@c9up/visa 0.1.0

package/dist/introspect.js

@@ -0,0 +1,110 @@
+/**
+ * Revocation (RFC 7009) and introspection (RFC 7662).
+ *
+ * Both answer the same way to a token that is unknown, expired, revoked or
+ * belongs to someone else — revocation with 200, introspection with
+ * `{ active: false }`. That uniformity IS the security property: a different
+ * answer per case turns either endpoint into an oracle for guessing tokens.
+ */
+import { authenticateClient } from "./clients.js";
+import { hashSecret } from "./crypto.js";
+import { OAuthError } from "./errors.js";
+/** `{ active: false }` — the only thing an inactive token ever reveals. */
+const INACTIVE = { active: false };
+export async function introspect(request, credentials, store, now = new Date(), issuer) {
+    // The CALLER authenticates — introspection tells you whether a credential
+    // is live, which is exactly what an attacker wants to ask.
+    const caller = await authenticateClient(credentials, (id) => store.findClient(id));
+    const presented = asString(request.token);
+    if (presented === undefined) {
+        throw new OAuthError("invalid_request", "token is required.");
+    }
+    const hash = hashSecret(presented);
+    const hint = asString(request.token_hint) ?? asString(request.token_type_hint);
+    // The hint is an optimisation, never a filter: a wrong hint must still
+    // find the token (RFC 7662 §2.1).
+    const access = hint === "refresh_token" ? null : await store.findAccessToken(hash);
+    if (access !== null) {
+        if (access.revokedAt !== undefined || access.expiresAt <= now) {
+            return INACTIVE;
+        }
+        // A client may only introspect its own tokens.
+        if (access.clientId !== caller.id)
+            return INACTIVE;
+        return {
+            active: true,
+            ...(issuer === undefined ? {} : { iss: issuer }),
+            scope: access.scopes.join(" "),
+            client_id: access.clientId,
+            token_type: "Bearer",
+            exp: Math.floor(access.expiresAt.getTime() / 1000),
+            ...(access.userId === undefined ? {} : { sub: access.userId }),
+        };
+    }
+    const refresh = await store.findRefreshToken(hash);
+    if (refresh === null)
+        return INACTIVE;
+    if (refresh.revokedAt !== undefined ||
+        refresh.consumedAt !== undefined ||
+        refresh.expiresAt <= now ||
+        refresh.clientId !== caller.id) {
+        return INACTIVE;
+    }
+    return {
+        active: true,
+        ...(issuer === undefined ? {} : { iss: issuer }),
+        scope: refresh.scopes.join(" "),
+        client_id: refresh.clientId,
+        exp: Math.floor(refresh.expiresAt.getTime() / 1000),
+        ...(refresh.userId === undefined ? {} : { sub: refresh.userId }),
+    };
+}
+/**
+ * Revoke a token. Answers nothing, always successfully (RFC 7009 §2.2).
+ *
+ * Revoking a REFRESH token takes its whole family with it, access tokens
+ * included: "sign me out" has to mean the session is over, not that one of
+ * its two credentials was retired.
+ */
+export async function revoke(request, credentials, store, now = new Date()) {
+    const caller = await authenticateClient(credentials, (id) => store.findClient(id));
+    const presented = asString(request.token);
+    if (presented === undefined) {
+        throw new OAuthError("invalid_request", "token is required.");
+    }
+    const hash = hashSecret(presented);
+    const refresh = await store.findRefreshToken(hash);
+    if (refresh !== null) {
+        // Someone else's token: nothing happens, and they are not told so.
+        if (refresh.clientId !== caller.id)
+            return;
+        await store.revokeFamily(refresh.familyId, now);
+        return;
+    }
+    const access = await store.findAccessToken(hash);
+    if (access === null || access.clientId !== caller.id)
+        return;
+    await store.revokeAccessToken(hash, now);
+}
+/**
+ * Is this bearer token good, and for what?
+ *
+ * What a resource server calls on every request — so it reads the store
+ * directly instead of going through introspection's client authentication.
+ */
+export async function verifyAccessToken(presented, store, now = new Date()) {
+    const token = await store.findAccessToken(hashSecret(presented));
+    if (token === null)
+        return null;
+    if (token.revokedAt !== undefined || token.expiresAt <= now)
+        return null;
+    return {
+        clientId: token.clientId,
+        ...(token.userId === undefined ? {} : { userId: token.userId }),
+        scopes: token.scopes,
+    };
+}
+function asString(value) {
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+//# sourceMappingURL=introspect.js.map

