@c9up/visa 0.1.1 → 0.1.2

package/dist/stores/memory.js

@@ -51,6 +51,31 @@ export class MemoryStore {
         if (token !== undefined)
             token.revokedAt = at;
     }
+    async listConsents(userId) {
+        return [...this.#consents.values()].filter((consent) => consent.userId === userId);
+    }
+    async listAccessTokens(userId) {
+        return [...this.#accessTokens.values()].filter((token) => token.userId === userId);
+    }
+    async revokeAccessFor(userId, clientId, at) {
+        for (const token of this.#accessTokens.values()) {
+            if (token.userId !== userId || token.clientId !== clientId)
+                continue;
+            if (token.revokedAt === undefined)
+                token.revokedAt = at;
+        }
+        for (const token of this.#refreshTokens.values()) {
+            if (token.userId !== userId || token.clientId !== clientId)
+                continue;
+            if (token.revokedAt === undefined)
+                token.revokedAt = at;
+        }
+    }
+    async deleteConsent(userId, clientId) {
+        // The same NUL-separated key `saveConsent` writes: a colon would make
+        // `a:b` + `c` collide with `a` + `b:c`.
+        this.#consents.delete(`${userId}\u0000${clientId}`);
+    }
     async touchAccessToken(tokenHash, at) {
         const token = this.#accessTokens.get(tokenHash);
         if (token !== undefined)

package/dist/stores/memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/stores/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAWH,MAAM,OAAO,WAAW;IACd,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrC,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC9C,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,cAAc,GAAG,IAAI,GAAG,EAAwB,CAAC;IACjD,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEhD,YAAY,UAA6B,EAAE;QAC1C,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAED,yEAAyE;IACzE,SAAS,CAAC,MAAc;QACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,IAAuB;QAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAC1B,QAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,EAAQ;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtE,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAkB;QACvC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACtC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,EAAQ;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,EAAQ;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAmB;QACzC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QACvC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAiB,EAAE,EAAQ;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACxE,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,EAAQ;QAC5C,mEAAmE;QACnE,mEAAmE;QACnE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAAE,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAAE,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC;QACvD,CAAC;IACF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,QAAgB;QACjD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,QAAQ,EAAE,CAAC,IAAI,IAAI,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAgB;QACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAS;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/C,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;IACF,CAAC;CACD"}
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/stores/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAWH,MAAM,OAAO,WAAW;IACd,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrC,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC9C,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,cAAc,GAAG,IAAI,GAAG,EAAwB,CAAC;IACjD,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEhD,YAAY,UAA6B,EAAE;QAC1C,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAED,yEAAyE;IACzE,SAAS,CAAC,MAAc;QACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,IAAuB;QAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAC1B,QAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,EAAQ;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtE,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAkB;QACvC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACtC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,EAAQ;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAChC,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CACzC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACpC,OAAO,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAC7C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAClC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CACpB,MAAc,EACd,QAAgB,EAChB,EAAQ;QAER,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YACrE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC;QACzD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YACrE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC;QACzD,CAAC;IACF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,QAAgB;QACnD,sEAAsE;QACtE,wCAAwC;QACxC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,SAAS,QAAQ,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,EAAQ;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAmB;QACzC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QACvC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAiB,EAAE,EAAQ;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACxE,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,EAAQ;QAC5C,mEAAmE;QACnE,mEAAmE;QACnE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAAE,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAAE,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC;QACvD,CAAC;IACF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,QAAgB;QACjD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,QAAQ,EAAE,CAAC,IAAI,IAAI,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAgB;QACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAS;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/C,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;IACF,CAAC;CACD"}

package/dist/token.d.ts

@@ -10,6 +10,8 @@ import type { VisaStore } from "./store.js";
 import type { TokenResponse } from "./types.js";
 export interface TokenOptions {
     accessTokenTtlSeconds?: number;
+    /** The resources this server issues tokens for — see `AuthorizeOptions`. */
+    resourcesSupported?: readonly string[];
     refreshTokenTtlSeconds?: number;
     /** Hand out refresh tokens at all. */
     issueRefreshTokens?: boolean;

