@c9up/visa 0.1.0

package/dist/token.js

@@ -0,0 +1,212 @@
+/**
+ * The token endpoint — the three grants OAuth 2.1 keeps.
+ *
+ * `password` and `implicit` are gone from the spec and are not implemented
+ * here under any option: both hand a credential to a party that should never
+ * hold one, and an application that needs them needs a different design.
+ */
+import { assertGrantAllowed, authenticateClient, resolveScopes, } from "./clients.js";
+import { hashMatches, hashSecret, randomToken, sha256 } from "./crypto.js";
+import { OAuthError } from "./errors.js";
+const DEFAULTS = {
+    accessTokenTtlSeconds: 3600,
+    refreshTokenTtlSeconds: 60 * 60 * 24 * 30,
+    issueRefreshTokens: true,
+};
+export async function token(request, credentials, store, options = {}, now = new Date()) {
+    const grant = asString(request.grant_type);
+    if (grant === undefined) {
+        throw new OAuthError("invalid_request", "grant_type is required.");
+    }
+    // Authenticate BEFORE looking at the grant: an unknown grant from an
+    // unauthenticated caller must not be distinguishable from an unknown grant
+    // from a real client.
+    const client = await authenticateClient(credentials, (id) => store.findClient(id));
+    if (!isKnownGrant(grant)) {
+        throw new OAuthError("unsupported_grant_type", grant === "password" || grant === "implicit"
+            ? `The ${grant} grant was removed in OAuth 2.1.`
+            : undefined);
+    }
+    assertGrantAllowed(client, grant);
+    if (grant === "authorization_code") {
+        return exchangeCode(request, client, store, options, now);
+    }
+    if (grant === "refresh_token") {
+        return exchangeRefresh(request, client, store, options, now);
+    }
+    return clientCredentials(request, client, store, options, now);
+}
+function isKnownGrant(grant) {
+    return (grant === "authorization_code" ||
+        grant === "refresh_token" ||
+        grant === "client_credentials");
+}
+/**
+ * The authorization code grant.
+ *
+ * Four things are verified, and each one has a published attack behind it:
+ * the code belongs to THIS client (otherwise a malicious client redeems
+ * another's code), the redirect URI is the one it was issued for (code
+ * injection), the PKCE verifier hashes to the stored challenge (interception
+ * on a native app), and the code has not been used (replay).
+ */
+async function exchangeCode(request, client, store, options, now) {
+    const code = asString(request.code);
+    const verifier = asString(request.code_verifier);
+    if (code === undefined) {
+        throw new OAuthError("invalid_request", "code is required.");
+    }
+    if (verifier === undefined) {
+        throw new OAuthError("invalid_request", "code_verifier is required.");
+    }
+    const record = await store.findAuthorizationCode(hashSecret(code));
+    // One sentence for every failure below: "no such code", "expired",
+    // "already used" and "wrong client" are indistinguishable to the caller.
+    const invalid = new OAuthError("invalid_grant", "The code is not valid.");
+    if (record === null || record.clientId !== client.id)
+        throw invalid;
+    if (record.expiresAt <= now)
+        throw invalid;
+    if (record.consumedAt !== undefined) {
+        // A code coming back a second time means it leaked. Anything it already
+        // bought has to go with it — the legitimate exchange has happened, so
+        // the tokens in flight are the attacker's or a race.
+        await store.revokeFamily(codeFamily(record.codeHash), now);
+        throw invalid;
+    }
+    const redirectUri = asString(request.redirect_uri);
+    // Required whenever it was in the authorization request, which this server
+    // always records.
+    if (redirectUri !== record.redirectUri)
+        throw invalid;
+    if (!verifierMatches(verifier, record.codeChallenge, record.codeChallengeMethod)) {
+        throw invalid;
+    }
+    // The single-use gate. Atomic in the store, so two requests racing with the
+    // same code cannot both pass.
