@boxxy/auth-oauth 0.2.6 → 0.2.8

package/src/http/create-public-door.ts

@@ -1,22 +1,20 @@
-// Adapted from atc: packages/mcp/src/http/start-mcp-http-server.ts at commit 4fe647cf.
-
+import type { Database } from 'bun:sqlite';
 import { mkdirSync } from 'node:fs';
 import { dirname } from 'node:path';
-import { APPROVAL_WINDOW_SECONDS } from '../auth/approval-window-seconds.ts';
-import { createApprovalState } from '../auth/create-approval-state.ts';
+import type { GrantScope } from '@boxxy/contract';
+import { grantScopes } from '@boxxy/contract';
+import { DEFAULT_PATHS, openMCPAuth } from '@zgeoff/mcp-auth';
+import type { MCPAuth, Requester } from '@zgeoff/mcp-auth';
+import { createMCPHTTPApp } from '@zgeoff/mcp-auth/elysia';
 import { createAuthAdmin } from '../auth/create-auth-admin.ts';
 import type { AuthAdmin } from '../auth/create-auth-admin.ts';
-import { createEnrollmentState } from '../auth/create-enrollment-state.ts';
 import { createSecurityEventLog } from '../auth/create-security-event-log.ts';
 import { openAuthDatabase } from '../auth/open-auth-database.ts';
-import { openMCPAuth } from '../auth/open-mcp-auth.ts';
-import type { HTTPServerContext, Requester } from '../auth/types.ts';
+import { runAuthMigrations } from '../migrations/run-auth-migrations.ts';
 import type { AuthClock } from '../utils/types.ts';
-import type { McpServe } from './answer-mcp-request.ts';
-import { createMCPHTTPApp } from './create-mcp-http-app.ts';
 import { isLoopbackHost } from './is-loopback-host.ts';
 import { normalizePublicURL } from './normalize-public-url.ts';
-import { PUBLIC_DOOR_PATHS } from './public-door-paths.ts';
+import type { McpServe } from './types.ts';
 
 export interface PublicDoorOptions {
   // The origin clients reach the door at: the OAuth issuer.
@@ -33,6 +31,9 @@ export interface PublicDoorOptions {
   // Receives one JSON line per sign-in outcome or refused token.
   readonly writeSecurityLine: (line: string) => void;
 
+  // Receives a failed sweep of the expired tokens and the sign-ins that never finished.
+  readonly onSweepError: (error: unknown) => void;
+
   // The address of the socket a request came in on, or null.
   readonly readPeer: (request: Request) => string | null;
 
@@ -48,6 +49,9 @@ export interface PublicDoor {
   // The door answers to the loopback address on this port as well as to its public host.
   readonly addLocalPort: (port: number) => void;
   readonly admin: AuthAdmin;
+
+  // The OAuth server itself, for the test helpers that sign a client in.
+  readonly auth: MCPAuth<GrantScope>;
   readonly stop: () => Promise<void>;
 }
 
@@ -62,8 +66,12 @@ const systemClock: AuthClock = {
   },
 };
 
-// Opens the authorization database and builds the door's routes. Throws on a public URL that is
-// not an https origin, or not a loopback address while the door listens beyond loopback.
+// The door serves no path of its own beside the OAuth server's, and no route lives under this.
+const NO_APP_PREFIX = '/.boxxy-none';
+
+// Opens and migrates the authorization database and builds the door's routes. Throws on a public
+// URL that is not an https origin, or not a loopback address while the door listens beyond
+// loopback.
 export async function createPublicDoor(options: PublicDoorOptions): Promise<PublicDoor> {
   const clock = options.clock ?? systemClock;
   const origin = normalizePublicURL(options.publicURL);
@@ -104,34 +112,43 @@ export async function createPublicDoor(options: PublicDoorOptions): Promise<Publ
 
   mkdirSync(dirname(options.dbPath), { recursive: true });
 