package/dist/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAGN,KAAK,iBAAiB,EAEtB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAqB,aAAa,EAAE,MAAM,YAAY,CAAC;AAEnE,MAAM,WAAW,YAAY;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sCAAsC;IACtC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAQD,8CAA8C;AAC9C,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnD,wBAAsB,KAAK,CAC1B,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,iBAAiB,EAC9B,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,YAAiB,EAC1B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,aAAa,CAAC,CA6BxB"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAGN,KAAK,iBAAiB,EAEtB,MAAM,cAAc,CAAC;AAQtB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAqB,aAAa,EAAE,MAAM,YAAY,CAAC;AAEnE,MAAM,WAAW,YAAY;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sCAAsC;IACtC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAQD,8CAA8C;AAC9C,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnD,wBAAsB,KAAK,CAC1B,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,iBAAiB,EAC9B,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,YAAiB,EAC1B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,aAAa,CAAC,CA6BxB"}

package/dist/token.js

@@ -8,6 +8,7 @@
 import { assertGrantAllowed, authenticateClient, resolveScopes, } from "./clients.js";
 import { hashMatches, hashSecret, randomToken, sha256 } from "./crypto.js";
 import { OAuthError } from "./errors.js";
+import { narrowResources, readResourceParameter, validateResources, } from "./resource.js";
 const DEFAULTS = {
     accessTokenTtlSeconds: 3600,
     refreshTokenTtlSeconds: 60 * 60 * 24 * 30,
@@ -87,11 +88,15 @@ async function exchangeCode(request, client, store, options, now) {
     if (!(await store.consumeAuthorizationCode(record.codeHash, now))) {
         throw invalid;
     }
+    // RFC 8707: a request may narrow the resources the code was bound to,
+    // never widen them — the user saw the list at authorization time.
+    const resources = narrowResources(validateResources(readResourceParameter(request.resource), options.resourcesSupported), record.resources ?? []);
     return issue({
         client,
         userId: record.userId,
         scopes: record.scopes,
         familyId: codeFamily(record.codeHash),
+        resources,
     }, store, options, now);
 }
 /**
@@ -144,6 +149,7 @@ async function exchangeRefresh(request, client, store, options, now) {
         ...(record.userId === undefined ? {} : { userId: record.userId }),
         scopes,
         familyId: record.familyId,
+        resources: narrowResources(validateResources(readResourceParameter(request.resource), options.resourcesSupported), record.resources ?? []),
     }, store, options, now);
 }
 function narrow(requested, granted) {
@@ -168,7 +174,13 @@ async function clientCredentials(request, client, store, options, now) {
         throw new OAuthError("unauthorized_client", "A public client cannot use the client_credentials grant.");
     }
     const scopes = resolveScopes(asString(request.scope), client);
-    return issue({ client, scopes }, store, { ...options, issueRefreshTokens: false }, now);
+    return issue({
+        client,
+        scopes,
+        // No user consented to a list here, so the request IS the list —
+        // checked against what this server issues for, and nothing wider.
+        resources: validateResources(readResourceParameter(request.resource), options.resourcesSupported),
+    }, store, { ...options, issueRefreshTokens: false }, now);
 }
 /** Mint the pair and store both, hashed. */
 async function issue(grant, store, options, now) {
@@ -181,6 +193,9 @@ async function issue(grant, store, options, now) {
         scopes: grant.scopes,
         expiresAt: new Date(now.getTime() + accessTtl * 1000),
         ...(grant.familyId === undefined ? {} : { familyId: grant.familyId }),
+        ...(grant.resources === undefined || grant.resources.length === 0
+            ? {}
+            : { audience: grant.resources }),
     });
     const response = {
         access_token: accessToken,
@@ -202,6 +217,11 @@ async function issue(grant, store, options, now) {
         ...(grant.userId === undefined ? {} : { userId: grant.userId }),
         scopes: grant.scopes,
         expiresAt: new Date(now.getTime() + refreshTtl * 1000),
+        // Carried so a rotation can narrow from the same list the code bound —
+        // without it, the second token of a session would be unbound.
+        ...(grant.resources === undefined || grant.resources.length === 0
+            ? {}
+            : { resources: grant.resources }),
     });
     response.refresh_token = refreshToken;
     return response;

