@c9up/visa 0.1.0 → 0.1.2

package/dist/resource.js

@@ -0,0 +1,101 @@
+/**
+ * Which resource a token is for (RFC 8707).
+ *
+ * A token with no stated audience is a token for everything. Send it to the
+ * wrong server — or let a compromised one replay it — and every other resource
+ * that trusts the same issuer accepts it. The `resource` parameter is how a
+ * client says "this one is for the calendar API", and how the calendar API
+ * refuses one minted for somebody else.
+ *
+ * Read off the RFC rather than recalled: the value MUST be an absolute URI
+ * without a fragment (§2), it MAY repeat, and a resource the server does not
+ * accept is refused with `invalid_target` (§2) — not `invalid_request`, which
+ * would tell a client its request was malformed when it was merely aimed
+ * somewhere it may not go.
+ */
+import { OAuthError } from "./errors.js";
+/**
+ * Normalise however the parameter arrived into a list.
+ *
+ * A form body gives one value or several under the same name, and a query
+ * string the same; both are `resource=` repeated, which parsers hand over
+ * either way.
+ */
+export function readResourceParameter(value) {
+    if (value === undefined || value === null)
+        return [];
+    if (Array.isArray(value)) {
+        return value.filter((entry) => typeof entry === "string");
+    }
+    return typeof value === "string" && value !== "" ? [value] : [];
+}
+/**
+ * Check each one, and refuse the request if any is unusable.
+ *
+ * `invalid_target` for every rejection here, including a malformed URI: §2
+ * names that code for "cannot parse the provided value(s)" as well as for a
+ * resource the server will not issue for.
+ */
+export function validateResources(requested, accepted) {
+    const resources = [];
+    for (const value of requested) {
+        let url;
+        try {
+            url = new URL(value);
+        }
+        catch {
+            throw new OAuthError("invalid_target", `resource must be an absolute URI: ${value}`);
+        }
+        if (url.hash !== "") {
+            throw new OAuthError("invalid_target", `resource must not carry a fragment: ${value}`);
+        }
+        // §2 SHOULD NOT include a query, and recognises that some cases need
+        // one — so it travels rather than being refused or stripped. Stripping
+        // would hand back a token for a resource nobody asked for.
+        if (accepted !== undefined && !accepted.includes(value)) {
+            throw new OAuthError("invalid_target", `this server does not issue tokens for ${value}`);
+        }
+        if (!resources.includes(value))
+            resources.push(value);
+    }
+    return resources;
+}
+/**
+ * What a token request may narrow to.
+ *
+ * A refresh or an exchange may ask for fewer resources than were authorised,
+ * never for more — the same rule scopes follow, and for the same reason: the
+ * user agreed to a set, and a later request must not widen it.
+ */
+export function narrowResources(requested, granted) {
+    if (requested.length === 0)
+        return [...granted];
+    if (granted.length === 0) {
+        // Nothing was bound at authorization time, so there is nothing to narrow
+        // FROM. Letting the request name one here would mint a token for an
+        // audience the user never saw.
+        throw new OAuthError("invalid_target", "this grant is not bound to any resource");
+    }
+    const outside = requested.filter((value) => !granted.includes(value));
+    if (outside.length > 0) {
+        throw new OAuthError("invalid_target", `this grant does not cover ${outside.join(", ")}`);
+    }
+    return [...requested];
+}
+/**
+ * Is this token for me?
+ *
+ * What a resource server asks. A token bound to nothing is accepted — that is
+ * every token issued before a client started sending `resource`, and refusing
+ * them would break each one. A token bound to SOMETHING must name this
+ * resource, or it was minted for another server and arriving here means it
+ * travelled.