-  const store = await openMCPAuth({
-    dbPath: options.dbPath,
-    openDatabase: openAuthDatabase,
-    origin,
+  const sqlite = openAuthDatabase(options.dbPath);
+
+  const auth = await openAuth(sqlite, origin, clock, security).catch((error: unknown) => {
+    sqlite.close();
+    throw error;
   });
 
   const hosts = new Set<string>([new URL(origin).host]);
   const origins = new Set<string>([origin]);
 
-  const context: HTTPServerContext = {
-    origin,
-    resource: `${origin}${PUBLIC_DOOR_PATHS.machine.mcp}`,
-    store,
-    approvals: createApprovalState(APPROVAL_WINDOW_SECONDS * 1000, () => clock.now()),
-    enrollments: createEnrollmentState(() => clock.now()),
-    security,
-    clock,
-  };
+  const metadataURL = `${origin}${DEFAULT_PATHS.machine.mcpResourceMetadata}`;
 
   const app = createMCPHTTPApp({
+    auth,
     hosts,
     origins,
-    readContext: () => context,
     readRequester,
-    serveMCP: options.serveMCP,
     security,
+    mcp: {
+      // The adapter answers only a request whose bearer token verified, so the header holds one.
+      // oxlint-disable-next-line zgeoff/function-verb -- the adapter's option names this method fetch
+      fetch: (request, access) =>
+        options.serveMCP(request, {
+          token:
+            /^Bearer (?<token>\S+)$/iu.exec(request.headers.get('authorization') ?? '')?.groups?.[
+              'token'
+            ] ?? '',
+          clientId: access.clientID,
+          scopes: [...access.scopes],
+          resourceMetadataUrl: metadataURL,
+        }),
+    },
+    besidePrefix: NO_APP_PREFIX,
   });
 
+  const sweep = startSweep(auth, clock, options.onSweepError);
+
   return {
     answerRequest: (request) => app.handle(request),
     addLocalPort: (port) => {
@@ -140,11 +157,78 @@ export async function createPublicDoor(options: PublicDoorOptions): Promise<Publ
       origins.add(`http://127.0.0.1:${port}`);
       origins.add(`http://localhost:${port}`);
     },
-    admin: createAuthAdmin({ store, origin, clock }),
+    admin: createAuthAdmin({ auth, origin }),
+    auth,
     stop: async () => {
-      await store.close();
+      sweep.stop();
 
+      await auth.close();
+
+      sqlite.close();
       security.drain();
     },
   };
 }
+
+async function openAuth(
+  sqlite: Database,
+  origin: string,
+  clock: AuthClock,
+  security: ReturnType<typeof createSecurityEventLog>,
+): Promise<MCPAuth<GrantScope>> {
+  await runAuthMigrations(sqlite);
+
+  return openMCPAuth({
+    database: sqlite,
+    origin,
+    productName: 'boxxy',
+    scopes: grantScopes,
+    paths: DEFAULT_PATHS,
+    tables: { passkey: 'boxxy_passkey', enrollmentToken: 'boxxy_enrollment_token' },
+    clock,
+    security,
+
+    // Each MCP request builds its own server and holds no stream open, so a revoke has nothing to
+    // end beyond the tokens the package deletes.
+    onGrantRevoked: () => {},
+  });
+}
+
+// Each passkey login makes a grant row, which stays until a sweep finds it unfinished an hour on.
+const SWEEP_MS = 15 * 60_000;
+
+function startSweep(
+  auth: MCPAuth<GrantScope>,
+  clock: AuthClock,
+  onError: (error: unknown) => void,
+): { readonly stop: () => void } {
+  let cancel: (() => void) | null = null;
+  let isStopped = false;
+
+  const runSweep = async (): Promise<void> => {
+    try {
+      await auth.removeExpired();
+    } catch (error) {
+      onError(error);
+    }
+
+    if (!isStopped) {
+      scheduleNext();
+    }
+  };
+
+  const scheduleNext = (): void => {
+    cancel = clock.schedule(() => {
+      void runSweep();
+    }, SWEEP_MS);
+  };
+
+  scheduleNext();
+
+  return {
+    stop: () => {
+      isStopped = true;
+      cancel?.();
+    },
+  };
+}