package/dist/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAElB,aAAa,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,QAAQ,GAAG;IAChB,qBAAqB,EAAE,IAAI;IAC3B,sBAAsB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;IACzC,kBAAkB,EAAE,IAAI;CACxB,CAAC;AAKF,MAAM,CAAC,KAAK,UAAU,KAAK,CAC1B,OAAqB,EACrB,WAA8B,EAC9B,KAAgB,EAChB,UAAwB,EAAE,EAC1B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;IACpE,CAAC;IACD,qEAAqE;IACrE,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAC3D,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CACpB,CAAC;IAEF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CACnB,wBAAwB,EACxB,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU;YAC3C,CAAC,CAAC,OAAO,KAAK,kCAAkC;YAChD,CAAC,CAAC,SAAS,CACZ,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAElC,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;QACpC,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC/B,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,CACN,KAAK,KAAK,oBAAoB;QAC9B,KAAK,KAAK,eAAe;QACzB,KAAK,KAAK,oBAAoB,CAC9B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAC1B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAC1E,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC;IACpE,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,MAAM,OAAO,CAAC;IAE3C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,wEAAwE;QACxE,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACnD,2EAA2E;IAC3E,kBAAkB;IAClB,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW;QAAE,MAAM,OAAO,CAAC;IAEtD,IACC,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAC3E,CAAC;QACF,MAAM,OAAO,CAAC;IACf,CAAC;IAED,4EAA4E;IAC5E,8BAA8B;IAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CACX;QACC,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;KACrC,EACD,KAAK,EACL,OAAO,EACP,GAAG,CACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,QAAgB;IACnC,OAAO,MAAM,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,yCAAyC;AACzC,SAAS,eAAe,CACvB,QAAgB,EAChB,SAAiB,EACjB,MAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjE,OAAO,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAC7B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,UAAU,CAC7B,eAAe,EACf,iCAAiC,CACjC,CAAC;IACF,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC;IACpE,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC;IAElD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,MAAM,OAAO,CAAC;IAE3C,0EAA0E;IAC1E,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GACX,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAE5E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAAE,MAAM,OAAO,CAAC;IAE7E,OAAO,KAAK,CACX;QACC,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACjE,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;KACzB,EACD,KAAK,EACL,OAAO,EACP,GAAG,CACH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,SAAiB,EAAE,OAA0B;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CACnB,eAAe,EACf,mCAAmC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACpD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC/B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC/C,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,IAAI,UAAU,CACnB,qBAAqB,EACrB,0DAA0D,CAC1D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,KAAK,CACX,EAAE,MAAM,EAAE,MAAM,EAAE,EAClB,KAAK,EACL,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,EACzC,GAAG,CACH,CAAC;AACH,CAAC;AASD,4CAA4C;AAC5C,KAAK,UAAU,KAAK,CACnB,KAAa,EACb,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GACd,OAAO,CAAC,qBAAqB,IAAI,QAAQ,CAAC,qBAAqB,CAAC;IACjE,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;IAElC,MAAM,KAAK,CAAC,eAAe,CAAC;QAC3B,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC;QAClC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACzB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;KACrE,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAkB;QAC/B,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KAC7B,CAAC;IAEF,MAAM,YAAY,GACjB,CAAC,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,kBAAkB,CAAC;QAC3D,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEnE,MAAM,UAAU,GACf,OAAO,CAAC,sBAAsB,IAAI,QAAQ,CAAC,sBAAsB,CAAC;IACnE,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;IACnC,MAAM,KAAK,CAAC,gBAAgB,CAAC;QAC5B,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACzB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;KACtD,CAAC,CAAC;IACH,QAAQ,CAAC,aAAa,GAAG,YAAY,CAAC;IACtC,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAElB,aAAa,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,eAAe,EACf,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,eAAe,CAAC;AAavB,MAAM,QAAQ,GAAG;IAChB,qBAAqB,EAAE,IAAI;IAC3B,sBAAsB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;IACzC,kBAAkB,EAAE,IAAI;CACxB,CAAC;AAKF,MAAM,CAAC,KAAK,UAAU,KAAK,CAC1B,OAAqB,EACrB,WAA8B,EAC9B,KAAgB,EAChB,UAAwB,EAAE,EAC1B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;IACpE,CAAC;IACD,qEAAqE;IACrE,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAC3D,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CACpB,CAAC;IAEF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CACnB,wBAAwB,EACxB,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU;YAC3C,CAAC,CAAC,OAAO,KAAK,kCAAkC;YAChD,CAAC,CAAC,SAAS,CACZ,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAElC,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;QACpC,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC/B,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,CACN,KAAK,KAAK,oBAAoB;QAC9B,KAAK,KAAK,eAAe;QACzB,KAAK,KAAK,oBAAoB,CAC9B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAC1B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAC1E,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC;IACpE,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,MAAM,OAAO,CAAC;IAE3C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,wEAAwE;QACxE,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACnD,2EAA2E;IAC3E,kBAAkB;IAClB,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW;QAAE,MAAM,OAAO,CAAC;IAEtD,IACC,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAC3E,CAAC;QACF,MAAM,OAAO,CAAC;IACf,CAAC;IAED,4EAA4E;IAC5E,8BAA8B;IAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,kEAAkE;IAClE,MAAM,SAAS,GAAG,eAAe,CAChC,iBAAiB,CAChB,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvC,OAAO,CAAC,kBAAkB,CAC1B,EACD,MAAM,CAAC,SAAS,IAAI,EAAE,CACtB,CAAC;IAEF,OAAO,KAAK,CACX;QACC,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrC,SAAS;KACT,EACD,KAAK,EACL,OAAO,EACP,GAAG,CACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,QAAgB;IACnC,OAAO,MAAM,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,yCAAyC;AACzC,SAAS,eAAe,CACvB,QAAgB,EAChB,SAAiB,EACjB,MAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjE,OAAO,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAC7B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,UAAU,CAC7B,eAAe,EACf,iCAAiC,CACjC,CAAC;IACF,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC;IACpE,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC;IAElD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,MAAM,OAAO,CAAC;IAE3C,0EAA0E;IAC1E,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GACX,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAE5E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAAE,MAAM,OAAO,CAAC;IAE7E,OAAO,KAAK,CACX;QACC,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACjE,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,eAAe,CACzB,iBAAiB,CAChB,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvC,OAAO,CAAC,kBAAkB,CAC1B,EACD,MAAM,CAAC,SAAS,IAAI,EAAE,CACtB;KACD,EACD,KAAK,EACL,OAAO,EACP,GAAG,CACH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,SAAiB,EAAE,OAA0B;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CACnB,eAAe,EACf,mCAAmC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACpD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC/B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC/C,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,IAAI,UAAU,CACnB,qBAAqB,EACrB,0DAA0D,CAC1D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,KAAK,CACX;QACC,MAAM;QACN,MAAM;QACN,iEAAiE;QACjE,kEAAkE;QAClE,SAAS,EAAE,iBAAiB,CAC3B,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvC,OAAO,CAAC,kBAAkB,CAC1B;KACD,EACD,KAAK,EACL,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,EACzC,GAAG,CACH,CAAC;AACH,CAAC;AAWD,4CAA4C;AAC5C,KAAK,UAAU,KAAK,CACnB,KAAa,EACb,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GACd,OAAO,CAAC,qBAAqB,IAAI,QAAQ,CAAC,qBAAqB,CAAC;IACjE,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;IAElC,MAAM,KAAK,CAAC,eAAe,CAAC;QAC3B,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC;QAClC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACzB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAChE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;KACjC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAkB;QAC/B,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KAC7B,CAAC;IAEF,MAAM,YAAY,GACjB,CAAC,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,kBAAkB,CAAC;QAC3D,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEnE,MAAM,UAAU,GACf,OAAO,CAAC,sBAAsB,IAAI,QAAQ,CAAC,sBAAsB,CAAC;IACnE,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;IACnC,MAAM,KAAK,CAAC,gBAAgB,CAAC;QAC5B,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACzB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;QACtD,uEAAuE;QACvE,8DAA8D;QAC9D,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAChE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;KAClC,CAAC,CAAC;IACH,QAAQ,CAAC,aAAa,GAAG,YAAY,CAAC;IACtC,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC"}

