRequestClient` for what the line says.
+     */
+    warn?(message: string): void;
 }
 export interface RevocationHandlers {
     revoke: RequestHandler;

package/dist/revocation-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revocation-controller.d.ts","sourceRoot":"","sources":["../src/revocation-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkC,KAAK,cAAc,EAAiB,MAAM,SAAS,CAAC;AAGrG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAG1E,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAwF5B,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,qBAAqB,CAAC;IACtC,YAAY,EAAE,YAAY,CAAC;IAC3B,iBAAiB,EAAE,iBAAiB,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,qBAAqB,GAAG,kBAAkB,CAiFxF;AAED,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB;IACpE,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAa/E"}
+{"version":3,"file":"revocation-controller.d.ts","sourceRoot":"","sources":["../src/revocation-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkC,KAAK,cAAc,EAAiB,MAAM,SAAS,CAAC;AAGrG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAG1E,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAwF5B,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,qBAAqB,CAAC;IACtC,YAAY,EAAE,YAAY,CAAC;IAC3B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,qBAAqB,GAAG,kBAAkB,CAqFxF;AAED,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB;IACpE,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAa/E"}

package/dist/revocation-controller.js

@@ -94,6 +94,7 @@ const DOMAIN_BY_HINT = new Map([
 ]);
 function createRevocationHandlers(deps) {
     const { clientRegistry, tokenService, revocationService } = deps;
+    const warn = deps.warn ?? ((message) => console.warn(`[cap-oauth-server] ${message}`));
     /** The hint's domain first, then the other. See the header: advisory only. */
     function searchOrder(hint) {
         const hinted = hint === undefined ? undefined : DOMAIN_BY_HINT.get(hint);
@@ -127,7 +128,10 @@ function createRevocationHandlers(deps) {
         try {
             const presented = (0, body_field_js_1.required)(req.body, 'token');
             const order = searchOrder((0, body_field_js_1.field)(req.body, 'token_type_hint'));
-            const client = await (0, request_client_js_1.resolveRequestClient)(clientRegistry, req.body);
+            const client = await (0, request_client_js_1.resolveRequestClient)(clientRegistry, req.body, {
+                endpoint: 'POST /oauth/revoke',
+                warn,
+            });
             // The client prefix is readable off the token before any lookup, so a
             // token belonging to somebody else is dropped without touching the
             // database — and, per §2.2, without being distinguishable from success.

package/dist/revocation-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"revocation-controller.js","sourceRoot":"","sources":["../src/revocation-controller.ts"],"names":[],"mappings":";;AA8GA,4DAiFC;AAgBD,wDAaC;AA5ND,qCAAqG;AAErG,mDAAkD;AAElD,qDAA4D;AAC5D,2DAA2D;AAC3D,mEAAoF;AACpF,yDAK4B;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAEH;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAA2B;IACvD,CAAC,cAAc,EAAE,sCAAmB,CAAC;IACrC,CAAC,eAAe,EAAE,uCAAoB,CAAC;CACxC,CAAC,CAAC;AAYH,SAAgB,wBAAwB,CAAC,IAA2B;IAClE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAEjE,8EAA8E;IAC9E,SAAS,WAAW,CAAC,IAAwB;QAC3C,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/C,uEAAuE;YACvE,0EAA0E;YAC1E,8DAA8D;YAC9D,MAAM,IAAI,2BAAU,CAClB,wBAAwB,EACxB,0DAA0D,IAAI,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,uCAAoB;YAAE,OAAO,CAAC,uCAAoB,EAAE,sCAAmB,CAAC,CAAC;QACxF,OAAO,CAAC,sCAAmB,EAAE,uCAAoB,CAAC,CAAC;IACrD,CAAC;IAED,6EAA6E;IAC7E,KAAK,UAAU,aAAa,CAC1B,MAAwB,EACxB,MAAc,EACd,WAAmB,EACnB,cAAsB;QAEtB,IAAI,MAAM,KAAK,sCAAmB,EAAE,CAAC;YACnC,MAAM,YAAY,CAAC,WAAW,CAAC,sCAAmB,EAAE,WAAW,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,mBAAmB,CACzD,MAAM,EACN,cAAc,EACd,yCAAiB,CAClB,CAAC;QACF,yEAAyE;QACzE,6DAA6D;QAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,YAAY,CAAC,WAAW,CAAC,uCAAoB,EAAE,WAAW,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAmB,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAI,EAAE,EAAE;QACzE,0EAA0E;QAC1E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,wBAAQ,EAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAA,qBAAK,EAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,IAAA,wCAAoB,EAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAEpE,sEAAsE;YACtE,mEAAmE;YACnE,wEAAwE;YACxE,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,MAAM,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACxD,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;oBAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;oBAC/D,IAAI,CAAC,QAAQ;wBAAE,SAAS;oBACxB,MAAM,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;oBACpF,MAAM;gBACR,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAA,6BAAY,EAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,IAAI,GAAG,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;oBACnC,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;gBACxC,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAOD;;;;;;;;GAQG;AACH,SAAgB,sBAAsB,CAAC,OAAgC;IACrE,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IACxB,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE1C,MAAM,CAAC,IAAI,CACT,eAAe,EACf,IAAA,oBAAU,EAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EACtC,IAAA,cAAI,EAAC,EAAE,KAAK,EAAE,CAAC,EACf,QAAQ,CAAC,MAAM,CAChB,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"revocation-controller.js","sourceRoot":"","sources":["../src/revocation-controller.ts"],"names":[],"mappings":";;AAmHA,4DAqFC;AAgBD,wDAaC;AArOD,qCAAqG;AAErG,mDAAkD;AAElD,qDAA4D;AAC5D,2DAA2D;AAC3D,mEAAoF;AACpF,yDAK4B;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAEH;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAA2B;IACvD,CAAC,cAAc,EAAE,sCAAmB,CAAC;IACrC,CAAC,eAAe,EAAE,uCAAoB,CAAC;CACxC,CAAC,CAAC;AAiBH,SAAgB,wBAAwB,CAAC,IAA2B;IAClE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC,CAAC;IAE/F,8EAA8E;IAC9E,SAAS,WAAW,CAAC,IAAwB;QAC3C,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/C,uEAAuE;YACvE,0EAA0E;YAC1E,8DAA8D;YAC9D,MAAM,IAAI,2BAAU,CAClB,wBAAwB,EACxB,0DAA0D,IAAI,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,uCAAoB;YAAE,OAAO,CAAC,uCAAoB,EAAE,sCAAmB,CAAC,CAAC;QACxF,OAAO,CAAC,sCAAmB,EAAE,uCAAoB,CAAC,CAAC;IACrD,CAAC;IAED,6EAA6E;IAC7E,KAAK,UAAU,aAAa,CAC1B,MAAwB,EACxB,MAAc,EACd,WAAmB,EACnB,cAAsB;QAEtB,IAAI,MAAM,KAAK,sCAAmB,EAAE,CAAC;YACnC,MAAM,YAAY,CAAC,WAAW,CAAC,sCAAmB,EAAE,WAAW,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,mBAAmB,CACzD,MAAM,EACN,cAAc,EACd,yCAAiB,CAClB,CAAC;QACF,yEAAyE;QACzE,6DAA6D;QAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,YAAY,CAAC,WAAW,CAAC,uCAAoB,EAAE,WAAW,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAmB,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAI,EAAE,EAAE;QACzE,0EAA0E;QAC1E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,wBAAQ,EAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAA,qBAAK,EAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,IAAA,wCAAoB,EAAC,cAAc,EAAE,GAAG,CAAC,IAAI,EAAE;gBAClE,QAAQ,EAAE,oBAAoB;gBAC9B,IAAI;aACL,CAAC,CAAC;YAEH,sEAAsE;YACtE,mEAAmE;YACnE,wEAAwE;YACxE,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,MAAM,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACxD,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;oBAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;oBAC/D,IAAI,CAAC,QAAQ;wBAAE,SAAS;oBACxB,MAAM,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;oBACpF,MAAM;gBACR,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAA,6BAAY,EAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,IAAI,GAAG,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;oBACnC,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;gBACxC,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAOD;;;;;;;;GAQG;AACH,SAAgB,sBAAsB,CAAC,OAAgC;IACrE,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IACxB,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE1C,MAAM,CAAC,IAAI,CACT,eAAe,EACf,IAAA,oBAAU,EAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EACtC,IAAA,cAAI,EAAC,EAAE,KAAK,EAAE,CAAC,EACf,QAAQ,CAAC,MAAM,CAChB,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/same-site.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Did this request come from a page this server served?
+ *
+ * ## Why the consent form needs its own answer
+ *
+ * `POST /oauth/authorize` mints an authorization code, and the only credential
+ * it needs is the session cookie the browser attaches by itself. That is the
+ * exact shape cross-site request forgery exploits: an attacker's page
+ * auto-submits the form, the victim's browser attaches the cookie, and a code
+ * for the victim's account is redirected to a `redirect_uri` the attacker
+ * registered.