+ */
+export function audienceAllows(audience, resource) {
+    if (audience === undefined || audience.length === 0)
+        return true;
+    if (resource === undefined)
+        return true;
+    return audience.includes(resource);
+}
+//# sourceMappingURL=resource.js.map

package/dist/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAChC,SAA4B,EAC5B,QAA4B;IAE5B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,UAAU,CACnB,gBAAgB,EAChB,qCAAqC,KAAK,EAAE,CAC5C,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,UAAU,CACnB,gBAAgB,EAChB,uCAAuC,KAAK,EAAE,CAC9C,CAAC;QACH,CAAC;QACD,qEAAqE;QACrE,uEAAuE;QACvE,2DAA2D;QAC3D,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,UAAU,CACnB,gBAAgB,EAChB,yCAAyC,KAAK,EAAE,CAChD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC9B,SAA4B,EAC5B,OAA0B;IAE1B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,yEAAyE;QACzE,oEAAoE;QACpE,+BAA+B;QAC/B,MAAM,IAAI,UAAU,CACnB,gBAAgB,EAChB,yCAAyC,CACzC,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CACnB,gBAAgB,EAChB,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC7B,QAAuC,EACvC,QAA4B;IAE5B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC"}

package/dist/store.d.ts

@@ -38,6 +38,39 @@ export interface VisaStore {
     revokeFamily(familyId: string, at: Date): Promise<void>;
     findConsent(userId: string, clientId: string): Promise<Consent | null>;
     saveConsent(consent: Consent): Promise<void>;
+    /**
+     * Everything this user has granted, so they can be shown it.
+     *
+     * The consent is the unit a person manages: they authorised an
+     * application, not a token. Tokens come and go under that decision.
+     */
+    listConsents(userId: string): Promise<Consent[]>;
+    /**
+     * Every access token of this user, EXPIRED ONES INCLUDED.
+     *
+     * Included deliberately: "last used" is most interesting precisely when
+     * nothing is live any more, and a screen that hid them would tell a user an
+     * application never touched their data when it did.
+     */
+    listAccessTokens(userId: string): Promise<AccessToken[]>;
+    /**
+     * Cut one application off for one user: every token, both kinds.
+     *
+     * Not the consent — {@link deleteConsent} is separate, because forgetting
+     * the grant and ending the sessions are two different things and a caller
+     * revoking in a panic wants the second one first.
+     */
+    revokeAccessFor(userId: string, clientId: string, at: Date): Promise<void>;
+    /** Forget the grant, so the user is asked again next time. */
+    deleteConsent(userId: string, clientId: string): Promise<void>;
+    /**
+     * Record that an access token was just used.
+     *
+     * Optional, and deliberately best-effort: it is one write per authenticated
+     * request, which a store on a hot path may not want. A store without it
+     * authenticates exactly the same, it simply reports no last use.
+     */
+    touchAccessToken?(tokenHash: string, at: Date): Promise<void>;
     /** Drop what has expired. Optional: a store with a TTL does it itself. */
     prune?(now: Date): Promise<void>;
 }

package/dist/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,iBAAiB,EACjB,MAAM,EACN,OAAO,EACP,YAAY,EACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,SAAS;IACzB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE/C,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC3E;;;;;;OAMG;IACH,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvE,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAChE,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAClE,oEAAoE;IACpE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE;;;;;;OAMG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACvE,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C,0EAA0E;IAC1E,KAAK,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,iBAAiB,EACjB,MAAM,EACN,OAAO,EACP,YAAY,EACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,SAAS;IACzB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE/C,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC3E;;;;;;OAMG;IACH,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvE,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAChE,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAClE,oEAAoE;IACpE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE;;;;;;OAMG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACvE,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C;;;;;OAKG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAEjD;;;;;;OAMG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAEzD;;;;;;OAMG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E,8DAA8D;IAC9D,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;OAMG;IACH,gBAAgB,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D,0EAA0E;IAC1E,KAAK,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC"}

package/dist/stores/atlas.d.ts

@@ -0,0 +1,106 @@
+/**
+ * The store an application running atlas gets for free.
+ *
+ * Twelve methods, two of them atomic, is not something every application
+ * should write again — and the two that matter are exactly the ones a
+ * hand-written store gets subtly wrong. This is that code, once.
+ *
+ * It takes atlas' `db` service rather than importing atlas: the structural
+ * slice below is what the store calls and nothing more, so visa still installs
+ * without a data layer and the package stays as standalone as every other one
+ * here. Built on atlas' query builder rather than on SQL text, deliberately —
+ * dialects are atlas' problem, and it already solves them.
+ *
+ * Every credential arrives HASHED, as the contract states, so what this writes
+ * is what the rest of the package writes: a database copy is not a set of
+ * working tokens.