package/dist/types.d.ts

@@ -50,6 +50,13 @@ export interface AuthorizationCode {
     expiresAt: Date;
     /** Set the moment it is exchanged, so a replay is detectable (§7.5.1). */
     consumedAt?: Date;
+    /**
+     * The resources this code may buy a token for (RFC 8707).
+     *
+     * Bound here rather than at the token endpoint: the user saw the request
+     * that named them, and the exchange may narrow the list but never widen it.
+     */
+    resources?: string[];
     /** Carried through to the id_token when OIDC lands. */
     nonce?: string;
 }
@@ -68,6 +75,15 @@ export interface AccessToken {
      * and what tells a dormant token from a live one.
      */
     lastUsedAt?: Date;
+    /**
+     * Which resources this token is for (RFC 8707).
+     *
+     * Absent means unbound — a token for everything, which is what every token
+     * was before a client started asking. A resource server checks it against
+     * its own identifier, so a token that travelled to the wrong one is refused
+     * there instead of being honoured.
+     */
+    audience?: string[];
     /**
      * The refresh family this token was minted in, when there is one.
      *
@@ -93,6 +109,8 @@ export interface RefreshToken {
     expiresAt: Date;
     consumedAt?: Date;
     revokedAt?: Date;
+    /** The resources a token minted from this one may be for (RFC 8707). */
+    resources?: string[];
 }
 /** What a user agreed to give a client, so they are asked once. */
 export interface Consent {
@@ -101,6 +119,28 @@ export interface Consent {
     scopes: string[];
     grantedAt: Date;
 }
+/**
+ * One application a user has authorised, as a "connected applications" screen
+ * shows it.
+ *
+ * The unit is the APPLICATION, not the token: a person authorised an
+ * application, and the tokens come and go under that one decision. Upstream's
+ * equivalent listing is per token because it has no clients; here a user with
+ * four live tokens for one application has authorised one thing, and seeing
+ * four rows would be a lie about what revoking does.
+ */
+export interface AuthorizedApplication {
+    clientId: string;
+    /** The client's registered name, or its id when the client is gone. */
+    name: string;
+    /** What was granted — the consent, not what any one token happens to carry. */
+    scopes: string[];
+    grantedAt: Date;
+    /** The most recent use across this application's tokens, if any was used. */
+    lastUsedAt?: Date;
+    /** Whether anything issued to it is still usable right now. */
+    active: boolean;
+}
 /** The token endpoint's success body (§4.1.4). */
 export interface TokenResponse {
     access_token: string;
@@ -126,5 +166,7 @@ export interface IntrospectionResponse {
     exp?: number;
     iat?: number;
     token_type?: "Bearer";
+    /** Which resources the token is for — RFC 8707 §3 names introspection as where this travels. */
+    aud?: string[];
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2DAA2D;AAC3D,MAAM,MAAM,gBAAgB;AAC3B,wEAAwE;AACtE,qBAAqB;AACvB,yCAAyC;GACvC,oBAAoB;AACtB,2EAA2E;GACzE,MAAM,CAAC;AAEV,MAAM,MAAM,SAAS,GAClB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,gFAAgF;IAChF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB,EAAE,gBAAgB,CAAC;IAC1C,uEAAuE;IACvE,OAAO,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IACjC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC;IACtC,SAAS,EAAE,IAAI,CAAC;IAChB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,CAAC;CACjB;AAED,mEAAmE;AACnE,MAAM,WAAW,OAAO;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,8CAA8C;AAC9C,MAAM,WAAW,qBAAqB;IACrC,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,QAAQ,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2DAA2D;AAC3D,MAAM,MAAM,gBAAgB;AAC3B,wEAAwE;AACtE,qBAAqB;AACvB,yCAAyC;GACvC,oBAAoB;AACtB,2EAA2E;GACzE,MAAM,CAAC;AAEV,MAAM,MAAM,SAAS,GAClB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,gFAAgF;IAChF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB,EAAE,gBAAgB,CAAC;IAC1C,uEAAuE;IACvE,OAAO,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IACjC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC;IACtC,SAAS,EAAE,IAAI,CAAC;IAChB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,WAAW,OAAO;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,qBAAqB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,+DAA+D;IAC/D,MAAM,EAAE,OAAO,CAAC;CAChB;AAED,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,8CAA8C;AAC9C,MAAM,WAAW,qBAAqB;IACrC,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,QAAQ,CAAC;IACtB,gGAAgG;IAChG,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CACf"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/visa",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Visa — OAuth 2.1 authorization server for the Ream framework: authorization code with PKCE, refresh rotation, revocation and introspection, on a store contract",
   "license": "MIT",
   "type": "module",

package/src/VisaManager.ts

@@ -24,9 +24,17 @@ import {
 import { hashSecret, randomToken } from "./crypto.js";
 import { OAuthError, VisaError } from "./errors.js";
 import { introspect, revoke, verifyAccessToken } from "./introspect.js";
+import {
+	type ClientRegistrationRequest,
+	type ClientRegistrationResponse,
+	type RegistrationOptions,
+	registrationResponse,
+	validateRegistration,
+} from "./register.js";
 import type { VisaStore } from "./store.js";
 import { type TokenOptions, token } from "./token.js";
 import type {
+	AuthorizedApplication,
 	Client,
 	ClientAuthMethod,
 	GrantType,
@@ -38,6 +46,8 @@ export interface VisaConfig extends AuthorizeOptions, TokenOptions {
 	/** Where this server lives — `https://auth.example.com`. */
 	issuer: string;
 	store: VisaStore;
+	/** Whether clients may register themselves, and on what terms (RFC 7591). */
+	registration?: RegistrationOptions;
 }
 