package/src/http/is-loopback-host.ts

@@ -1,5 +1,3 @@
-// Copied from atc: packages/mcp/src/http/is-loopback-host.ts at commit 4fe647cf.
-
 export function isLoopbackHost(host: string): boolean {
   return (
     host === 'localhost' ||

package/src/http/normalize-public-url.ts

@@ -1,5 +1,3 @@
-// Copied from atc: packages/mcp/src/http/normalize-public-url.ts at commit 4fe647cf.
-
 import { isLoopbackHost } from './is-loopback-host.ts';
 
 export function normalizePublicURL(raw: string): string {

package/src/http/types.ts

@@ -0,0 +1,11 @@
+// What the MCP transport reads of a verified token: the scopes it holds, and the resource metadata
+// that a scope challenge points at.
+export interface McpAuthInfo {
+  readonly token: string;
+  readonly clientId: string;
+  readonly scopes: string[];
+  readonly resourceMetadataUrl: string;
+}
+
+// Serves one MCP request for a token that verified.
+export type McpServe = (request: Request, authInfo: McpAuthInfo) => Promise<Response>;

package/src/index.ts

@@ -1,8 +1,12 @@
-export type { AddClientAnswer, AuthAdmin, EnrollmentLink } from './auth/create-auth-admin.ts';
-export type { McpAuthInfo, McpServe } from './http/answer-mcp-request.ts';
+export type {
+  AddClientAnswer,
+  AuthAdmin,
+  AuthGrantView,
+  EnrollmentLink,
+  RemoveClientAnswer,
+} from './auth/create-auth-admin.ts';
+
+export type { McpAuthInfo, McpServe } from './http/types.ts';
 export type { PublicDoor, PublicDoorOptions } from './http/create-public-door.ts';
 export { createPublicDoor } from './http/create-public-door.ts';
-export type { ClientView } from './auth/read-client-views.ts';
-export type { GrantView } from './auth/read-grant-views.ts';
-export type { VerifiedAccess } from './auth/types.ts';
 export { isLoopbackHost } from './http/is-loopback-host.ts';