package/dist/introspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspect.js","sourceRoot":"","sources":["../src/introspect.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAA0B,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,2EAA2E;AAC3E,MAAM,QAAQ,GAA0B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,OAAgC,EAChC,WAA8B,EAC9B,KAAgB,EAChB,MAAY,IAAI,IAAI,EAAE,EACtB,MAAe;IAEf,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAC3D,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CACpB,CAAC;IACF,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GACT,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAEnE,uEAAuE;IACvE,kCAAkC;IAClC,MAAM,MAAM,GACX,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACrE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,+CAA+C;QAC/C,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QACnD,OAAO;YACN,MAAM,EAAE,IAAI;YACZ,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YAChD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,UAAU,EAAE,QAAQ;YACpB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAClD,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;SAC9D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACtC,IACC,OAAO,CAAC,SAAS,KAAK,SAAS;QAC/B,OAAO,CAAC,UAAU,KAAK,SAAS;QAChC,OAAO,CAAC,SAAS,IAAI,GAAG;QACxB,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAC7B,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,OAAO;QACN,MAAM,EAAE,IAAI;QACZ,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAChD,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/B,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QACnD,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KAChE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC3B,OAAgC,EAChC,WAA8B,EAC9B,KAAgB,EAChB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAC3D,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CACpB,CAAC;IACF,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAEnC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACtB,mEAAmE;QACnE,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;YAAE,OAAO;QAC3C,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChD,OAAO;IACR,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;QAAE,OAAO;IAC7D,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,SAAiB,EACjB,KAAgB,EAChB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;KACpB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC"}

package/dist/services/main.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Container service accessor — `import visa from '@c9up/visa/services/main'`.
+ *
+ * Populated by `VisaProvider.boot()`. Reading it before the provider booted
+ * throws rather than answering with a half-built server: an authorization
+ * server with no store would mint tokens nobody can verify.
+ */
+import type { VisaManager } from "../VisaManager.js";
+/** @internal Called by the provider once the manager exists. */
+export declare function setVisa(manager: VisaManager): void;
+/** @internal Read the seated manager, if there is one. */
+export declare function getVisa(): VisaManager | undefined;
+/**
+ * @internal Forget the manager — the provider on shutdown, tests between cases.
+ *
+ * The caller checks ownership first (`getVisa() === mine`): two applications
+ * share this module in one process, and the one shutting down must not clear a
+ * manager the other has since seated.
+ */
+export declare function clearVisa(): void;
+/**
+ * A proxy so the import can be held before the provider boots.
+ *
+ * Symbols and `then` answer undefined: a module namespace is probed for `then`
+ * when it is imported, and a proxy that threw there would crash the import.
+ */
+declare const visa: VisaManager;
+export default visa;
+//# sourceMappingURL=main.d.ts.map

package/dist/services/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/services/main.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD,gEAAgE;AAChE,wBAAgB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAElD;AAED,0DAA0D;AAC1D,wBAAgB,OAAO,IAAI,WAAW,GAAG,SAAS,CAEjD;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,IAAI,IAAI,CAEhC;AAWD;;;;;GAKG;AACH,QAAA,MAAM,IAAI,EAMJ,WAAW,CAAC;AAElB,eAAe,IAAI,CAAC"}

package/dist/services/main.js

@@ -0,0 +1,48 @@
+/**
+ * Container service accessor — `import visa from '@c9up/visa/services/main'`.
+ *
+ * Populated by `VisaProvider.boot()`. Reading it before the provider booted
+ * throws rather than answering with a half-built server: an authorization
+ * server with no store would mint tokens nobody can verify.
+ */
+let instance;
+/** @internal Called by the provider once the manager exists. */
+export function setVisa(manager) {
+    instance = manager;
+}
+/** @internal Read the seated manager, if there is one. */
+export function getVisa() {
+    return instance;
+}
+/**
+ * @internal Forget the manager — the provider on shutdown, tests between cases.
+ *
+ * The caller checks ownership first (`getVisa() === mine`): two applications
+ * share this module in one process, and the one shutting down must not clear a
+ * manager the other has since seated.
+ */
+export function clearVisa() {
+    instance = undefined;
+}
+function resolve() {
+    if (!instance) {
+        throw new Error("[visa] accessed before initialization — register VisaProvider, or call setVisa() yourself.");
+    }
+    return instance;
+}
+/**
+ * A proxy so the import can be held before the provider boots.
+ *
+ * Symbols and `then` answer undefined: a module namespace is probed for `then`
+ * when it is imported, and a proxy that threw there would crash the import.
+ */
+const visa = new Proxy({}, {
+    get(_target, property) {
+        if (typeof property === "symbol" || property === "then")
+            return undefined;
+        const value = Reflect.get(resolve(), property);
+        return typeof value === "function" ? value.bind(resolve()) : value;
+    },
+});
+export default visa;
+//# sourceMappingURL=main.js.map