 /** What `authorize()` decided. */
@@ -117,6 +127,32 @@ export class VisaManager {
 		return secret === undefined ? { client } : { client, secret };
 	}
 
+	/**
+	 * A client registering itself (RFC 7591).
+	 *
+	 * Refused unless the application turned registration on. What comes back is
+	 * the 201 body, secret included — the one time it exists.
+	 */
+	async register(
+		request: ClientRegistrationRequest,
+		presentedToken?: string,
+		now: Date = new Date(),
+	): Promise<ClientRegistrationResponse> {
+		const options = this.#config.registration ?? {};
+		const metadata = validateRegistration(request, options, presentedToken);
+		const { client, secret } = await this.registerClient({
+			// The id is ours to choose: a client naming itself could claim one
+			// that already exists and read another application's tokens.
+			id: randomToken(),
+			name: metadata.name,
+			redirectUris: metadata.redirectUris,
+			grantTypes: metadata.grantTypes,
+			scopes: metadata.scopes,
+			tokenEndpointAuthMethod: metadata.tokenEndpointAuthMethod,
+		});
+		return registrationResponse(client, now, secret, options);
+	}
+
 	/**
 	 * Step one: check the request, and decide what happens to the user.
 	 *
@@ -229,12 +265,82 @@ export class VisaManager {
 		return revoke(body, credentials, this.#config.store, now);
 	}
 
-	/** What a resource server calls on every request. */
+	/**
+	 * What a resource server calls on every request.
+	 *
+	 * `resource` is this server's own identifier (RFC 8707): given, a token
+	 * minted for a different one is refused here rather than honoured.
+	 */
 	async verify(
 		presented: string,
 		now: Date = new Date(),
-	): Promise<{ clientId: string; userId?: string; scopes: string[] } | null> {
-		return verifyAccessToken(presented, this.#config.store, now);
+		resource?: string,
+	): ReturnType<typeof verifyAccessToken> {
+		return verifyAccessToken(presented, this.#config.store, now, resource);
+	}
+
+	/**
+	 * Every application this user has authorised.
+	 *
+	 * What a "connected applications" screen renders. Includes an application
+	 * whose tokens have all expired: "last used" matters most when nothing is
+	 * live any more, and hiding it would tell someone an application never
+	 * touched their data when it did.
+	 */
+	async listAuthorizations(
+		userId: string,
+		now: Date = new Date(),
+	): Promise<AuthorizedApplication[]> {
+		const store = this.#config.store;
+		const consents = await store.listConsents(userId);
+		const tokens = await store.listAccessTokens(userId);
+
+		return Promise.all(
+			consents.map(async (consent) => {
+				const mine = tokens.filter(
+					(token) => token.clientId === consent.clientId,
+				);
+				const client = await store.findClient(consent.clientId);
+				const lastUsedAt = mine.reduce<Date | undefined>((latest, token) => {
+					if (token.lastUsedAt === undefined) return latest;
+					if (latest === undefined) return token.lastUsedAt;
+					return token.lastUsedAt > latest ? token.lastUsedAt : latest;
+				}, undefined);
+
+				return {
+					clientId: consent.clientId,
+					// A client that has since been deleted still shows, under its id:
+					// the grant is the user's and they must be able to end it.
+					name: client?.name ?? consent.clientId,
+					scopes: consent.scopes,
+					grantedAt: consent.grantedAt,
+					...(lastUsedAt === undefined ? {} : { lastUsedAt }),
+					active: mine.some(
+						(token) => token.revokedAt === undefined && token.expiresAt > now,
+					),
+				};
+			}),
+		);
+	}
+
+	/**
+	 * End one application's access for one user.
+	 *
+	 * Tokens first, consent second, and deliberately in that order: someone
+	 * revoking in a hurry wants the sessions dead, and a failure half-way
+	 * through must not leave an application still holding live tokens with the
+	 * grant already forgotten.
+	 *
+	 * Both kinds of token go — revoking only the refresh half would leave the
+	 * access token it already bought alive for its full lifetime.
+	 */
+	async revokeAuthorization(
+		userId: string,
+		clientId: string,
+		now: Date = new Date(),
+	): Promise<void> {
+		await this.#config.store.revokeAccessFor(userId, clientId, now);
+		await this.#config.store.deleteConsent(userId, clientId);
 	}
 