+ */
+import type { VisaStore } from "../store.js";
+import type { AccessToken, AuthorizationCode, Client, Consent, RefreshToken } from "../types.js";
+/** A row as atlas hands it back. */
+type Row = Record<string, unknown>;
+/** The comparisons atlas' builder accepts. */
+type Operator = "=" | "!=" | ">" | ">=" | "<" | "<=";
+/**
+ * The slice of atlas' `DatabaseQueryBuilder` this store uses.
+ *
+ * Every read here fetches one row, so the slice asks for `first()` and not for
+ * the builder's thenable form. Nothing is declared that nothing calls.
+ */
+export interface AtlasQuery {
+    where(conditions: Row): AtlasQuery;
+    where(column: string, operator: Operator, value: unknown): AtlasQuery;
+    whereNull(column: string): AtlasQuery;
+    orderBy(column: string, direction?: "asc" | "desc"): AtlasQuery;
+    first(): Promise<Row | null>;
+    /** Run the select and return every row — atlas' `exec()`. */
+    exec(): Promise<Row[]>;
+    insert(data: Row): PromiseLike<unknown>;
+    /** Resolves to the number of rows affected, which is what the atomic paths read. */
+    update(data: Row): PromiseLike<number | Row[]>;
+    delete(): PromiseLike<number | Row[]>;
+}
+/** The slice of atlas' `db` service this store uses. */
+export interface AtlasDb {
+    from(table: string): AtlasQuery;
+    table(table: string): AtlasQuery;
+}
+/** Where each kind of row lives. Override one to fit a schema you do not own. */
+export interface AtlasStoreTables {
+    clients?: string;
+    authorizationCodes?: string;
+    accessTokens?: string;
+    refreshTokens?: string;
+    consents?: string;
+}
+export declare class AtlasStore implements VisaStore {
+    #private;
+    constructor(db: AtlasDb, tables?: AtlasStoreTables);
+    findClient(id: string): Promise<Client | null>;
+    /** Persist a registered client. Not on the contract — what `registerClient` writes through. */
+    saveClient(client: Client): Promise<void>;
+    saveAuthorizationCode(code: AuthorizationCode): Promise<void>;
+    findAuthorizationCode(codeHash: string): Promise<AuthorizationCode | null>;
+    /**
+     * One UPDATE, guarded by `consumed_at IS NULL`.
+     *
+     * The single-use guarantee lives in that one statement: two requests racing
+     * with the same code both reach the database, and only the one that finds
+     * the row still unconsumed is allowed to write it. Reading and then writing
+     * would let both through.
+     */
+    consumeAuthorizationCode(codeHash: string, at: Date): Promise<boolean>;
+    saveAccessToken(token: AccessToken): Promise<void>;
+    findAccessToken(tokenHash: string): Promise<AccessToken | null>;
+    revokeAccessToken(tokenHash: string, at: Date): Promise<void>;
+    touchAccessToken(tokenHash: string, at: Date): Promise<void>;
+    saveRefreshToken(token: RefreshToken): Promise<void>;
+    findRefreshToken(tokenHash: string): Promise<RefreshToken | null>;
+    /** Same one-statement guarantee as a code: rotation depends on it. */
+    consumeRefreshToken(tokenHash: string, at: Date): Promise<boolean>;
+    /**
+     * End a family: the refresh tokens AND the access tokens they bought.
+     *
+     * Both, because revoking only the refresh half would leave an access token
+     * already minted alive for its full lifetime — which is most of what this
+     * revocation exists to prevent.
+     */
+    revokeFamily(familyId: string, at: Date): Promise<void>;
+    findConsent(userId: string, clientId: string): Promise<Consent | null>;
+    /**
+     * Record a consent, replacing what was there.
+     *
+     * Delete then insert rather than an upsert: the dialects spell an upsert
+     * three different ways, and re-granting is not a hot path.