package/dist/services/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/services/main.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,IAAI,QAAiC,CAAC;AAEtC,gEAAgE;AAChE,MAAM,UAAU,OAAO,CAAC,OAAoB;IAC3C,QAAQ,GAAG,OAAO,CAAC;AACpB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,OAAO;IACtB,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS;IACxB,QAAQ,GAAG,SAAS,CAAC;AACtB,CAAC;AAED,SAAS,OAAO;IACf,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACd,4FAA4F,CAC5F,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,EAAiB,EAAE;IACzC,GAAG,CAAC,OAAO,EAAE,QAAQ;QACpB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACpE,CAAC;CACD,CAAgB,CAAC;AAElB,eAAe,IAAI,CAAC"}

package/dist/store.d.ts

@@ -0,0 +1,44 @@
+/**
+ * What the server needs from wherever its state lives.
+ *
+ * A contract rather than a table, the same way echo, eclipse and bay do it:
+ * an application already running atlas gets a driver, one running on Redis or
+ * on a schema it does not own writes twelve methods.
+ *
+ * Every method that takes a credential takes it HASHED. The plaintext never
+ * reaches the store, so a database dump is not a set of working tokens.
+ */
+import type { AccessToken, AuthorizationCode, Client, Consent, RefreshToken } from "./types.js";
+export interface VisaStore {
+    findClient(id: string): Promise<Client | null>;
+    saveAuthorizationCode(code: AuthorizationCode): Promise<void>;
+    findAuthorizationCode(codeHash: string): Promise<AuthorizationCode | null>;
+    /**
+     * Mark a code as used. MUST be atomic against a concurrent exchange: two
+     * requests racing with the same code must not both succeed, which is the
+     * whole of the single-use guarantee (§7.5.1).
+     *
+     * Answers `false` when it was already consumed.
+     */
+    consumeAuthorizationCode(codeHash: string, at: Date): Promise<boolean>;
+    saveAccessToken(token: AccessToken): Promise<void>;
+    findAccessToken(tokenHash: string): Promise<AccessToken | null>;
+    revokeAccessToken(tokenHash: string, at: Date): Promise<void>;
+    saveRefreshToken(token: RefreshToken): Promise<void>;
+    findRefreshToken(tokenHash: string): Promise<RefreshToken | null>;
+    /** Same atomicity requirement as a code: rotation depends on it. */
+    consumeRefreshToken(tokenHash: string, at: Date): Promise<boolean>;
+    /**
+     * Revoke every token of a family, refresh and access alike.
+     *
+     * Called when a consumed refresh token comes back: that is a leak, and the
+     * only safe answer is to end the session it belongs to rather than guess
+     * which of the two holders is the thief.
+     */
+    revokeFamily(familyId: string, at: Date): Promise<void>;
+    findConsent(userId: string, clientId: string): Promise<Consent | null>;
+    saveConsent(consent: Consent): Promise<void>;
+    /** Drop what has expired. Optional: a store with a TTL does it itself. */
+    prune?(now: Date): Promise<void>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,iBAAiB,EACjB,MAAM,EACN,OAAO,EACP,YAAY,EACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,SAAS;IACzB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE/C,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC3E;;;;;;OAMG;IACH,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvE,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAChE,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAClE,oEAAoE;IACpE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE;;;;;;OAMG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACvE,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C,0EAA0E;IAC1E,KAAK,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC"}