package/src/migrations/grant-rows-migration.ts

@@ -0,0 +1,108 @@
+import { sql } from 'kysely';
+import type { Kysely } from 'kysely';
+import type { Migration } from 'kysely/migration';
+
+// The time better-auth writes, as ISO 8601 text in UTC with milliseconds, so the text compares in
+// time order.
+const now = sql`strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`;
+
+// better-auth 1.7.15 made the token and session tables with `userId` referencing `user(id)` on
+// delete cascade, so only `user` needs a rebuild.
+const statements = [
+  sql`CREATE TEMP TABLE boxxy_grant_token AS
+    SELECT authorizationCodeId AS grantId, clientId, scopes, createdAt, expiresAt, revoked
+      FROM oauthRefreshToken WHERE authorizationCodeId IS NOT NULL
+    UNION ALL
+    SELECT authorizationCodeId, clientId, scopes, createdAt, expiresAt, revoked
+      FROM oauthAccessToken WHERE authorizationCodeId IS NOT NULL`,
+
+  // SQLite cannot add a NOT NULL column with no default, so the table is made anew, in the shape
+  // the package's better-auth gives a new database.
+  sql`CREATE TABLE boxxy_grant_user (
+    "id" text not null primary key,
+    "name" text not null,
+    "email" text not null unique,
+    "emailVerified" integer not null,
+    "image" text,
+    "createdAt" date not null,
+    "updatedAt" date not null,
+    "clientId" text not null,
+    "scopes" text,
+    "approvedBy" text not null,
+    "limits" text,
+    "lastUsedAt" date
+  )`,
+
+  // With max(), SQLite takes the other bare columns from the row that holds the maximum, so each
+  // grant takes the scopes of its newest live token.
+  sql`INSERT INTO boxxy_grant_user
+      (id, name, email, emailVerified, image, createdAt, updatedAt, clientId, scopes, approvedBy, limits, lastUsedAt)
+    SELECT
+      live.grantId,
+      coalesce(client.name, live.clientId),
+      live.grantId || '@grant.invalid',
+      1,
+      NULL,
+      first.createdAt,
+      first.createdAt,
+      live.clientId,
+      (SELECT json_group_array(scope.value) FROM json_each(live.scopes) AS scope
+        WHERE scope.value <> 'offline_access'),
+      'passkey',
+      NULL,
+      used.last_used_at
+    FROM (
+      SELECT grantId, clientId, scopes, max(createdAt) AS newestAt FROM boxxy_grant_token
+        WHERE revoked IS NULL AND expiresAt > ${now}
+        GROUP BY grantId
+    ) AS live
+    JOIN (
+      SELECT grantId, min(createdAt) AS createdAt FROM boxxy_grant_token GROUP BY grantId
+    ) AS first ON first.grantId = live.grantId
+    LEFT JOIN oauthClient AS client ON client.clientId = live.clientId
+    LEFT JOIN boxxy_grant_use AS used ON used.grant_id = live.grantId`,
+
+  sql`UPDATE oauthAccessToken SET userId = authorizationCodeId, sessionId = NULL
+    WHERE authorizationCodeId IN (SELECT id FROM boxxy_grant_user)`,
+  sql`DELETE FROM oauthAccessToken
+    WHERE authorizationCodeId IS NULL OR authorizationCodeId NOT IN (SELECT id FROM boxxy_grant_user)`,
+  sql`UPDATE oauthRefreshToken SET userId = authorizationCodeId, sessionId = NULL
+    WHERE authorizationCodeId IN (SELECT id FROM boxxy_grant_user)`,
+  sql`DELETE FROM oauthRefreshToken
+    WHERE authorizationCodeId IS NULL OR authorizationCodeId NOT IN (SELECT id FROM boxxy_grant_user)`,
+
+  // Every session, account and consent belonged to the owner row, and the foreign keys are off, so
+  // its delete cascades to none of them.
+  sql`DELETE FROM session`,
+  sql`DELETE FROM account`,
+  sql`DELETE FROM oauthConsent`,
+  sql`UPDATE oauthClient SET userId = NULL`,
+  sql`DROP TABLE "user"`,
+  sql`ALTER TABLE boxxy_grant_user RENAME TO "user"`,
+  sql`DROP TABLE boxxy_grant_use`,
+  sql`DROP TABLE temp.boxxy_grant_token`,
+];
+
+export const grantRowsMigration: Migration = {
+  up: async (db: Kysely<unknown>) => {
+    const table =
+      await sql`SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'user'`.execute(db);
+
+    // A new database has no tables yet: better-auth makes them when the package opens it.
+    if (table.rows.length === 0) {
+      return;
+    }
+
+    for (const statement of statements) {
+      await statement.execute(db);
+    }
+
+    const broken = await sql`PRAGMA foreign_key_check`.execute(db);
+
+    if (broken.rows.length > 0) {
+      throw new Error(
+        `the grant migration left ${broken.rows.length} rows whose foreign key points at no row`,
+      );
+    }
+  },
+};