+     */
+    saveConsent(consent: Consent): Promise<void>;
+    listConsents(userId: string): Promise<Consent[]>;
+    /** Expired ones included — see the contract for why. */
+    listAccessTokens(userId: string): Promise<AccessToken[]>;
+    revokeAccessFor(userId: string, clientId: string, at: Date): Promise<void>;
+    deleteConsent(userId: string, clientId: string): Promise<void>;
+    /** Drop what has expired and can no longer be presented. */
+    prune(now: Date): Promise<void>;
+}
+export {};
+//# sourceMappingURL=atlas.d.ts.map

package/dist/stores/atlas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atlas.d.ts","sourceRoot":"","sources":["../../src/stores/atlas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EACX,WAAW,EACX,iBAAiB,EACjB,MAAM,EAEN,OAAO,EAEP,YAAY,EACZ,MAAM,aAAa,CAAC;AAErB,oCAAoC;AACpC,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,8CAA8C;AAC9C,KAAK,QAAQ,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC;AAErD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAC1B,KAAK,CAAC,UAAU,EAAE,GAAG,GAAG,UAAU,CAAC;IACnC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,GAAG,UAAU,CAAC;IACtE,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACtC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,UAAU,CAAC;IAChE,KAAK,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC7B,6DAA6D;IAC7D,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACvB,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACxC,oFAAoF;IACpF,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;CACtC;AAED,wDAAwD;AACxD,MAAM,WAAW,OAAO;IACvB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;IAChC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;CACjC;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAgFD,qBAAa,UAAW,YAAW,SAAS;;gBAI/B,EAAE,EAAE,OAAO,EAAE,MAAM,GAAE,gBAAqB;IAYhD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkBpD,+FAA+F;IACzF,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAczC,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB7D,qBAAqB,CAC1B,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAwBpC;;;;;;;OAOG;IACG,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAStE,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAelD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAQ/D,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ7D,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAO5D,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAepD,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAsBvE,sEAAsE;IAChE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IASxE;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAavD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAc5E;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAa5C,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IActD,wDAAwD;IAClD,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IASxD,eAAe,CACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,IAAI,GACN,OAAO,CAAC,IAAI,CAAC;IAaV,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpE,4DAA4D;IACtD,KAAK,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CASrC"}

package/dist/stores/atlas.js

@@ -0,0 +1,408 @@
+/**
+ * The store an application running atlas gets for free.
+ *
+ * Twelve methods, two of them atomic, is not something every application
+ * should write again — and the two that matter are exactly the ones a
+ * hand-written store gets subtly wrong. This is that code, once.
+ *
+ * It takes atlas' `db` service rather than importing atlas: the structural
+ * slice below is what the store calls and nothing more, so visa still installs
+ * without a data layer and the package stays as standalone as every other one
+ * here. Built on atlas' query builder rather than on SQL text, deliberately —
+ * dialects are atlas' problem, and it already solves them.
+ *
+ * Every credential arrives HASHED, as the contract states, so what this writes
+ * is what the rest of the package writes: a database copy is not a set of
+ * working tokens.
+ */
+const DEFAULT_TABLES = {
+    clients: "visa_clients",
+    authorizationCodes: "visa_authorization_codes",
+    accessTokens: "visa_access_tokens",
+    refreshTokens: "visa_refresh_tokens",
+    consents: "visa_consents",
+};
+/**
+ * A list of strings, stored as JSON text.
+ *
+ * Text and not a native array type: three dialects are supported and only one
+ * of them has arrays. The round trip is explicit so a malformed value fails on
+ * read rather than becoming `[]` — a scope list that quietly empties is an
+ * authorisation bug, not a display one.
+ */
+function encodeList(values) {
+    return JSON.stringify(values);
+}
+function decodeList(value, column) {
+    if (value === null || value === undefined)
+        return [];
+    if (Array.isArray(value)) {
+        // A `json` column comes back parsed on some dialects and as text on others.
+        return value.filter((entry) => typeof entry === "string");
+    }
+    if (typeof value !== "string") {
+        throw new Error(`[visa] ${column} holds ${typeof value}, expected a list`);
+    }
+    const parsed = JSON.parse(value);
+    if (!Array.isArray(parsed)) {
+        throw new Error(`[visa] ${column} is not a JSON array: ${value}`);
+    }
+    return parsed.filter((entry) => typeof entry === "string");
+}
+/** A column that may be null, as a Date. */
+function decodeDate(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    if (value instanceof Date)
+        return value;
+    if (typeof value === "number" || typeof value === "string") {
+        const date = new Date(value);
+        if (!Number.isNaN(date.getTime()))
+            return date;
+    }
+    return undefined;
+}
+/** A column that must hold a date. */
+function requireDate(value, column) {
+    const date = decodeDate(value);
+    if (date === undefined) {
+        throw new Error(`[visa] ${column} is not a date: ${String(value)}`);
+    }
+    return date;
+}
+function requireString(value, column) {
+    if (typeof value !== "string") {
+        throw new Error(`[visa] ${column} is not a string: ${String(value)}`);
+    }
+    return value;
+}
+function optionalString(value) {
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+/**
+ * How many rows a write touched.