 	/** Read credentials out of a request, both places the spec allows. */

package/src/VisaProvider.ts

@@ -19,6 +19,11 @@
 import "./augmentations.js";
 import type { VisaConfigInput } from "./config.js";
 import { OAuthError } from "./errors.js";
+import {
+	PROTECTED_RESOURCE_PATH,
+	protectedResourceMetadata,
+	protectedResourceMetadataUrl,
+} from "./protectedResource.js";
 import { clearVisa, getVisa, setVisa } from "./services/main.js";
 import { VisaManager } from "./VisaManager.js";
 
@@ -132,6 +137,24 @@ export default class VisaProvider {
 			});
 		});
 
+		// RFC 7591 — a client that registers itself. Mounted only when the
+		// application turned it on: an authorization server quietly accepting
+		// registrations is a thing nobody asked for.
+		if (config?.registration?.enabled === true) {
+			router.post(`${prefix}/register`, async (ctx) => {
+				await this.#answer(ctx, async () => {
+					const bearer = readBearer(ctx);
+					const created = await manager.register(ctx.request.all(), bearer);
+					// §3.2.1: 201, and the body carries a secret — no cache may
+					// keep it.
+					ctx.response.status(201);
+					ctx.response.header("cache-control", "no-store");
+					ctx.response.header("pragma", "no-cache");
+					return created;
+				});
+			});
+		}
+
 		// RFC 8414 — what a client fetches to discover the endpoints.
 		router.get("/.well-known/oauth-authorization-server", async (ctx) => {
 			ctx.response.header("content-type", "application/json");
@@ -150,6 +173,9 @@ export default class VisaProvider {
 				// S256 only unless the application turned `plain` back on.
 				code_challenge_methods_supported:
 					config?.allowPlainChallenge === true ? ["S256", "plain"] : ["S256"],
+				...(config?.registration?.enabled === true
+					? { registration_endpoint: `${manager.issuer}${prefix}/register` }
+					: {}),
 				token_endpoint_auth_methods_supported: [
 					"client_secret_basic",
 					"client_secret_post",
@@ -157,6 +183,34 @@ export default class VisaProvider {
 				],
 			});
 		});
+
+		// RFC 9728 — what a client fetches after a 401 to learn where tokens
+		// come from. Mounted only when the application named its resource: a
+		// document announcing a resource nobody declared would point clients at
+		// something that does not exist.
+		const protectedResource = config?.protectedResource;
+		if (protectedResource !== undefined) {
+			const document = protectedResourceMetadata({
+				...protectedResource,
+				authorizationServers: [manager.issuer],
+			});
+			router.get(PROTECTED_RESOURCE_PATH, async (ctx) => {
+				ctx.response.header("content-type", "application/json");
+				ctx.response.send(document);
+			});
+			// §3: the well-known segment goes BETWEEN the host and the resource's
+			// path, so a resource at `/mcp` publishes at `…/oauth-protected-
+			// resource/mcp`. Both are served: a client may ask for either.
+			const withPath = new URL(
+				protectedResourceMetadataUrl(protectedResource.resource),
+			).pathname;
+			if (withPath !== PROTECTED_RESOURCE_PATH) {
+				router.get(withPath, async (ctx) => {
+					ctx.response.header("content-type", "application/json");
+					ctx.response.send(document);
+				});
+			}
+		}
 	}
 
 	async shutdown(): Promise<void> {
@@ -191,6 +245,16 @@ export default class VisaProvider {
 	}
 }
 
+/** The initial access token a registration may carry (RFC 7591 §3). */
+function readBearer(ctx: VisaHttpContext): string | undefined {
+	const header = ctx.request.header("authorization");
+	if (header === undefined) return undefined;
+	const [scheme, value] = header.split(" ");
+	if (scheme?.toLowerCase() !== "bearer" || value === undefined)
+		return undefined;
+	return value;
+}
+
 function readAuthorization(ctx: VisaHttpContext): { authorization?: string } {
 	const header = ctx.request.header("authorization");
 	return header === undefined ? {} : { authorization: header };

package/src/authorize.ts

@@ -15,6 +15,7 @@ import {
 } from "./clients.js";
 import { hashSecret, randomToken } from "./crypto.js";
 import { OAuthError } from "./errors.js";
+import { readResourceParameter, validateResources } from "./resource.js";
 import type { VisaStore } from "./store.js";
 import type { AuthorizationCode, Client } from "./types.js";
 