package/src/migrations/run-auth-migrations.ts

@@ -0,0 +1,53 @@
+import type { Database } from 'bun:sqlite';
+import { buildSQLiteDialect } from '@zgeoff/kysely-bun-sqlite';
+import { Kysely, sql } from 'kysely';
+import { Migrator } from 'kysely/migration';
+import { grantRowsMigration } from './grant-rows-migration.ts';
+
+// Kysely's SQLite adapter reports no transactional DDL, so its Migrator opens no transaction; the
+// runner opens one itself, around every migration and its record. SQLite ignores the foreign_keys
+// pragma inside a transaction, so the keys go off before it, since a dropped table runs cascades.
+export async function runAuthMigrations(sqlite: Database): Promise<void> {
+  sqlite.run('PRAGMA foreign_keys = OFF;');
+
+  const db = new Kysely<unknown>({ dialect: buildSQLiteDialect(sqlite) });
+
+  try {
+    await db.connection().execute(async (connection) => {
+      await sql`BEGIN IMMEDIATE`.execute(connection);
+
+      try {
+        await runMigrator(connection);
+
+        await sql`COMMIT`.execute(connection);
+      } catch (error) {
+        await sql`ROLLBACK`.execute(connection);
+
+        throw error;
+      }
+    });
+  } finally {
+    await db.destroy();
+
+    sqlite.run('PRAGMA foreign_keys = ON;');
+  }
+}
+
+// Kysely runs the migrations in the order of their names, and skips each one the file has run.
+const migrations = {
+  '0001-grant-rows': grantRowsMigration,
+};
+
+async function runMigrator(db: Kysely<unknown>): Promise<void> {
+  const migrator = new Migrator({
+    db,
+    provider: { getMigrations: () => Promise.resolve(migrations) },
+    disableTransactions: true,
+  });
+
+  const outcome = await migrator.migrateToLatest();
+
+  if (outcome.error !== undefined) {
+    throw new Error('the auth database migrations failed', { cause: outcome.error });
+  }
+}