+ *
+ * `update()` answers a count, or the rows themselves when the caller asked for
+ * them. Only the count is ever asked for here, and the other shape is read as
+ * its length rather than assumed away.
+ */
+function affected(result) {
+    return typeof result === "number" ? result : result.length;
+}
+export class AtlasStore {
+    #db;
+    #tables;
+    constructor(db, tables = {}) {
+        this.#db = db;
+        this.#tables = {
+            clients: tables.clients ?? DEFAULT_TABLES.clients,
+            authorizationCodes: tables.authorizationCodes ?? DEFAULT_TABLES.authorizationCodes,
+            accessTokens: tables.accessTokens ?? DEFAULT_TABLES.accessTokens,
+            refreshTokens: tables.refreshTokens ?? DEFAULT_TABLES.refreshTokens,
+            consents: tables.consents ?? DEFAULT_TABLES.consents,
+        };
+    }
+    async findClient(id) {
+        const row = await this.#db.from(this.#tables.clients).where({ id }).first();
+        if (row === null)
+            return null;
+        const secretHash = optionalString(row.secret_hash);
+        return {
+            id: requireString(row.id, "id"),
+            name: requireString(row.name, "name"),
+            ...(secretHash === undefined ? {} : { secretHash }),
+            redirectUris: decodeList(row.redirect_uris, "redirect_uris"),
+            grantTypes: decodeList(row.grant_types, "grant_types").filter(isGrantType),
+            scopes: decodeList(row.scopes, "scopes"),
+            tokenEndpointAuthMethod: readAuthMethod(row.token_endpoint_auth_method),
+            ...(row.trusted === true || row.trusted === 1 ? { trusted: true } : {}),
+        };
+    }
+    /** Persist a registered client. Not on the contract — what `registerClient` writes through. */
+    async saveClient(client) {
+        await this.#db.table(this.#tables.clients).insert({
+            id: client.id,
+            name: client.name,
+            secret_hash: client.secretHash ?? null,
+            redirect_uris: encodeList(client.redirectUris),
+            grant_types: encodeList(client.grantTypes),
+            scopes: encodeList(client.scopes),
+            token_endpoint_auth_method: client.tokenEndpointAuthMethod,
+            trusted: client.trusted === true,
+            created_at: new Date(),
+        });
+    }
+    async saveAuthorizationCode(code) {
+        await this.#db.table(this.#tables.authorizationCodes).insert({
+            code_hash: code.codeHash,
+            client_id: code.clientId,
+            user_id: code.userId,
+            redirect_uri: code.redirectUri,
+            scopes: encodeList(code.scopes),
+            code_challenge: code.codeChallenge,
+            code_challenge_method: code.codeChallengeMethod,
+            expires_at: code.expiresAt,
+            consumed_at: code.consumedAt ?? null,
+            nonce: code.nonce ?? null,
+            resources: encodeList(code.resources ?? []),
+            created_at: new Date(),
+        });
+    }
+    async findAuthorizationCode(codeHash) {
+        const row = await this.#db
+            .from(this.#tables.authorizationCodes)
+            .where({ code_hash: codeHash })
+            .first();
+        if (row === null)
+            return null;
+        const consumedAt = decodeDate(row.consumed_at);
+        const nonce = optionalString(row.nonce);
+        return {
+            codeHash: requireString(row.code_hash, "code_hash"),
+            clientId: requireString(row.client_id, "client_id"),
+            userId: requireString(row.user_id, "user_id"),
+            redirectUri: requireString(row.redirect_uri, "redirect_uri"),
+            scopes: decodeList(row.scopes, "scopes"),
+            codeChallenge: requireString(row.code_challenge, "code_challenge"),
+            codeChallengeMethod: row.code_challenge_method === "plain" ? "plain" : "S256",
+            expiresAt: requireDate(row.expires_at, "expires_at"),
+            ...(consumedAt === undefined ? {} : { consumedAt }),
+            ...(nonce === undefined ? {} : { nonce }),
+            ...listOrNothing("resources", row.resources),
+        };
+    }
+    /**
+     * One UPDATE, guarded by `consumed_at IS NULL`.