+    if (!(await store.consumeAuthorizationCode(record.codeHash, now))) {
+        throw invalid;
+    }
+    return issue({
+        client,
+        userId: record.userId,
+        scopes: record.scopes,
+        familyId: codeFamily(record.codeHash),
+    }, store, options, now);
+}
+/**
+ * The family a code's tokens belong to.
+ *
+ * Derived from the code rather than random, so the tokens minted from a code
+ * can be revoked when that same code is replayed — at which point the code
+ * record is all we have to go on.
+ */
+function codeFamily(codeHash) {
+    return sha256(`family:${codeHash}`);
+}
+/** PKCE verification (RFC 7636 §4.6). */
+function verifierMatches(verifier, challenge, method) {
+    const computed = method === "S256" ? sha256(verifier) : verifier;
+    return hashMatches(computed, challenge);
+}
+/**
+ * The refresh grant, with rotation.
+ *
+ * Every use mints a new refresh token and consumes the old one. A consumed
+ * token coming back is a replay — the legitimate holder has already moved on
+ * — and since there is no way to tell the thief from the victim, the whole
+ * family is revoked and both are signed out (RFC 9700 §4.14.2).
+ */
+async function exchangeRefresh(request, client, store, options, now) {
+    const presented = asString(request.refresh_token);
+    if (presented === undefined) {
+        throw new OAuthError("invalid_request", "refresh_token is required.");
+    }
+    const record = await store.findRefreshToken(hashSecret(presented));
+    const invalid = new OAuthError("invalid_grant", "The refresh token is not valid.");
+    if (record === null || record.clientId !== client.id)
+        throw invalid;
+    if (record.revokedAt !== undefined)
+        throw invalid;
+    if (record.consumedAt !== undefined) {
+        await store.revokeFamily(record.familyId, now);
+        throw invalid;
+    }
+    if (record.expiresAt <= now)
+        throw invalid;
+    // A refresh MUST NOT widen what was consented to (§4.3.1); it may narrow.
+    const requested = asString(request.scope);
+    const scopes = requested === undefined ? record.scopes : narrow(requested, record.scopes);
+    if (!(await store.consumeRefreshToken(record.tokenHash, now)))
+        throw invalid;
+    return issue({
+        client,
+        ...(record.userId === undefined ? {} : { userId: record.userId }),
+        scopes,
+        familyId: record.familyId,
+    }, store, options, now);
+}
+function narrow(requested, granted) {
+    const asked = requested.split(/\s+/).filter((scope) => scope !== "");
+    const extra = asked.filter((scope) => !granted.includes(scope));
+    if (extra.length > 0) {
+        throw new OAuthError("invalid_scope", `Not part of the original grant: ${extra.join(" ")}`);
+    }
+    return asked;
+}
+/**
+ * The client credentials grant — the client acting as itself.
+ *
+ * No user, so no refresh token: there is nothing to keep alive on someone's
+ * behalf, and the client can always ask again with the credentials it holds
+ * (§4.2.3).
+ */
+async function clientCredentials(request, client, store, options, now) {
+    if (client.tokenEndpointAuthMethod === "none") {
+        // A public client has no secret, so "the client itself" is anyone who
+        // read its id out of a browser.