+ *
+ * PKCE does not help. It binds a code to whoever *asked* for it, and here the
+ * attacker is the client — they generate the challenge and hold the verifier.
+ * `state` does not help either: it is the client's CSRF token, echoed back
+ * untouched, and on this attack the attacker is the one who chose it. Neither
+ * mechanism was ever pointed at this direction.
+ *
+ * What was holding the line was a browser default — an unlabelled cookie is
+ * treated as `SameSite=Lax`, and Lax is not sent on a cross-site POST. The
+ * cookie is now labelled explicitly (see `createConsentHandlers`), but a
+ * defence that lives entirely in the user agent is one this server cannot
+ * assert, cannot test, and does not own. This is the server's own answer.
+ *
+ * ## What it reads, and why that is enough
+ *
+ * `Origin` and `Sec-Fetch-Site` are both **forbidden header names**: page
+ * script cannot set or remove either one, so on a form post from a hostile
+ * page the browser attaches them truthfully. An attacker can no more suppress
+ * them than they can read the cookie.
+ *
+ * A request carrying neither is accepted. It is not a browser, or it is one
+ * too old to label anything — and a forgery needs a browser, because a browser
+ * is the only thing that will attach somebody else's cookie. Refusing here
+ * would break every non-browser caller and buy nothing.
+ */
+/** The parts of a request this check reads. `express.Request` satisfies it. */
+export interface SameSiteRequest {
+    headers: Record<string, string | string[] | undefined>;
+    /** Express's resolved hostname — `X-Forwarded-Host` under `trust proxy`. */
+    hostname?: string;
+}
+/**
+ * Whether this request may be treated as originating from this site.
+ *
+ * `allowedOrigins` are origins the application declares as its own, matched
+ * exactly and before anything else. They exist for a deployment this function
+ * cannot work out on its own — a proxy that rewrites `Host` without setting
+ * `X-Forwarded-Host`, or a consent page deliberately served from a sibling
+ * host. Naming one is a decision about what counts as this application, so it
+ * is the application's to make and nothing here guesses at it.
+ */
+export declare function isSameSiteRequest(req: SameSiteRequest, allowedOrigins?: readonly string[]): boolean;
+//# sourceMappingURL=same-site.d.ts.map

package/dist/same-site.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"same-site.d.ts","sourceRoot":"","sources":["../src/same-site.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA6DD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,eAAe,EACpB,cAAc,GAAE,SAAS,MAAM,EAAO,GACrC,OAAO,CAcT"}

package/dist/same-site.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * Did this request come from a page this server served?
+ *
+ * ## Why the consent form needs its own answer
+ *
+ * `POST /oauth/authorize` mints an authorization code, and the only credential
+ * it needs is the session cookie the browser attaches by itself. That is the
+ * exact shape cross-site request forgery exploits: an attacker's page
+ * auto-submits the form, the victim's browser attaches the cookie, and a code
+ * for the victim's account is redirected to a `redirect_uri` the attacker
+ * registered.
+ *
+ * PKCE does not help. It binds a code to whoever *asked* for it, and here the
+ * attacker is the client — they generate the challenge and hold the verifier.
+ * `state` does not help either: it is the client's CSRF token, echoed back
+ * untouched, and on this attack the attacker is the one who chose it. Neither
+ * mechanism was ever pointed at this direction.
+ *
+ * What was holding the line was a browser default — an unlabelled cookie is
+ * treated as `SameSite=Lax`, and Lax is not sent on a cross-site POST. The
+ * cookie is now labelled explicitly (see `createConsentHandlers`), but a
+ * defence that lives entirely in the user agent is one this server cannot
+ * assert, cannot test, and does not own. This is the server's own answer.
+ *
+ * ## What it reads, and why that is enough
+ *
+ * `Origin` and `Sec-Fetch-Site` are both **forbidden header names**: page
+ * script cannot set or remove either one, so on a form post from a hostile
+ * page the browser attaches them truthfully. An attacker can no more suppress
+ * them than they can read the cookie.
+ *
+ * A request carrying neither is accepted. It is not a browser, or it is one
+ * too old to label anything — and a forgery needs a browser, because a browser
+ * is the only thing that will attach somebody else's cookie. Refusing here
+ * would break every non-browser caller and buy nothing.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSameSiteRequest = isSameSiteRequest;
+function headerOf(req, name) {
+    const value = req.headers?.[name];
+    const first = Array.isArray(value) ? value[0] : value;
+    return typeof first === 'string' && first !== '' ? first : undefined;
+}
+/**
+ * Whether `origin` names the host this request arrived on.