package/src/test-utils/authorize-test-client.ts

@@ -1,194 +1,2 @@
-import { createHash, randomBytes } from 'node:crypto';
-import { z } from 'zod';
-import type { PublicDoor } from '../http/create-public-door.ts';
-import { buildStubAuthenticator } from './build-stub-authenticator.ts';
-
-interface AuthorizeInput {
-  // the origin the door was created with, such as `https://boxxy.example`
-  readonly origin: string;
-
-  // the scopes the client asks for, and the ones the owner ticks on the consent page
-  readonly requested: readonly string[];
-  readonly ticked: readonly string[];
-}
-
-export interface TestGrant {
-  readonly clientID: string;
-  readonly accessToken: string;
-  readonly refreshToken: string;
-}
-
-const tokenSchema = z.object({ access_token: z.string(), refresh_token: z.string() });
-
-// Runs the whole sign-in against a door, the way a client and the owner's browser would: enrolls a
-// passkey, adds a client, then authorizes it with a passkey sign-in, consent and a code exchange.
-export async function authorizeTestClient(
-  door: PublicDoor,
-  input: AuthorizeInput,
-): Promise<TestGrant> {
-  const authenticator = buildStubAuthenticator();
-
-  const host = new URL(input.origin).host;
-
-  const redirectURI = 'https://client.example/callback';
-
-  const send = (path: string, init: RequestInit & { readonly cookie?: string } = {}) => {
-    const headers = new Headers(init.headers);
-
-    headers.set('host', host);
-
-    if (init.method === 'POST') {
-      headers.set('origin', input.origin);
-    }
-
-    if (init.cookie !== undefined) {
-      headers.set('cookie', init.cookie);
-    }
-
-    return door.answerRequest(new Request(`${input.origin}${path}`, { ...init, headers }));
-  };
-
-  const postForm = (
-    path: string,
-    fields: Readonly<Record<string, string | string[]>>,
-    cookie?: string,
-  ) => {
-    const body = new URLSearchParams();
-
-    for (const [name, value] of Object.entries(fields)) {
-      for (const item of [value].flat()) {
-        body.append(name, item);
-      }
-    }
-
-    return send(path, {
-      method: 'POST',
-      headers: { 'content-type': 'application/x-www-form-urlencoded' },
-      body,
-      ...(cookie === undefined ? {} : { cookie }),
-    });
-  };
-
-  const enrollment = await door.admin.enroll();
-  const enrolling = await postForm('/enroll', { token: enrollment.token });
-  const enrollingPage = await enrolling.text();
-
-  const creation = readOptions(enrollingPage);
-
-  const registration = await authenticator.create(
-    {
-      challenge: String(creation['challenge']),
-      rp: { id: new URL(input.origin).hostname },
-      user: { id: 'b3duZXI' },
-    },
-    { origin: input.origin },
-  );
-
-  const enrolled = await postForm('/enroll', {
-    token: enrollment.token,
-    credential: JSON.stringify(registration),
-  });
-
-  if (enrolled.status !== 200) {
-    throw new Error(`the stub passkey did not enroll: ${enrolled.status}`);
-  }
-
-  const added = await door.admin.addClient('test client', [redirectURI]);
-
-  if (added.kind !== 'added') {
-    throw new Error('the test client was refused');
-  }
-
-  const verifier = randomBytes(32).toString('base64url');
-  const challenge = createHash('sha256').update(verifier).digest('base64url');
-
-  const authorizeQuery = new URLSearchParams({
-    response_type: 'code',
-    client_id: added.clientID,
-    redirect_uri: redirectURI,
-    scope: input.requested.join(' '),
-    state: 'state-1',
-    code_challenge: challenge,
-    code_challenge_method: 'S256',
-  });
-
-  const authorized = await send(`/oauth2/authorize?${authorizeQuery.toString()}`);
-
-  const loginLocation = new URL(authorized.headers.get('location') ?? '', input.origin);
-
-  const oauthQuery = loginLocation.search.slice(1);
-
-  const loginPage = await send(`${loginLocation.pathname}${loginLocation.search}`);
-  const loginHtml = await loginPage.text();
-
-  const request = readOptions(loginHtml);
-
-  const assertion = await authenticator.signAssertion(
-    { challenge: String(request['challenge']), rpId: new URL(input.origin).hostname },
-    { origin: input.origin },
-  );
-
-  const signedIn = await postForm('/login', {
-    oauth_query: oauthQuery,
-    credential: JSON.stringify(assertion),
-  });
-
-  const cookie = signedIn.headers
-    .getSetCookie()
-    .map((line) => line.split(';')[0])
-    .join('; ');
-
-  const consentLocation = new URL(signedIn.headers.get('location') ?? '', input.origin);
-
-  const consented = await postForm(
-    '/consent',
-    {
-      oauth_query: consentLocation.search.slice(1),
-      decision: 'approve',
-      scope: [...input.ticked],
-    },
-    cookie,
-  );
-
-  const code = new URL(consented.headers.get('location') ?? '', redirectURI).searchParams.get(
-    'code',
-  );
-
-  if (code === null) {
-    throw new Error(`the consent issued no code: ${consented.status}`);
-  }
-
-  const exchanged = await postForm('/oauth2/token', {
-    grant_type: 'authorization_code',
-    code,
-    redirect_uri: redirectURI,
-    client_id: added.clientID,
-    code_verifier: verifier,
-    resource: `${input.origin}/mcp`,
-  });
-
-  const exchangedBody: unknown = await exchanged.json();
-
-  const tokens = tokenSchema.parse(exchangedBody);
-
-  return {
-    clientID: added.clientID,
-    accessToken: tokens.access_token,
-    refreshToken: tokens.refresh_token,
-  };
-}
-
-const scriptSchema = z.object({ options: z.record(z.string(), z.unknown()) });
-
-// The WebAuthn options that a page carries in its passkey script block.
-function readOptions(page: string): Record<string, unknown> {
-  const block = /<script type="application\/json" id="boxxy-passkey">(?<json>.*?)<\/script>/su.exec(
-    page,
-  )?.groups?.['json'];
-
-  if (block === undefined) {
-    throw new Error('the page carries no passkey options');
-  }
-
-  return scriptSchema.parse(JSON.parse(block.replaceAll(String.raw`\u003c`, '<'))).options;
-}
+// Signs a client in through a door's OAuth server, with a stub passkey: pass it `door.auth`.
+export { authorizeTestClient } from '@zgeoff/mcp-auth/testing';