+        throw new OAuthError("unauthorized_client", "A public client cannot use the client_credentials grant.");
+    }
+    const scopes = resolveScopes(asString(request.scope), client);
+    return issue({ client, scopes }, store, { ...options, issueRefreshTokens: false }, now);
+}
+/** Mint the pair and store both, hashed. */
+async function issue(grant, store, options, now) {
+    const accessTtl = options.accessTokenTtlSeconds ?? DEFAULTS.accessTokenTtlSeconds;
+    const accessToken = randomToken();
+    await store.saveAccessToken({
+        tokenHash: hashSecret(accessToken),
+        clientId: grant.client.id,
+        ...(grant.userId === undefined ? {} : { userId: grant.userId }),
+        scopes: grant.scopes,
+        expiresAt: new Date(now.getTime() + accessTtl * 1000),
+        ...(grant.familyId === undefined ? {} : { familyId: grant.familyId }),
+    });
+    const response = {
+        access_token: accessToken,
+        token_type: "Bearer",
+        expires_in: accessTtl,
+        scope: grant.scopes.join(" "),
+    };
+    const wantsRefresh = (options.issueRefreshTokens ?? DEFAULTS.issueRefreshTokens) &&
+        grant.familyId !== undefined &&
+        grant.client.grantTypes.includes("refresh_token");
+    if (!wantsRefresh || grant.familyId === undefined)
+        return response;
+    const refreshTtl = options.refreshTokenTtlSeconds ?? DEFAULTS.refreshTokenTtlSeconds;
+    const refreshToken = randomToken();
+    await store.saveRefreshToken({
+        tokenHash: hashSecret(refreshToken),
+        familyId: grant.familyId,
+        clientId: grant.client.id,
+        ...(grant.userId === undefined ? {} : { userId: grant.userId }),
+        scopes: grant.scopes,
+        expiresAt: new Date(now.getTime() + refreshTtl * 1000),
+    });
+    response.refresh_token = refreshToken;
+    return response;
+}
+function asString(value) {
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+//# sourceMappingURL=token.js.map

package/dist/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAElB,aAAa,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,QAAQ,GAAG;IAChB,qBAAqB,EAAE,IAAI;IAC3B,sBAAsB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;IACzC,kBAAkB,EAAE,IAAI;CACxB,CAAC;AAKF,MAAM,CAAC,KAAK,UAAU,KAAK,CAC1B,OAAqB,EACrB,WAA8B,EAC9B,KAAgB,EAChB,UAAwB,EAAE,EAC1B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;IACpE,CAAC;IACD,qEAAqE;IACrE,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAC3D,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CACpB,CAAC;IAEF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CACnB,wBAAwB,EACxB,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU;YAC3C,CAAC,CAAC,OAAO,KAAK,kCAAkC;YAChD,CAAC,CAAC,SAAS,CACZ,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAElC,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;QACpC,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC/B,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,CACN,KAAK,KAAK,oBAAoB;QAC9B,KAAK,KAAK,eAAe;QACzB,KAAK,KAAK,oBAAoB,CAC9B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAC1B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAC1E,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC;IACpE,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,MAAM,OAAO,CAAC;IAE3C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,wEAAwE;QACxE,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACnD,2EAA2E;IAC3E,kBAAkB;IAClB,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW;QAAE,MAAM,OAAO,CAAC;IAEtD,IACC,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAC3E,CAAC;QACF,MAAM,OAAO,CAAC;IACf,CAAC;IAED,4EAA4E;IAC5E,8BAA8B;IAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CACX;QACC,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;KACrC,EACD,KAAK,EACL,OAAO,EACP,GAAG,CACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,QAAgB;IACnC,OAAO,MAAM,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,yCAAyC;AACzC,SAAS,eAAe,CACvB,QAAgB,EAChB,SAAiB,EACjB,MAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjE,OAAO,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAC7B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,UAAU,CAC7B,eAAe,EACf,iCAAiC,CACjC,CAAC;IACF,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC;IACpE,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC;IAElD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,MAAM,OAAO,CAAC;IAE3C,0EAA0E;IAC1E,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GACX,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAE5E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAAE,MAAM,OAAO,CAAC;IAE7E,OAAO,KAAK,CACX;QACC,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACjE,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;KACzB,EACD,KAAK,EACL,OAAO,EACP,GAAG,CACH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,SAAiB,EAAE,OAA0B;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CACnB,eAAe,EACf,mCAAmC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACpD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC/B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC/C,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,IAAI,UAAU,CACnB,qBAAqB,EACrB,0DAA0D,CAC1D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,KAAK,CACX,EAAE,MAAM,EAAE,MAAM,EAAE,EAClB,KAAK,EACL,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,EACzC,GAAG,CACH,CAAC;AACH,CAAC;AASD,4CAA4C;AAC5C,KAAK,UAAU,KAAK,CACnB,KAAa,EACb,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GACd,OAAO,CAAC,qBAAqB,IAAI,QAAQ,CAAC,qBAAqB,CAAC;IACjE,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;IAElC,MAAM,KAAK,CAAC,eAAe,CAAC;QAC3B,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC;QAClC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACzB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;KACrE,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAkB;QAC/B,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KAC7B,CAAC;IAEF,MAAM,YAAY,GACjB,CAAC,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,kBAAkB,CAAC;QAC3D,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEnE,MAAM,UAAU,GACf,OAAO,CAAC,sBAAsB,IAAI,QAAQ,CAAC,sBAAsB,CAAC;IACnE,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;IACnC,MAAM,KAAK,CAAC,gBAAgB,CAAC;QAC5B,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACzB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;KACtD,CAAC,CAAC;IACH,QAAQ,CAAC,aAAa,GAAG,YAAY,CAAC;IACtC,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,123 @@
+/**
+ * What an authorization server stores, and what it hands back.