@@ -30,6 +31,13 @@ export interface AuthorizationRequest {
 	nonce?: string;
 	/** A client may ask to always see the consent screen. */
 	prompt?: string;
+	/**
+	 * Which resource the token is for (RFC 8707). One, or several.
+	 *
+	 * A parser hands repeated parameters over as an array, so both shapes are
+	 * accepted rather than one being silently the only one that works.
+	 */
+	resource?: string | string[];
 }
 
 /** A request that passed every check, with the values it resolved to. */
@@ -41,6 +49,8 @@ export interface ValidatedRequest {
 	codeChallenge: string;
 	codeChallengeMethod: "S256" | "plain";
 	nonce: string | undefined;
+	/** The resources the token will be bound to (RFC 8707). Empty means unbound. */
+	resources: string[];
 }
 
 /**
@@ -61,6 +71,15 @@ export class UnredirectableError extends Error {
 export interface AuthorizeOptions {
 	/** Lifetime of the code. Short on purpose — see `issueAuthorizationCode`. */
 	codeTtlSeconds?: number;
+	/**
+	 * The resources this server will issue tokens for (RFC 8707).
+	 *
+	 * Left out, any well-formed resource is accepted and carried — which is
+	 * useful while a deployment finds its names, and worth replacing with the
+	 * list once it has: an unknown resource should be refused with
+	 * `invalid_target` rather than minted for.
+	 */
+	resourcesSupported?: readonly string[];
 	/**
 	 * Accept `plain` as a code challenge method.
 	 *
@@ -119,6 +138,10 @@ export async function validateAuthorizationRequest(
 		options,
 	);
 	const scopes = resolveScopes(request.scope, client);
+	const resources = validateResources(
+		readResourceParameter(request.resource),
+		options.resourcesSupported,
+	);
 
 	return {
 		client,
@@ -128,6 +151,7 @@ export async function validateAuthorizationRequest(
 		codeChallenge,
 		codeChallengeMethod,
 		nonce: request.nonce,
+		resources,
 	};
 }
 
@@ -215,6 +239,9 @@ export async function issueAuthorizationCode(
 		codeChallengeMethod: validated.codeChallengeMethod,
 		expiresAt: new Date(now.getTime() + ttl * 1000),
 		...(validated.nonce === undefined ? {} : { nonce: validated.nonce }),
+		...(validated.resources.length === 0
+			? {}
+			: { resources: validated.resources }),
 	};
 	await store.saveAuthorizationCode(record);
 	return code;

package/src/config.ts

@@ -3,6 +3,7 @@
  * provider reads out of the config store.
  */
 
+import type { RegistrationOptions } from "./register.js";
 import type { VisaStore } from "./store.js";
 
 export interface VisaConfigInput {
@@ -27,6 +28,40 @@ export interface VisaConfigInput {
 	allowPlainChallenge?: boolean;
 	/** Where the endpoints are mounted. Default `/oauth`. */
 	prefix?: string;
+	/**
+	 * The resources this server issues tokens for (RFC 8707).
+	 *
+	 * Left out, any well-formed `resource` is accepted and carried. Named, an
+	 * unknown one is refused with `invalid_target` — which is what stops a
+	 * client asking for a token aimed at a server you do not run.
+	 */
+	resourcesSupported?: string[];
+	/**
+	 * Let clients register themselves (RFC 7591).
+	 *
+	 * OFF unless you say otherwise. An MCP client such as claude.ai has nobody
+	 * to fill in a form for it, so it needs this; a server on the public
+	 * internet with it open lets anyone create a client, so think about
+	 * `initialAccessToken` before shipping one.
+	 */
+	registration?: RegistrationOptions;
+	/**
+	 * The protected resource this server issues tokens for (RFC 9728).
+	 *
+	 * Declare it and two things follow: the metadata document is served at
+	 * `/.well-known/oauth-protected-resource`, and a refusal can name it. An
+	 * MCP client walks from the 401 to that document to this server without
+	 * anybody pasting a URL into a config file, which is the whole reason the
+	 * RFC exists.
+	 */
+	protectedResource?: {
+		/** The resource identifier — an absolute URI, no fragment. */
+		resource: string;
+		/** What a client may ask for. RECOMMENDED by §3.2. */
+		scopesSupported?: string[];
+		resourceName?: string;
+		resourceDocumentation?: string;
+	};
 }
 
 export function defineConfig(config: VisaConfigInput): VisaConfigInput {