+ *
+ * The comparison is on host, not on the whole origin: the scheme is the
+ * deployment's business — a boop application in development is served over
+ * http — and a wrong scheme on the right host means a network attacker, which
+ * is `Secure` on the cookie rather than this function.
+ *
+ * `Host` is checked first and including the port, because a different port is a
+ * different origin and on a shared development host it is a different
+ * application altogether.
+ *
+ * The fallback to `req.hostname` is for a deployment behind a proxy that
+ * rewrites `Host`: with `trust proxy` set, express resolves
+ * `X-Forwarded-Host` there, which is the public name the browser used. It
+ * compares hostnames only, because `X-Forwarded-Host` frequently carries no
+ * port — and it is reached **only when express resolved a different name than
+ * `Host` carried**, i.e. when a proxy really did rewrite something. Otherwise
+ * an unproxied request whose port did not match would be rescued by a
+ * comparison that ignores the port, and the check above would mean nothing.
+ */
+function matchesOwnHost(origin, req) {
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        // `null`, an empty string, anything malformed. Not our host.
+        return false;
+    }
+    const host = headerOf(req, 'host');
+    const hostname = typeof req.hostname === 'string' ? req.hostname : undefined;
+    if (host !== undefined) {
+        if (url.host.toLowerCase() === host.toLowerCase())
+            return true;
+        if (hostname === undefined || hostname === '')
+            return false;
+        // Nothing was rewritten — the mismatch is real, and it is the port.
+        if (hostname.toLowerCase() === hostnameOf(host))
+            return false;
+    }
+    if (hostname === undefined || hostname === '')
+        return false;
+    return url.hostname.toLowerCase() === hostname.toLowerCase();
+}
+/** The host-header's name without its port. `undefined` if it will not parse. */
+function hostnameOf(host) {
+    try {
+        return new URL(`http://${host}`).hostname.toLowerCase();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Whether this request may be treated as originating from this site.
+ *
+ * `allowedOrigins` are origins the application declares as its own, matched
+ * exactly and before anything else. They exist for a deployment this function
+ * cannot work out on its own — a proxy that rewrites `Host` without setting
+ * `X-Forwarded-Host`, or a consent page deliberately served from a sibling
+ * host. Naming one is a decision about what counts as this application, so it
+ * is the application's to make and nothing here guesses at it.
+ */
+function isSameSiteRequest(req, allowedOrigins = []) {
+    const origin = headerOf(req, 'origin');
+    if (origin !== undefined && allowedOrigins.includes(origin))
+        return true;
+    // Refuse on any label that says this did not come from us, whether or not an
+    // Origin is present. `same-site` is refused alongside `cross-site`: this form
+    // only ever posts to the page that rendered it, so a sibling subdomain is as
+    // much a stranger here as anywhere else.
+    const site = headerOf(req, 'sec-fetch-site');
+    if (site !== undefined && site !== 'same-origin' && site !== 'none')
+        return false;
+    if (origin !== undefined)
+        return matchesOwnHost(origin, req);
+    return true;
+}
+//# sourceMappingURL=same-site.js.map

package/dist/same-site.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"same-site.js","sourceRoot":"","sources":["../src/same-site.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;;AA8EH,8CAiBC;AAtFD,SAAS,QAAQ,CAAC,GAAoB,EAAE,IAAY;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,cAAc,CAAC,MAAc,EAAE,GAAoB;IAC1D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5D,oEAAoE;QACpE,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,iBAAiB,CAC/B,GAAoB,EACpB,iBAAoC,EAAE;IAEtC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzE,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,yCAAyC;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAElF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE7D,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/token-controller.d.ts

@@ -41,6 +41,27 @@ import { type TokenService } from './token-service.js';
  * Superseded rows are bounded: they age out under the same
  * `createdAt + refresh ttl` rule as any other token, and revoking the grant
  * end-dates all of them at once.
+ *
+ * ## And so does replay of an authorization code, for the same reason
+ *
+ * RFC 6749 §4.1.2 and §10.5 ask for both halves: deny the replayed code, AND
+ * revoke the tokens already issued from it. Denying alone is the worse of the
+ * two failures, because the redemption that succeeded was the ATTACKER'S. A
+ * code stolen off a loopback callback and raced to this endpoint leaves the
+ * attacker holding a working token pair, while the legitimate client's
+ * redemption comes back as a generic `invalid_grant` that reads exactly like an
+ * ordinary expiry — nobody is told anything, and nothing is undone.
+ *
+ * So a second redemption of one code ends the grant with `reason:
+ * "code_replay"` and sweeps its tokens, the same write `refresh_reuse` makes.