+ *
+ * Nothing here is an entity of a particular ORM: the store contract takes and
+ * returns these shapes, so the same server runs on atlas, on Redis or on a
+ * table someone else owns.
+ */
+/** How a client proves who it is at the token endpoint. */
+export type ClientAuthMethod = 
+/** A confidential client with a secret, sent as HTTP Basic (§2.4.1). */
+"client_secret_basic"
+/** The same secret, in the form body. */
+ | "client_secret_post"
+/** A public client — a SPA, a native app — which has no secret to keep. */
+ | "none";
+export type GrantType = "authorization_code" | "refresh_token" | "client_credentials";
+/**
+ * A registered application.
+ *
+ * `redirectUris` is a list of COMPLETE uris, path included: OAuth 2.1 requires
+ * an exact match, because a prefix match is how an open redirect on the
+ * client's domain turns into a stolen authorization code.
+ */
+export interface Client {
+    id: string;
+    name: string;
+    /** Hashed. The plaintext is shown once, at registration, and never stored. */
+    secretHash?: string;
+    redirectUris: string[];
+    grantTypes: GrantType[];
+    /** What this client may ever ask for; a request narrows it, never widens it. */
+    scopes: string[];
+    tokenEndpointAuthMethod: ClientAuthMethod;
+    /** Skip the consent screen — for a first-party application you own. */
+    trusted?: boolean;
+}
+/**
+ * An authorization code: single use, short lived, bound to everything that
+ * was true when it was issued.
+ */
+export interface AuthorizationCode {
+    /** Hashed, like every other credential this package persists. */
+    codeHash: string;
+    clientId: string;
+    userId: string;
+    redirectUri: string;
+    scopes: string[];
+    codeChallenge: string;
+    codeChallengeMethod: "S256" | "plain";
+    expiresAt: Date;
+    /** Set the moment it is exchanged, so a replay is detectable (§7.5.1). */
+    consumedAt?: Date;
+    /** Carried through to the id_token when OIDC lands. */
+    nonce?: string;
+}
+export interface AccessToken {
+    tokenHash: string;
+    clientId: string;
+    /** Absent for `client_credentials`: there is no user behind it. */
+    userId?: string;
+    scopes: string[];
+    expiresAt: Date;
+    revokedAt?: Date;
+    /**
+     * The refresh family this token was minted in, when there is one.
+     *
+     * Without it, revoking a leaked family would leave the access token it
+     * already bought alive for its full lifetime — which is most of what the
+     * revocation exists to prevent.
+     */
+    familyId?: string;
+}
+/**
+ * A refresh token, and the family it belongs to.
+ *
+ * `familyId` is what makes replay detection possible: rotation issues a new
+ * token in the same family, so presenting an old one proves a leak and the
+ * whole family goes (RFC 9700 §4.14.2).