package/dist/store.js

@@ -0,0 +1,12 @@
+/**
+ * What the server needs from wherever its state lives.
+ *
+ * A contract rather than a table, the same way echo, eclipse and bay do it:
+ * an application already running atlas gets a driver, one running on Redis or
+ * on a schema it does not own writes twelve methods.
+ *
+ * Every method that takes a credential takes it HASHED. The plaintext never
+ * reaches the store, so a database dump is not a set of working tokens.
+ */
+export {};
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/stores/memory.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The store that needs no database.
+ *
+ * For tests and for a single-process development server — never for
+ * production, where a restart would sign every user out and a second instance
+ * would not see the first one's tokens.
+ *
+ * It is also the reference implementation of the contract: the atomicity the
+ * interface demands is trivially true here, in one event loop, which is
+ * exactly why a driver on a real database has to say how it achieves it.
+ */
+import type { VisaStore } from "../store.js";
+import type { AccessToken, AuthorizationCode, Client, Consent, RefreshToken } from "../types.js";
+export declare class MemoryStore implements VisaStore {
+    #private;
+    constructor(clients?: readonly Client[]);
+    /** Register a client. Returns it, so a caller can keep the reference. */
+    addClient(client: Client): Client;
+    findClient(id: string): Promise<Client | null>;
+    saveAuthorizationCode(code: AuthorizationCode): Promise<void>;
+    findAuthorizationCode(codeHash: string): Promise<AuthorizationCode | null>;
+    consumeAuthorizationCode(codeHash: string, at: Date): Promise<boolean>;
+    saveAccessToken(token: AccessToken): Promise<void>;
+    findAccessToken(tokenHash: string): Promise<AccessToken | null>;
+    revokeAccessToken(tokenHash: string, at: Date): Promise<void>;
+    saveRefreshToken(token: RefreshToken): Promise<void>;
+    findRefreshToken(tokenHash: string): Promise<RefreshToken | null>;
+    consumeRefreshToken(tokenHash: string, at: Date): Promise<boolean>;
+    revokeFamily(familyId: string, at: Date): Promise<void>;
+    findConsent(userId: string, clientId: string): Promise<Consent | null>;
+    saveConsent(consent: Consent): Promise<void>;
+    prune(now: Date): Promise<void>;
+}
+//# sourceMappingURL=memory.d.ts.map

package/dist/stores/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/stores/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EACX,WAAW,EACX,iBAAiB,EACjB,MAAM,EACN,OAAO,EACP,YAAY,EACZ,MAAM,aAAa,CAAC;AAErB,qBAAa,WAAY,YAAW,SAAS;;gBAOhC,OAAO,GAAE,SAAS,MAAM,EAAO;IAI3C,yEAAyE;IACzE,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAK3B,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI9C,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D,qBAAqB,CAC1B,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAI9B,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAOtE,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAI/D,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7D,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIjE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAOlE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAWvD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAItE,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5C,KAAK,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAWrC"}