+ * The grant ended is the one belonging to the client the CODE was issued to,
+ * which `redeem` reports back — never the `client_id` the replay happened to
+ * carry, or a stolen code would be a way to disconnect a bystander.
+ *
+ * The one honest limit: a replay arriving after the code's own 120 seconds
+ * resolves to nobody, so there is no grant to reach and the answer is a bare
+ * `invalid_grant`. Every replay that is a race — which is every replay that
+ * matters — arrives well inside that window.
  */
 /** RFC 6749 §5.1's success body. */
 export interface TokenResponse {
@@ -55,6 +76,11 @@ export interface TokenHandlerDeps {
     tokenService: TokenService;
     grantService: GrantService;
     authorizationCodeService: AuthorizationCodeService;
+    /**
+     * Where a request refused for an unidentifiable client is reported. Defaults
+     * to `console.warn`. See `resolveRequestClient` for what the line says.
+     */
+    warn?(message: string): void;
 }
 /** The scope that earns a refresh token, per the discovery document. */
 export declare const OFFLINE_ACCESS_SCOPE = "offline_access";

package/dist/token-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-controller.d.ts","sourceRoot":"","sources":["../src/token-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkC,KAAK,cAAc,EAAiB,MAAM,SAAS,CAAC;AAErG,OAAO,KAAK,EAAE,wBAAwB,EAAiB,MAAM,iCAAiC,CAAC;AAE/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAoB,MAAM,oBAAoB,CAAC;AAIzE,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAI5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,oCAAoC;AACpC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,qBAAqB,CAAC;IACtC,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,wBAAwB,EAAE,wBAAwB,CAAC;CACpD;AAED,wEAAwE;AACxE,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAWrD,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAG7D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG;IAAE,KAAK,EAAE,cAAc,CAAA;CAAE,CAiMrF;AAED,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAarE"}
+{"version":3,"file":"token-controller.d.ts","sourceRoot":"","sources":["../src/token-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkC,KAAK,cAAc,EAAiB,MAAM,SAAS,CAAC;AAErG,OAAO,KAAK,EAAE,wBAAwB,EAAiB,MAAM,iCAAiC,CAAC;AAE/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAoB,MAAM,oBAAoB,CAAC;AAIzE,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAI5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,oCAAoC;AACpC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,qBAAqB,CAAC;IACtC,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,wBAAwB,EAAE,wBAAwB,CAAC;IACnD;;;OAGG;IACH,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,wEAAwE;AACxE,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAYrD,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAG7D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG;IAAE,KAAK,EAAE,cAAc,CAAA;CAAE,CA4NrF;AAED,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAarE"}

package/dist/token-controller.js

@@ -16,7 +16,7 @@ exports.OFFLINE_ACCESS_SCOPE = 'offline_access';
 /** Redemption failures, mapped to the wire. */
 const REDEEM_ERROR = {
     unknown_code: 'the authorization code is unknown, expired or already used',
-    already_redeemed: 'the authorization code has already been redeemed',
+    already_redeemed: 'this authorization code has already been redeemed; anything it granted has been revoked',
     expired: 'the authorization code has expired',
     client_mismatch: 'the authorization code was issued to a different client',
     redirect_uri_mismatch: 'redirect_uri does not match the one the code was issued for',
@@ -30,7 +30,8 @@ function parseScopes(raw) {
 function createTokenHandlers(deps) {
     const { clientRegistry, tokenService, grantService, authorizationCodeService } = deps;
     /** Shared with `/oauth/revoke`, so the two doors cannot disagree. */
-    const resolveClient = (body) => (0, request_client_js_1.resolveRequestClient)(clientRegistry, body);
+    const warn = deps.warn ?? ((message) => console.warn(`[cap-oauth-server] ${message}`));
+    const resolveClient = (body) => (0, request_client_js_1.resolveRequestClient)(clientRegistry, body, { endpoint: 'POST /oauth/token', warn });
     /**
      * End-date every token the grant holds, then the grant itself.
      *
@@ -43,6 +44,36 @@ function createTokenHandlers(deps) {
         await tokenService.revokeTokensForClient(userId, grant.client_public_id);
         await grantService.end(userId, grant.grant_id, reason);
     }
+    /**
+     * A code was presented twice: end the grant the first redemption created.
+     *
+     * Idempotent and quiet by design. `findActive` answers `null` when the first
+     * redemption never got as far as a grant — a replay of a code whose original
+     * redemption failed PKCE, or a third presentation after the second already
+     * revoked — and there is nothing to do in either case. The refusal below is
+     * the same either way, so the caller learns nothing from which happened.