+     *
+     * The single-use guarantee lives in that one statement: two requests racing
+     * with the same code both reach the database, and only the one that finds
+     * the row still unconsumed is allowed to write it. Reading and then writing
+     * would let both through.
+     */
+    async consumeAuthorizationCode(codeHash, at) {
+        const result = await this.#db
+            .from(this.#tables.authorizationCodes)
+            .where({ code_hash: codeHash })
+            .whereNull("consumed_at")
+            .update({ consumed_at: at });
+        return affected(result) === 1;
+    }
+    async saveAccessToken(token) {
+        await this.#db.table(this.#tables.accessTokens).insert({
+            token_hash: token.tokenHash,
+            client_id: token.clientId,
+            user_id: token.userId ?? null,
+            scopes: encodeList(token.scopes),
+            expires_at: token.expiresAt,
+            revoked_at: token.revokedAt ?? null,
+            last_used_at: token.lastUsedAt ?? null,
+            family_id: token.familyId ?? null,
+            audience: encodeList(token.audience ?? []),
+            created_at: new Date(),
+        });
+    }
+    async findAccessToken(tokenHash) {
+        const row = await this.#db
+            .from(this.#tables.accessTokens)
+            .where({ token_hash: tokenHash })
+            .first();
+        return row === null ? null : readAccessToken(row);
+    }
+    async revokeAccessToken(tokenHash, at) {
+        await this.#db
+            .from(this.#tables.accessTokens)
+            .where({ token_hash: tokenHash })
+            .whereNull("revoked_at")
+            .update({ revoked_at: at });
+    }
+    async touchAccessToken(tokenHash, at) {
+        await this.#db
+            .from(this.#tables.accessTokens)
+            .where({ token_hash: tokenHash })
+            .update({ last_used_at: at });
+    }
+    async saveRefreshToken(token) {
+        await this.#db.table(this.#tables.refreshTokens).insert({
+            token_hash: token.tokenHash,
+            family_id: token.familyId,
+            client_id: token.clientId,
+            user_id: token.userId ?? null,
+            scopes: encodeList(token.scopes),
+            expires_at: token.expiresAt,
+            consumed_at: token.consumedAt ?? null,
+            revoked_at: token.revokedAt ?? null,
+            resources: encodeList(token.resources ?? []),
+            created_at: new Date(),
+        });
+    }
+    async findRefreshToken(tokenHash) {
+        const row = await this.#db
+            .from(this.#tables.refreshTokens)
+            .where({ token_hash: tokenHash })
+            .first();
+        if (row === null)
+            return null;
+        const userId = optionalString(row.user_id);
+        const consumedAt = decodeDate(row.consumed_at);
+        const revokedAt = decodeDate(row.revoked_at);
+        return {
+            tokenHash: requireString(row.token_hash, "token_hash"),
+            familyId: requireString(row.family_id, "family_id"),
+            clientId: requireString(row.client_id, "client_id"),
+            ...(userId === undefined ? {} : { userId }),
+            scopes: decodeList(row.scopes, "scopes"),
+            expiresAt: requireDate(row.expires_at, "expires_at"),
+            ...(consumedAt === undefined ? {} : { consumedAt }),
+            ...(revokedAt === undefined ? {} : { revokedAt }),
+            ...listOrNothing("resources", row.resources),
+        };
+    }
+    /** Same one-statement guarantee as a code: rotation depends on it. */
+    async consumeRefreshToken(tokenHash, at) {
+        const result = await this.#db
+            .from(this.#tables.refreshTokens)
+            .where({ token_hash: tokenHash })
+            .whereNull("consumed_at")
+            .update({ consumed_at: at });
+        return affected(result) === 1;
+    }
+    /**
+     * End a family: the refresh tokens AND the access tokens they bought.
+     *
+     * Both, because revoking only the refresh half would leave an access token
+     * already minted alive for its full lifetime — which is most of what this
+     * revocation exists to prevent.