package/dist/stores/memory.js

@@ -0,0 +1,100 @@
+/**
+ * The store that needs no database.
+ *
+ * For tests and for a single-process development server — never for
+ * production, where a restart would sign every user out and a second instance
+ * would not see the first one's tokens.
+ *
+ * It is also the reference implementation of the contract: the atomicity the
+ * interface demands is trivially true here, in one event loop, which is
+ * exactly why a driver on a real database has to say how it achieves it.
+ */
+export class MemoryStore {
+    #clients = new Map();
+    #codes = new Map();
+    #accessTokens = new Map();
+    #refreshTokens = new Map();
+    #consents = new Map();
+    constructor(clients = []) {
+        for (const client of clients)
+            this.#clients.set(client.id, client);
+    }
+    /** Register a client. Returns it, so a caller can keep the reference. */
+    addClient(client) {
+        this.#clients.set(client.id, client);
+        return client;
+    }
+    async findClient(id) {
+        return this.#clients.get(id) ?? null;
+    }
+    async saveAuthorizationCode(code) {
+        this.#codes.set(code.codeHash, code);
+    }
+    async findAuthorizationCode(codeHash) {
+        return this.#codes.get(codeHash) ?? null;
+    }
+    async consumeAuthorizationCode(codeHash, at) {
+        const code = this.#codes.get(codeHash);
+        if (code === undefined || code.consumedAt !== undefined)
+            return false;
+        code.consumedAt = at;
+        return true;
+    }
+    async saveAccessToken(token) {
+        this.#accessTokens.set(token.tokenHash, token);
+    }
+    async findAccessToken(tokenHash) {
+        return this.#accessTokens.get(tokenHash) ?? null;
+    }
+    async revokeAccessToken(tokenHash, at) {
+        const token = this.#accessTokens.get(tokenHash);
+        if (token !== undefined)
+            token.revokedAt = at;
+    }
+    async saveRefreshToken(token) {
+        this.#refreshTokens.set(token.tokenHash, token);
+    }
+    async findRefreshToken(tokenHash) {
+        return this.#refreshTokens.get(tokenHash) ?? null;
+    }
+    async consumeRefreshToken(tokenHash, at) {
+        const token = this.#refreshTokens.get(tokenHash);
+        if (token === undefined || token.consumedAt !== undefined)
+            return false;
+        token.consumedAt = at;
+        return true;
+    }
+    async revokeFamily(familyId, at) {
+        // Both kinds: a leaked refresh token has usually already bought an
+        // access token, and leaving that one alive defeats the revocation.
+        for (const token of this.#refreshTokens.values()) {
+            if (token.familyId === familyId)
+                token.revokedAt = at;
+        }
+        for (const token of this.#accessTokens.values()) {
+            if (token.familyId === familyId)
+                token.revokedAt = at;
+        }
+    }
+    async findConsent(userId, clientId) {
+        return this.#consents.get(`${userId}\u0000${clientId}`) ?? null;
+    }
+    async saveConsent(consent) {
+        this.#consents.set(`${consent.userId}\u0000${consent.clientId}`, consent);
+    }
+    async prune(now) {
+        for (const [key, code] of this.#codes) {
+            if (code.expiresAt <= now)
+                this.#codes.delete(key);
+        }
+        for (const [key, token] of this.#accessTokens) {
+            if (token.expiresAt <= now)
+                this.#accessTokens.delete(key);
+        }
+        for (const [key, token] of this.#refreshTokens) {
+            if (token.expiresAt <= now)
+                this.#refreshTokens.delete(key);
+        }
+    }
+}
+//# sourceMappingURL=memory.js.map

package/dist/stores/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/stores/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAWH,MAAM,OAAO,WAAW;IACd,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrC,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC9C,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,cAAc,GAAG,IAAI,GAAG,EAAwB,CAAC;IACjD,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEhD,YAAY,UAA6B,EAAE;QAC1C,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAED,yEAAyE;IACzE,SAAS,CAAC,MAAc;QACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,IAAuB;QAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAC1B,QAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,EAAQ;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtE,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAkB;QACvC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACtC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,EAAQ;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAmB;QACzC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QACvC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAiB,EAAE,EAAQ;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACxE,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,EAAQ;QAC5C,mEAAmE;QACnE,mEAAmE;QACnE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAAE,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAAE,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC;QACvD,CAAC;IACF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,QAAgB;QACjD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,QAAQ,EAAE,CAAC,IAAI,IAAI,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAgB;QACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAS;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/C,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;IACF,CAAC;CACD"}

package/dist/stubs.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Where this package's stubs live.
+ *
+ * Its own module, as upstream keeps it: a stub root is a path a package
+ * publishes, and a caller importing it should not have to import the
+ * configure hook to get it.
+ *
+ * `import.meta.dirname` rather than a URL — upstream reads it straight off
+ * `import.meta`, and deriving it from `import.meta.url` breaks wherever that
+ * is not a `file://` URL, which is what a test runner serving modules over
+ * HTTP hands you.
+ */
+export declare const stubsRoot: string;
+//# sourceMappingURL=stubs.d.ts.map

package/dist/stubs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stubs.d.ts","sourceRoot":"","sources":["../src/stubs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,eAAO,MAAM,SAAS,QAA2C,CAAC"}

package/dist/stubs.js

@@ -0,0 +1,15 @@
+/**
+ * Where this package's stubs live.
+ *
+ * Its own module, as upstream keeps it: a stub root is a path a package
+ * publishes, and a caller importing it should not have to import the
+ * configure hook to get it.
+ *
+ * `import.meta.dirname` rather than a URL — upstream reads it straight off
+ * `import.meta`, and deriving it from `import.meta.url` breaks wherever that
+ * is not a `file://` URL, which is what a test runner serving modules over
+ * HTTP hands you.
+ */
+import { join } from "node:path";
+export const stubsRoot = join(import.meta.dirname, "..", "stubs");
+//# sourceMappingURL=stubs.js.map