+     *
+     * A lost revision race is swallowed for the same reason. Something else wrote
+     * `oauth-grants` between the read and the write — a person disconnecting, or a
+     * second replay a millisecond behind this one — and in every version of that
+     * the grant is being ended anyway. Turning it into a 500 would answer a
+     * REPLAY with a server error, which is the one answer that tells an attacker
+     * something. The tokens are already swept by then regardless.
+     */
+    async function revokeForCodeReplay(userId, clientPublicId) {
+        if (userId === undefined || clientPublicId === undefined)
+            return;
+        const grant = await grantService.findActive(userId, clientPublicId);
+        if (!grant)
+            return;
+        try {
+            await revokeGrant(userId, grant, 'code_replay');
+        }
+        catch (err) {
+            if (!(0, user_store_js_1.isStaleWriteError)(err))
+                throw err;
+        }
+    }
     /** Mint the pair and answer. One place, so the two grants cannot drift. */
     async function issueTokens(userId, client, grant) {
         const access = await tokenService.mint(userId, token_service_js_1.OAUTH_ACCESS_DOMAIN, client.publicId);
@@ -71,24 +102,18 @@ function createTokenHandlers(deps) {
         // PKCE is required, not optional: OAuth 2.1 requires it for public clients
         // and every client here is public.
         const verifier = (0, body_field_js_1.required)(body, 'code_verifier');
-        let redeemed;
-        try {
-            redeemed = await authorizationCodeService.redeem({
-                code,
-                clientId: client.clientId,
-                clientPublicId: client.publicId,
-                redirectUri,
-            });
-        }
-        catch (err) {
-            // The single-use claim is the property write, so losing its revision
-            // check means another request redeemed this code first.
-            if ((0, user_store_js_1.isStaleWriteError)(err)) {
-                throw new oauth_error_js_1.OAuthError('invalid_grant', 'the authorization code has already been redeemed');
-            }
-            throw err;
-        }
+        const redeemed = await authorizationCodeService.redeem({
+            code,
+            clientId: client.clientId,
+            clientPublicId: client.publicId,
+            redirectUri,
+        });
         if (!redeemed.ok) {
+            if (redeemed.reason === 'already_redeemed') {
+                // The replay. See the header for why denying it is not enough, and why
+                // the client revoked is the code's own rather than this request's.
+                await revokeForCodeReplay(redeemed.userId, redeemed.clientPublicId);
+            }
             throw new oauth_error_js_1.OAuthError('invalid_grant', REDEEM_ERROR[redeemed.reason]);
         }
         const { record, userId } = redeemed;

package/dist/token-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-controller.js","sourceRoot":"","sources":["../src/token-controller.ts"],"names":[],"mappings":";;;AAsFA,kCAGC;AAED,kDAiMC;AAeD,8CAaC;AAxTD,qCAAqG;AAGrG,mDAAkD;AAGlD,qDAA4D;AAC5D,uCAAgD;AAChD,2DAA2D;AAC3D,yDAI4B;AAE5B,mDAAoD;AA0DpD,wEAAwE;AAC3D,QAAA,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,+CAA+C;AAC/C,MAAM,YAAY,GAAkC;IAClD,YAAY,EAAE,4DAA4D;IAC1E,gBAAgB,EAAE,kDAAkD;IACpE,OAAO,EAAE,oCAAoC;IAC7C,eAAe,EAAE,yDAAyD;IAC1E,qBAAqB,EAAE,6DAA6D;CACrF,CAAC;AAEF,iFAAiF;AACjF,SAAgB,WAAW,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAsB;IACxD,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,wBAAwB,EAAE,GAAG,IAAI,CAAC;IAEtF,qEAAqE;IACrE,MAAM,aAAa,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,IAAA,wCAAoB,EAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAEpF;;;;;;;OAOG;IACH,KAAK,UAAU,WAAW,CACxB,MAAc,EACd,KAAuB,EACvB,MAAc;QAEd,MAAM,YAAY,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,2EAA2E;IAC3E,KAAK,UAAU,WAAW,CACxB,MAAc,EACd,MAAmB,EACnB,KAAuB;QAEvB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,sCAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAErF,MAAM,QAAQ,GAAkB;YAC9B,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,YAAY,CAAC,aAAa,CAAC,sCAAmB,CAAC;YAC3D,oEAAoE;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SAC9B,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAAoB,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,uCAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvF,sEAAsE;YACtE,wDAAwD;YACxD,MAAM,YAAY,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC9E,QAAQ,CAAC,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;QACzC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,sBAAsB,CAAC,IAAa;QACjD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,WAAW,GAAG,IAAA,wBAAQ,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACnD,2EAA2E;QAC3E,mCAAmC;QACnC,MAAM,QAAQ,GAAG,IAAA,wBAAQ,EAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAEjD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC;gBAC/C,IAAI;gBACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,cAAc,EAAE,MAAM,CAAC,QAAQ;gBAC/B,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