package/src/test-utils/build-stub-clock.ts

@@ -1,5 +1,3 @@
-// Copied from atc: packages/test-utils/src/build-stub-clock.ts at commit 4fe647cf.
-
 import type { AuthClock } from '../utils/types.ts';
 
 interface StubTimer {

package/src/test-utils/pre-package-schema.ts

@@ -0,0 +1,36 @@
+// The schema of the auth database before boxxy moved to `@zgeoff/mcp-auth`, as better-auth 1.7.15
+// and boxxy's own tables made it.
+export const PRE_PACKAGE_SCHEMA = [
+  'CREATE TABLE "user" ("id" text not null primary key, "name" text not null, "email" text not null unique, "emailVerified" integer not null, "image" text, "createdAt" date not null, "updatedAt" date not null)',
+  'CREATE TABLE "session" ("id" text not null primary key, "expiresAt" date not null, "token" text not null unique, "createdAt" date not null, "updatedAt" date not null, "ipAddress" text, "userAgent" text, "userId" text not null references "user" ("id") on delete cascade)',
+  'CREATE TABLE "account" ("id" text not null primary key, "accountId" text not null, "providerId" text not null, "userId" text not null references "user" ("id") on delete cascade, "accessToken" text, "refreshToken" text, "idToken" text, "accessTokenExpiresAt" date, "refreshTokenExpiresAt" date, "scope" text, "password" text, "createdAt" date not null, "updatedAt" date not null)',
+  'CREATE TABLE "verification" ("id" text not null primary key, "identifier" text not null, "value" text not null, "expiresAt" date not null, "createdAt" date not null, "updatedAt" date not null)',
+  'CREATE TABLE "oauthClient" ("id" text not null primary key, "clientId" text not null unique, "clientSecret" text, "clientDiscoveryId" text, "disabled" integer, "skipConsent" integer, "enableEndSession" integer, "subjectType" text, "scopes" text, "clientCredentialsScopes" text, "userId" text references "user" ("id") on delete cascade, "createdAt" date, "updatedAt" date, "name" text, "uri" text, "icon" text, "contacts" text, "tos" text, "policy" text, "softwareId" text, "softwareVersion" text, "softwareStatement" text, "redirectUris" text not null, "postLogoutRedirectUris" text, "backchannelLogoutUri" text, "backchannelLogoutSessionRequired" integer, "tokenEndpointAuthMethod" text, "applicationType" text, "jwks" text, "jwksUri" text, "grantTypes" text, "responseTypes" text, "requirePKCE" integer, "dpopBoundAccessTokens" integer, "referenceId" text, "metadata" text)',
+  'CREATE TABLE "oauthResource" ("id" text not null primary key, "identifier" text not null unique, "name" text not null, "accessTokenTtl" integer, "refreshTokenTtl" integer, "signingAlgorithm" text, "signingKeyId" text, "allowedScopes" text, "customClaims" text, "dpopBoundAccessTokensRequired" integer, "disabled" integer, "createdAt" date, "updatedAt" date, "policyVersion" integer, "metadata" text)',
+  'CREATE TABLE "oauthClientResource" ("id" text not null primary key, "clientId" text not null references "oauthClient" ("clientId") on delete cascade, "resourceId" text not null references "oauthResource" ("identifier") on delete cascade, "metadata" text, "createdAt" date)',
+  'CREATE TABLE "oauthRefreshToken" ("id" text not null primary key, "token" text not null unique, "clientId" text not null references "oauthClient" ("clientId") on delete cascade, "sessionId" text references "session" ("id") on delete set null, "userId" text not null references "user" ("id") on delete cascade, "referenceId" text, "authorizationCodeId" text, "resources" text, "requestedUserInfoClaims" text, "expiresAt" date not null, "createdAt" date not null, "revoked" date, "rotatedAt" date, "rotationReplayResponse" text, "rotationReplayExpiresAt" date, "authTime" date, "confirmation" text, "scopes" text not null)',