+     */
+    async revokeFamily(familyId, at) {
+        await this.#db
+            .from(this.#tables.refreshTokens)
+            .where({ family_id: familyId })
+            .whereNull("revoked_at")
+            .update({ revoked_at: at });
+        await this.#db
+            .from(this.#tables.accessTokens)
+            .where({ family_id: familyId })
+            .whereNull("revoked_at")
+            .update({ revoked_at: at });
+    }
+    async findConsent(userId, clientId) {
+        const row = await this.#db
+            .from(this.#tables.consents)
+            .where({ user_id: userId, client_id: clientId })
+            .first();
+        if (row === null)
+            return null;
+        return {
+            userId: requireString(row.user_id, "user_id"),
+            clientId: requireString(row.client_id, "client_id"),
+            scopes: decodeList(row.scopes, "scopes"),
+            grantedAt: requireDate(row.granted_at, "granted_at"),
+        };
+    }
+    /**
+     * Record a consent, replacing what was there.
+     *
+     * Delete then insert rather than an upsert: the dialects spell an upsert
+     * three different ways, and re-granting is not a hot path.
+     */
+    async saveConsent(consent) {
+        await this.#db
+            .from(this.#tables.consents)
+            .where({ user_id: consent.userId, client_id: consent.clientId })
+            .delete();
+        await this.#db.table(this.#tables.consents).insert({
+            user_id: consent.userId,
+            client_id: consent.clientId,
+            scopes: encodeList(consent.scopes),
+            granted_at: consent.grantedAt,
+        });
+    }
+    async listConsents(userId) {
+        const rows = await this.#db
+            .from(this.#tables.consents)
+            .where({ user_id: userId })
+            .orderBy("granted_at", "desc")
+            .exec();
+        return rows.map((row) => ({
+            userId: requireString(row.user_id, "user_id"),
+            clientId: requireString(row.client_id, "client_id"),
+            scopes: decodeList(row.scopes, "scopes"),
+            grantedAt: requireDate(row.granted_at, "granted_at"),
+        }));
+    }
+    /** Expired ones included — see the contract for why. */
+    async listAccessTokens(userId) {
+        const rows = await this.#db
+            .from(this.#tables.accessTokens)
+            .where({ user_id: userId })
+            .orderBy("expires_at", "desc")
+            .exec();
+        return rows.map(readAccessToken);
+    }
+    async revokeAccessFor(userId, clientId, at) {
+        for (const table of [
+            this.#tables.accessTokens,
+            this.#tables.refreshTokens,
+        ]) {
+            await this.#db
+                .from(table)
+                .where({ user_id: userId, client_id: clientId })
+                .whereNull("revoked_at")
+                .update({ revoked_at: at });
+        }
+    }
+    async deleteConsent(userId, clientId) {
+        await this.#db
+            .from(this.#tables.consents)
+            .where({ user_id: userId, client_id: clientId })
+            .delete();
+    }
+    /** Drop what has expired and can no longer be presented. */
+    async prune(now) {
+        for (const table of [
+            this.#tables.authorizationCodes,
+            this.#tables.accessTokens,
+            this.#tables.refreshTokens,
+        ]) {
+            await this.#db.from(table).where("expires_at", "<", now).delete();
+        }
+    }
+}
+/** One access-token row, as the contract's shape. */
+function readAccessToken(row) {
+    const userId = optionalString(row.user_id);
+    const revokedAt = decodeDate(row.revoked_at);
+    const lastUsedAt = decodeDate(row.last_used_at);
+    const familyId = optionalString(row.family_id);
+    return {
+        tokenHash: requireString(row.token_hash, "token_hash"),
+        clientId: requireString(row.client_id, "client_id"),
+        ...(userId === undefined ? {} : { userId }),
+        scopes: decodeList(row.scopes, "scopes"),
+        expiresAt: requireDate(row.expires_at, "expires_at"),
+        ...(revokedAt === undefined ? {} : { revokedAt }),
+        ...(lastUsedAt === undefined ? {} : { lastUsedAt }),
+        ...(familyId === undefined ? {} : { familyId }),
+        ...listOrNothing("audience", row.audience),
+    };
+}
+function listOrNothing(key, value) {
+    const list = decodeList(value, key);
+    if (list.length === 0)
+        return {};
+    return key === "audience" ? { audience: list } : { resources: list };
+}
+function isGrantType(value) {
+    return (value === "authorization_code" ||
+        value === "refresh_token" ||
+        value === "client_credentials");
+}
+function readAuthMethod(value) {
+    if (value === "client_secret_basic" || value === "client_secret_post") {
+        return value;
+    }
+    // A row holding nothing usable is read as a public client, which is the
+    // method that grants the least.
+    return "none";
+}
+//# sourceMappingURL=atlas.js.map