,wDAAwD;YACxD,IAAI,IAAA,iCAAiB,EAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAA,6BAAmB,EAAC,QAAQ,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACxF,yEAAyE;YACzE,0EAA0E;YAC1E,uDAAuD;YACvD,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,iDAAiD,CAAC,CAAC;QAC3F,CAAC;QAED,4EAA4E;QAC5E,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE;YAC/C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,IAAa;QAC5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAA,wBAAQ,EAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAElD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,uCAAoB,EAAE,SAAS,CAAC,CAAC;QAC7E,uEAAuE;QACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,QAAQ,CAAC,cAAc,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC/C,wEAAwE;YACxE,wEAAwE;YACxE,aAAa;YACb,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;YAC3D,MAAM,IAAI,2BAAU,CAClB,eAAe,EACf,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAA,qBAAK,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,8BAA8B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACnE,wEAAwE;YACxE,8DAA8D;YAC9D,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAA,iCAAiB,EAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,sEAAsE;gBACtE,sEAAsE;gBACtE,yDAAyD;gBACzD,MAAM,IAAI,2BAAU,CAAC,yBAAyB,EAAE,oCAAoC,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAmB,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAI,EAAE,EAAE;QACxE,2EAA2E;QAC3E,iBAAiB;QACjB,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,wBAAQ,EAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAEnD,IAAI,QAAuB,CAAC;YAC5B,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;gBACvC,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBACzC,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,2BAAU,CAClB,wBAAwB,EACxB,2EAA2E,SAAS,EAAE,CACvF,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAA,6BAAY,EAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,IAAI,GAAG,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;oBACnC,iEAAiE;oBACjE,mDAAmD;oBACnD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;gBACxC,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAOD;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IACxB,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE1C,MAAM,CAAC,IAAI,CACT,cAAc,EACd,IAAA,oBAAU,EAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EACtC,IAAA,cAAI,EAAC,EAAE,KAAK,EAAE,CAAC,EACf,QAAQ,CAAC,KAAK,CACf,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"token-controller.js","sourceRoot":"","sources":["../src/token-controller.ts"],"names":[],"mappings":";;;AAiHA,kCAGC;AAED,kDA4NC;AAeD,8CAaC;AA9WD,qCAAqG;AAGrG,mDAAkD;AAGlD,qDAA4D;AAC5D,uCAAgD;AAChD,2DAA2D;AAC3D,yDAI4B;AAE5B,mDAAoD;AAoFpD,wEAAwE;AAC3D,QAAA,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,+CAA+C;AAC/C,MAAM,YAAY,GAAkC;IAClD,YAAY,EAAE,4DAA4D;IAC1E,gBAAgB,EACd,yFAAyF;IAC3F,OAAO,EAAE,oCAAoC;IAC7C,eAAe,EAAE,yDAAyD;IAC1E,qBAAqB,EAAE,6DAA6D;CACrF,CAAC;AAEF,iFAAiF;AACjF,SAAgB,WAAW,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAsB;IACxD,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,wBAAwB,EAAE,GAAG,IAAI,CAAC;IAEtF,qEAAqE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/F,MAAM,aAAa,GAAG,CAAC,IAAa,EAAE,EAAE,CACtC,IAAA,wCAAoB,EAAC,cAAc,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtF;;;;;;;OAOG;IACH,KAAK,UAAU,WAAW,CACxB,MAAc,EACd,KAAuB,EACvB,MAAc;QAEd,MAAM,YAAY,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,UAAU,mBAAmB,CAChC,MAA0B,EAC1B,cAAkC;QAElC,IAAI,MAAM,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO;QACjE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAA,iCAAiB,EAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QACzC,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,KAAK,UAAU,WAAW,CACxB,MAAc,EACd,MAAmB,EACnB,KAAuB;QAEvB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,sCAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAErF,MAAM,QAAQ,GAAkB;YAC9B,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,YAAY,CAAC,aAAa,CAAC,sCAAmB,CAAC;YAC3D,oEAAoE;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SAC9B,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAAoB,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,uCAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvF,sEAAsE;YACtE,wDAAwD;YACxD,MAAM,YAAY,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC9E,QAAQ,CAAC,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;QACzC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,sBAAsB,CAAC,IAAa;QACjD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,WAAW,GAAG,IAAA,wBAAQ,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACnD,2EAA2E;QAC3E,mCAAmC;QACnC,MAAM,QAAQ,GAAG,IAAA,wBAAQ,EAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAEjD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC;YACrD,IAAI;YACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,WAAW;SACZ,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBAC3C,uEAAuE;gBACvE,mEAAmE;gBACnE,MAAM,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAA,6BAAmB,EAAC,QAAQ,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACxF,yEAAyE;YACzE,0EAA0E;YAC1E,uDAAuD;YACvD,