+  'CREATE TABLE "oauthAccessToken" ("id" text not null primary key, "token" text not null unique, "clientId" text not null references "oauthClient" ("clientId") on delete cascade, "sessionId" text references "session" ("id") on delete set null, "userId" text references "user" ("id") on delete cascade, "referenceId" text, "authorizationCodeId" text, "resources" text, "requestedUserInfoClaims" text, "refreshId" text references "oauthRefreshToken" ("id") on delete cascade, "expiresAt" date not null, "createdAt" date not null, "revoked" date, "confirmation" text, "scopes" text not null)',
+  'CREATE TABLE "oauthConsent" ("id" text not null primary key, "clientId" text not null references "oauthClient" ("clientId") on delete cascade, "userId" text references "user" ("id") on delete cascade, "referenceId" text, "resources" text, "requestedUserInfoClaims" text, "scopes" text not null, "createdAt" date not null, "updatedAt" date not null)',
+  'CREATE TABLE "oauthClientAssertion" ("id" text not null primary key, "expiresAt" date not null)',
+  'CREATE INDEX "session_userId_idx" on "session" ("userId")',
+  'CREATE INDEX "account_userId_idx" on "account" ("userId")',
+  'CREATE INDEX "verification_identifier_idx" on "verification" ("identifier")',
+  'CREATE INDEX "oauthClient_userId_idx" on "oauthClient" ("userId")',
+  'CREATE INDEX "oauthClientResource_clientId_idx" on "oauthClientResource" ("clientId")',
+  'CREATE INDEX "oauthClientResource_resourceId_idx" on "oauthClientResource" ("resourceId")',
+  'CREATE INDEX "oauthRefreshToken_clientId_idx" on "oauthRefreshToken" ("clientId")',
+  'CREATE INDEX "oauthRefreshToken_sessionId_idx" on "oauthRefreshToken" ("sessionId")',
+  'CREATE INDEX "oauthRefreshToken_userId_idx" on "oauthRefreshToken" ("userId")',
+  'CREATE INDEX "oauthRefreshToken_authorizationCodeId_idx" on "oauthRefreshToken" ("authorizationCodeId")',
+  'CREATE INDEX "oauthAccessToken_clientId_idx" on "oauthAccessToken" ("clientId")',
+  'CREATE INDEX "oauthAccessToken_sessionId_idx" on "oauthAccessToken" ("sessionId")',
+  'CREATE INDEX "oauthAccessToken_userId_idx" on "oauthAccessToken" ("userId")',
+  'CREATE INDEX "oauthAccessToken_authorizationCodeId_idx" on "oauthAccessToken" ("authorizationCodeId")',
+  'CREATE INDEX "oauthAccessToken_refreshId_idx" on "oauthAccessToken" ("refreshId")',
+  'CREATE INDEX "oauthConsent_clientId_idx" on "oauthConsent" ("clientId")',
+  'CREATE INDEX "oauthConsent_userId_idx" on "oauthConsent" ("userId")',
+  'CREATE UNIQUE INDEX "oauthClientResource_clientId_resourceId_uidx" on "oauthClientResource" ("clientId", "resourceId")',
+  'CREATE TABLE boxxy_grant_use (grant_id text primary key not null, last_used_at text not null)',
+  'CREATE TABLE boxxy_passkey (id text primary key not null, public_key text not null, counter integer not null, transports text not null, created_at text not null, last_used_at text)',
+  'CREATE TABLE boxxy_enrollment_token (token_hash text primary key not null, created_at text not null, expires_at text not null)',
+];

package/src/test-utils/register-test-cleanup.ts

@@ -1,5 +1,3 @@
-// Copied from atc: packages/test-utils/src/register-test-cleanup.ts at commit 4fe647cf.
-
 import { onTestFinished } from 'bun:test';
 
 // The releases the current test registered, in registration order; null