package/dist/stubs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stubs.js","sourceRoot":"","sources":["../src/stubs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC"}

package/dist/testing/main.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Test helpers — `import { testVisa } from '@c9up/visa/testing'`.
+ *
+ * Not a fake of the server: the real one, on a memory store. An authorization
+ * server whose test double is lenient teaches applications to ship the leniency
+ * — a consent screen tested against a stub that always grants is a consent
+ * screen nobody has ever seen refuse.
+ *
+ * What it removes is the setup, not the rules: a registered client, a PKCE
+ * pair, and one call that walks authorize → consent → code → token.
+ */
+import { MemoryStore } from "../stores/memory.js";
+import type { Client, GrantType, TokenResponse } from "../types.js";
+import { type VisaConfig, VisaManager } from "../VisaManager.js";
+export interface TestVisa {
+    visa: VisaManager;
+    store: MemoryStore;
+    /** The client that was registered for you. */
+    client: Client;
+    /** Its secret, in the clear — it exists only in this process. */
+    secret: string;
+    /** Credentials shaped the way the endpoints take them. */
+    credentials: {
+        clientId: string;
+        clientSecret?: string;
+    };
+    /** A fresh PKCE pair. */
+    pkce(): {
+        verifier: string;
+        challenge: string;
+    };
+    /**
+     * Everything at once: authorize as `userId`, consent, exchange the code.
+     * What a test protecting a resource needs, without the four steps.
+     */
+    tokensFor(userId: string, scope?: string): Promise<TokenResponse>;
+}
+export interface TestVisaOptions {
+    issuer?: string;
+    clientId?: string;
+    redirectUri?: string;
+    scopes?: string[];
+    grantTypes?: GrantType[];
+    /** A public client: no secret, and no client_credentials. */
+    publicClient?: boolean;
+    config?: Partial<Omit<VisaConfig, "issuer" | "store">>;
+}
+export declare function testVisa(options?: TestVisaOptions): Promise<TestVisa>;
+//# sourceMappingURL=main.d.ts.map

package/dist/testing/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/testing/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,KAAK,UAAU,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,WAAW,QAAQ;IACxB,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,WAAW,CAAC;IACnB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,WAAW,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,yBAAyB;IACzB,IAAI,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD;;;OAGG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,eAAe;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,wBAAsB,QAAQ,CAC7B,OAAO,GAAE,eAAoB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAsEnB"}

package/dist/testing/main.js

@@ -0,0 +1,77 @@
+/**
+ * Test helpers — `import { testVisa } from '@c9up/visa/testing'`.
+ *
+ * Not a fake of the server: the real one, on a memory store. An authorization
+ * server whose test double is lenient teaches applications to ship the leniency
+ * — a consent screen tested against a stub that always grants is a consent
+ * screen nobody has ever seen refuse.
+ *
+ * What it removes is the setup, not the rules: a registered client, a PKCE
+ * pair, and one call that walks authorize → consent → code → token.
+ */
+import { randomToken, sha256 } from "../crypto.js";
+import { MemoryStore } from "../stores/memory.js";
+import { VisaManager } from "../VisaManager.js";
+export async function testVisa(options = {}) {
+    const redirectUri = options.redirectUri ?? "https://app.test/callback";
+    const store = new MemoryStore();
+    const visa = new VisaManager({
+        issuer: options.issuer ?? "https://auth.test",
+        store,
+        ...options.config,
+    });
+    const { client, secret } = await visa.registerClient({
+        id: options.clientId ?? "test-client",
+        name: "Test client",
+        redirectUris: [redirectUri],
+        scopes: options.scopes ?? ["profile", "email"],
+        grantTypes: options.grantTypes ?? ["authorization_code", "refresh_token"],
+        ...(options.publicClient === true
+            ? { tokenEndpointAuthMethod: "none" }
+            : {}),
+    });
+    const credentials = secret === undefined
+        ? { clientId: client.id }
+        : { clientId: client.id, clientSecret: secret };
+    return {
+        visa,
+        store,
+        client,
+        secret: secret ?? "",
+        credentials,
+        pkce() {
+            const verifier = randomToken();
+            return { verifier, challenge: sha256(verifier) };
+        },
+        async tokensFor(userId, scope) {
+            const verifier = randomToken();
+            const outcome = await visa.authorize({
+                response_type: "code",
+                client_id: client.id,
+                redirect_uri: redirectUri,
+                code_challenge: sha256(verifier),
+                code_challenge_method: "S256",
+                ...(scope === undefined ? {} : { scope }),
+            }, userId);
+            // The real path, consent screen included — a helper that skipped it
+            // would let an application forget the screen and still pass.
+            const url = outcome.type === "consent"
+                ? await visa.grant(outcome.request, userId)
+                : outcome.type === "redirect"
+                    ? outcome.url
+                    : (() => {
+                        throw new Error(`authorize failed: ${outcome.error.message}`);
+                    })();
+            const code = new URL(url).searchParams.get("code");
+            if (code === null)
+                throw new Error(`no code in ${url}`);
+            return visa.token({
+                grant_type: "authorization_code",
+                code,
+                redirect_uri: redirectUri,
+                code_verifier: verifier,
+            }, credentials);
+        },
+    };
+}
+//# sourceMappingURL=main.js.map

