@c9up/visa 0.1.0 → 0.1.2

package/src/types.ts

@@ -57,6 +57,13 @@ export interface AuthorizationCode {
 	expiresAt: Date;
 	/** Set the moment it is exchanged, so a replay is detectable (§7.5.1). */
 	consumedAt?: Date;
+	/**
+	 * The resources this code may buy a token for (RFC 8707).
+	 *
+	 * Bound here rather than at the token endpoint: the user saw the request
+	 * that named them, and the exchange may narrow the list but never widen it.
+	 */
+	resources?: string[];
 	/** Carried through to the id_token when OIDC lands. */
 	nonce?: string;
 }
@@ -69,6 +76,22 @@ export interface AccessToken {
 	scopes: string[];
 	expiresAt: Date;
 	revokedAt?: Date;
+	/**
+	 * When this token was last presented, if the store records it.
+	 *
+	 * What an "Applications connectées" screen shows next to each authorisation,
+	 * and what tells a dormant token from a live one.
+	 */
+	lastUsedAt?: Date;
+	/**
+	 * Which resources this token is for (RFC 8707).
+	 *
+	 * Absent means unbound — a token for everything, which is what every token
+	 * was before a client started asking. A resource server checks it against
+	 * its own identifier, so a token that travelled to the wrong one is refused
+	 * there instead of being honoured.
+	 */
+	audience?: string[];
 	/**
 	 * The refresh family this token was minted in, when there is one.
 	 *
@@ -95,6 +118,8 @@ export interface RefreshToken {
 	expiresAt: Date;
 	consumedAt?: Date;
 	revokedAt?: Date;
+	/** The resources a token minted from this one may be for (RFC 8707). */
+	resources?: string[];
 }
 
 /** What a user agreed to give a client, so they are asked once. */
@@ -105,6 +130,29 @@ export interface Consent {
 	grantedAt: Date;
 }
 
+/**
+ * One application a user has authorised, as a "connected applications" screen
+ * shows it.
+ *
+ * The unit is the APPLICATION, not the token: a person authorised an
+ * application, and the tokens come and go under that one decision. Upstream's
+ * equivalent listing is per token because it has no clients; here a user with
+ * four live tokens for one application has authorised one thing, and seeing
+ * four rows would be a lie about what revoking does.
+ */
+export interface AuthorizedApplication {
+	clientId: string;
+	/** The client's registered name, or its id when the client is gone. */
+	name: string;
+	/** What was granted — the consent, not what any one token happens to carry. */
+	scopes: string[];
+	grantedAt: Date;
+	/** The most recent use across this application's tokens, if any was used. */
+	lastUsedAt?: Date;
+	/** Whether anything issued to it is still usable right now. */
+	active: boolean;
+}
+
 /** The token endpoint's success body (§4.1.4). */
 export interface TokenResponse {
 	access_token: string;
@@ -131,4 +179,6 @@ export interface IntrospectionResponse {
 	exp?: number;
 	iat?: number;
 	token_type?: "Bearer";
+	/** Which resources the token is for — RFC 8707 §3 names introspection as where this travels. */
+	aud?: string[];
 }