+ */
+export interface RefreshToken {
+    tokenHash: string;
+    familyId: string;
+    clientId: string;
+    userId?: string;
+    scopes: string[];
+    expiresAt: Date;
+    consumedAt?: Date;
+    revokedAt?: Date;
+}
+/** What a user agreed to give a client, so they are asked once. */
+export interface Consent {
+    userId: string;
+    clientId: string;
+    scopes: string[];
+    grantedAt: Date;
+}
+/** The token endpoint's success body (§4.1.4). */
+export interface TokenResponse {
+    access_token: string;
+    token_type: "Bearer";
+    expires_in: number;
+    refresh_token?: string;
+    scope?: string;
+}
+/** The introspection body (RFC 7662 §2.2). */
+export interface IntrospectionResponse {
+    active: boolean;
+    /**
+     * Which authorization server vouches for this token.
+     *
+     * An opaque token carries nothing by itself; the issuer is a property of
+     * the SERVER, and this is where a caller gets to see it.
+     */
+    iss?: string;
+    scope?: string;
+    client_id?: string;
+    username?: string;
+    sub?: string;
+    exp?: number;
+    iat?: number;
+    token_type?: "Bearer";
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2DAA2D;AAC3D,MAAM,MAAM,gBAAgB;AAC3B,wEAAwE;AACtE,qBAAqB;AACvB,yCAAyC;GACvC,oBAAoB;AACtB,2EAA2E;GACzE,MAAM,CAAC;AAEV,MAAM,MAAM,SAAS,GAClB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,gFAAgF;IAChF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB,EAAE,gBAAgB,CAAC;IAC1C,uEAAuE;IACvE,OAAO,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IACjC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC;IACtC,SAAS,EAAE,IAAI,CAAC;IAChB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,CAAC;CACjB;AAED,mEAAmE;AACnE,MAAM,WAAW,OAAO;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,8CAA8C;AAC9C,MAAM,WAAW,qBAAqB;IACrC,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,QAAQ,CAAC;CACtB"}

package/dist/types.js

@@ -0,0 +1,9 @@
+/**
+ * What an authorization server stores, and what it hands back.
+ *
+ * Nothing here is an entity of a particular ORM: the store contract takes and
+ * returns these shapes, so the same server runs on atlas, on Redis or on a
+ * table someone else owns.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/package.json

@@ -0,0 +1,83 @@
+{
+  "name": "@c9up/visa",
+  "version": "0.1.0",
+  "description": "Visa — OAuth 2.1 authorization server for the Ream framework: authorization code with PKCE, refresh rotation, revocation and introspection, on a store contract",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./config": {
+      "types": "./dist/config.d.ts",
+      "import": "./dist/config.js"
+    },
+    "./provider": {
+      "types": "./dist/VisaProvider.d.ts",
+      "import": "./dist/VisaProvider.js"
+    },
+    "./configure": {
+      "types": "./dist/configure.d.ts",
+      "import": "./dist/configure.js"
+    },
+    "./services/main": {
+      "types": "./dist/services/main.d.ts",
+      "import": "./dist/services/main.js"
+    },
+    "./stores/memory": {
+      "types": "./dist/stores/memory.d.ts",
+      "import": "./dist/stores/memory.js"
+    },
+    "./types": {
+      "types": "./dist/types.d.ts",
+      "import": "./dist/types.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/main.d.ts",
+      "import": "./dist/testing/main.js"
+    }
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.5.12",
+    "@c9up/ream": "^0.2.25",
+    "@types/node": "^22.20.1",
+    "@vitest/coverage-v8": "4.1.11",
+    "typescript": "^6.0.3",
+    "vitest": "4.1.11"
+  },
+  "peerDependencies": {
+    "@c9up/ream": "^0.2.26"
+  },
+  "peerDependenciesMeta": {
+    "@c9up/ream": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "files": [
+    "src",
+    "dist",
+    "stubs",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/C9up/visa.git"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "vitest run",
+    "lint": "biome check src/ tests/",
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc --noEmit"
+  }
+}