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,iDAAiD,CAAC,CAAC;QAC3F,CAAC;QAED,4EAA4E;QAC5E,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE;YAC/C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,IAAa;QAC5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAA,wBAAQ,EAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAElD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,uCAAoB,EAAE,SAAS,CAAC,CAAC;QAC7E,uEAAuE;QACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,QAAQ,CAAC,cAAc,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC/C,wEAAwE;YACxE,wEAAwE;YACxE,aAAa;YACb,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;YAC3D,MAAM,IAAI,2BAAU,CAClB,eAAe,EACf,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAA,qBAAK,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,2BAAU,CAAC,eAAe,EAAE,8BAA8B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACnE,wEAAwE;YACxE,8DAA8D;YAC9D,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAA,iCAAiB,EAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,sEAAsE;gBACtE,sEAAsE;gBACtE,yDAAyD;gBACzD,MAAM,IAAI,2BAAU,CAAC,yBAAyB,EAAE,oCAAoC,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAmB,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAI,EAAE,EAAE;QACxE,2EAA2E;QAC3E,iBAAiB;QACjB,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,wBAAQ,EAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAEnD,IAAI,QAAuB,CAAC;YAC5B,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;gBACvC,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBACzC,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,2BAAU,CAClB,wBAAwB,EACxB,2EAA2E,SAAS,EAAE,CACvF,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAA,6BAAY,EAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,IAAI,GAAG,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;oBACnC,iEAAiE;oBACjE,mDAAmD;oBACnD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;gBACxC,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAOD;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IACxB,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE1C,MAAM,CAAC,IAAI,CACT,cAAc,EACd,IAAA,oBAAU,EAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EACtC,IAAA,cAAI,EAAC,EAAE,KAAK,EAAE,CAAC,EACf,QAAQ,CAAC,KAAK,CACf,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/types.d.ts

@@ -59,6 +59,8 @@ export interface ClientMetadataInput {
     response_types?: unknown;
     scope?: unknown;
     token_endpoint_auth_method?: unknown;
+    /** Read only to decide whether a non-`none` method may be stored as `none`. */
+    token_endpoint_auth_methods_supported?: unknown;
     [key: string]: unknown;
 }
 /** What an operator hands `registerStaticClient`. Typed, because it is code. */
@@ -98,6 +100,8 @@ export interface ClientIdMetadataDocument {
     response_types?: unknown;
     scope?: unknown;
     token_endpoint_auth_method?: unknown;
+    /** Read only to decide whether a non-`none` method may be stored as `none`. */
+    token_endpoint_auth_methods_supported?: unknown;
     [key: string]: unknown;
 }
 /**

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qDAAqD;AACrD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,mBAAmB,GAAG,QAAQ,CAAC;AAEpE,4EAA4E;AAC5E,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,CAAC;AAEnD,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA+C,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,4DAA4D;AAC5D,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAClF,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9F,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7E,MAAM,CAAC,IAAI,EAAE;QACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/B,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnF,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qDAAqD;AACrD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,mBAAmB,GAAG,QAAQ,CAAC;AAEpE,4EAA4E;AAC5E,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,CAAC;AAEnD,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA+C,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,4DAA4D;AAC5D,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,+EAA+E;IAC/E,qCAAqC,CAAC,EAAE,OAAO,CAAC;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,+EAA+E;IAC/E,qCAAqC,CAAC,EAAE,OAAO,CAAC;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAClF,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9F,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7E,MAAM,CAAC,IAAI,EAAE;QACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/B,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnF,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boopkit/cap-oauth-server",
-  "version": "0.1.4",
+  "version": "0.3.1",
   "description": "Make a boop app an OAuth 2.1 authorization server and resource server, so an MCP client can act on behalf of one of its users",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -20,10 +20,10 @@
     "build": "tsc -p tsconfig.json"
   },
   "dependencies": {
-    "@boopkit/cap-users": "^0.8.0",
     "@boopkit/logger": "^0.4.0"
   },
   "peerDependencies": {
+    "@boopkit/cap-users": ">=0.9.0 <1",
     "express": ">=4.0.0"
   },
   "devDependencies": {