package/dist/testing/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/testing/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAmB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA+BjE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC7B,UAA2B,EAAE;IAE7B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,2BAA2B,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,mBAAmB;QAC7C,KAAK;QACL,GAAG,OAAO,CAAC,MAAM;KACjB,CAAC,CAAC;IACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;QACpD,EAAE,EAAE,OAAO,CAAC,QAAQ,IAAI,aAAa;QACrC,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;QAC9C,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,IAAI;YAChC,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAe,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;KACN,CAAC,CAAC;IAEH,MAAM,WAAW,GAChB,MAAM,KAAK,SAAS;QACnB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;QACzB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAElD,OAAO;QACN,IAAI;QACJ,KAAK;QACL,MAAM;QACN,MAAM,EAAE,MAAM,IAAI,EAAE;QACpB,WAAW;QACX,IAAI;YACH,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;YAC/B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,KAAc;YAC7C,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CACnC;gBACC,aAAa,EAAE,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,YAAY,EAAE,WAAW;gBACzB,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC;gBAChC,qBAAqB,EAAE,MAAM;gBAC7B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aACzC,EACD,MAAM,CACN,CAAC;YACF,oEAAoE;YACpE,6DAA6D;YAC7D,MAAM,GAAG,GACR,OAAO,CAAC,IAAI,KAAK,SAAS;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;gBAC3C,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;oBAC5B,CAAC,CAAC,OAAO,CAAC,GAAG;oBACb,CAAC,CAAC,CAAC,GAAG,EAAE;wBACN,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC/D,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,IAAI,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,KAAK,CAChB;gBACC,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,WAAW;gBACzB,aAAa,EAAE,QAAQ;aACvB,EACD,WAAW,CACX,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/token.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The token endpoint — the three grants OAuth 2.1 keeps.
+ *
+ * `password` and `implicit` are gone from the spec and are not implemented
+ * here under any option: both hand a credential to a party that should never
+ * hold one, and an application that needs them needs a different design.
+ */
+import { type ClientCredentials } from "./clients.js";
+import type { VisaStore } from "./store.js";
+import type { TokenResponse } from "./types.js";
+export interface TokenOptions {
+    accessTokenTtlSeconds?: number;
+    refreshTokenTtlSeconds?: number;
+    /** Hand out refresh tokens at all. */
+    issueRefreshTokens?: boolean;
+}
+/** The body of a token request, untrusted. */
+export type TokenRequest = Record<string, unknown>;
+export declare function token(request: TokenRequest, credentials: ClientCredentials, store: VisaStore, options?: TokenOptions, now?: Date): Promise<TokenResponse>;
+//# sourceMappingURL=token.d.ts.map

package/dist/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAGN,KAAK,iBAAiB,EAEtB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAqB,aAAa,EAAE,MAAM,YAAY,CAAC;AAEnE,MAAM,WAAW,YAAY;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sCAAsC;IACtC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAQD,8CAA8C;AAC9C,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnD,wBAAsB,KAAK,CAC1B,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,iBAAiB,EAC9B,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,YAAiB,EAC1B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,aAAa,CAAC,CA6BxB"}