package/stubs/database/migrations/9000_create_visa_tables.stub

@@ -0,0 +1,112 @@
+---
+to: database/migrations/9000_create_visa_tables.ts
+---
+import { Migration } from "@c9up/atlas";
+
+/**
+ * What the authorization server keeps.
+ *
+ * Every credential column holds a HASH, never the value that was handed out —
+ * a dump of these tables is not a set of working tokens.
+ *
+ * Two portability rules are followed deliberately and should survive an edit:
+ *
+ * No `t.timestamps()`. It emits `DEFAULT (NOW())`, which is not a sqlite
+ * function and fails at `migration:run` on a fresh sqlite app. Every timestamp
+ * here is written explicitly by the store instead.
+ *
+ * Every string that is a primary key or an index stays well inside MySQL's
+ * InnoDB utf8mb4 limit of 3072 bytes (768 characters). A hash is 64 characters
+ * of hex; an identifier is capped at 255.
+ */
+export default class CreateVisaTables extends Migration {
+	async up() {
+		this.schema.createTable("visa_clients", (t) => {
+			t.string("id", 255).primary();
+			t.string("name", 255).notNullable();
+			// Null for a public client — a SPA or a native app has no secret to keep.
+			t.string("secret_hash", 255).nullable();
+			t.json("redirect_uris").notNullable();
+			t.json("grant_types").notNullable();
+			t.json("scopes").notNullable();
+			t.string("token_endpoint_auth_method", 32).notNullable();
+			t.boolean("trusted").notNullable();
+			t.timestamp("created_at").notNullable();
+		});
+
+		this.schema.createTable("visa_authorization_codes", (t) => {
+			t.string("code_hash", 64).primary();
+			t.string("client_id", 255).notNullable();
+			t.string("user_id", 255).notNullable();
+			t.text("redirect_uri").notNullable();
+			t.json("scopes").notNullable();
+			t.string("code_challenge", 128).notNullable();
+			t.string("code_challenge_method", 10).notNullable();
+			t.timestamp("expires_at").notNullable();
+			// Set the moment it is exchanged: the single-use guarantee is an
+			// UPDATE guarded on this column being null.
+			t.timestamp("consumed_at").nullable();
+			t.string("nonce", 255).nullable();
+			// RFC 8707 — which resources a token bought with this code may be
+			// for. Empty means unbound, which is every code a client sent no
+			// `resource` with.
+			t.json("resources").notNullable();
+			t.timestamp("created_at").notNullable();
+			t.index("user_id");
+		});
+
+		this.schema.createTable("visa_access_tokens", (t) => {
+			t.string("token_hash", 64).primary();
+			t.string("client_id", 255).notNullable();
+			// Null for `client_credentials`: there is no user behind that grant.
+			t.string("user_id", 255).nullable();
+			t.json("scopes").notNullable();
+			t.timestamp("expires_at").notNullable();
+			t.timestamp("revoked_at").nullable();
+			t.timestamp("last_used_at").nullable();
+			// The refresh family this token was minted in. Indexed because
+			// revoking a leaked family reads every token by it.
+			t.string("family_id", 64).nullable();
+			// RFC 8707 — what this token is for. Empty means unbound, and a
+			// resource server accepts it; bound, it is refused anywhere else.
+			t.json("audience").notNullable();
+			t.timestamp("created_at").notNullable();
+			t.index("family_id");
+			t.index("user_id");
+		});
+
+		this.schema.createTable("visa_refresh_tokens", (t) => {
+			t.string("token_hash", 64).primary();
+			t.string("family_id", 64).notNullable();
+			t.string("client_id", 255).notNullable();
+			t.string("user_id", 255).nullable();
+			t.json("scopes").notNullable();
+			t.timestamp("expires_at").notNullable();
+			t.timestamp("consumed_at").nullable();
+			t.timestamp("revoked_at").nullable();
+			// Carried so a rotation narrows from the same list the code bound.
+			t.json("resources").notNullable();
+			t.timestamp("created_at").notNullable();
+			t.index("family_id");
+			t.index("user_id");
+		});
+
+		this.schema.createTable("visa_consents", (t) => {
+			t.string("user_id", 255).notNullable();
+			t.string("client_id", 255).notNullable();
+			t.json("scopes").notNullable();
+			t.timestamp("granted_at").notNullable();
+			// One consent per pair: asking twice for the same thing is the bug
+			// this table exists to prevent.
+			t.primary(["user_id", "client_id"]);
+		});
+	}
+
+	async down() {
+		this.schema.dropTable("visa_consents");
+		this.schema.dropTable("visa_refresh_tokens");
+		this.schema.dropTable("visa_access_tokens");
+		this.schema.dropTable("visa_authorization_codes");
+		this.schema.dropTable("visa_clients");
+	}
+}