@c9up/visa 0.1.3 → 0.1.4

package/README.md

@@ -41,13 +41,39 @@ consent screen, and both belong to your application. See below.
 - **Refresh rotation with replay detection.** Every use mints a new token; a
   spent one coming back proves a leak, and since there is no telling the thief
   from the victim, the whole family goes.
+- **Parameters in the body only.** `/token`, `/introspect`, `/revoke` and
+  `/register` read the request body only, and answer `invalid_request` to a
+  request that puts an OAuth parameter (`client_secret`, `code`, `token`,
+  `refresh_token`, registration metadata on `/register`…) in the query
+  string: a secret, a code or a token in a URL ends up in access logs,
+  proxies and traces (RFC 6749 §2.3.1). Other query parameters are ignored.
+- **A scope is not a permission.** `visaGuard()` puts the token's scopes on
+  `ctx.auth.user.currentAccessToken` (`allows`, `denies`, `authorize`) and
+  leaves `user.permissions` as your user provider returned it. A scope is
+  chosen by the client and granted by consent, which never checks the user's
+  own rights — so a route that needs both checks both.
 - **One sentence per failure.** "No such code", "expired", "already used" and
   "wrong client" are `invalid_grant: The code is not valid.` — telling them
   apart is how a code space gets probed.
 
 ## Wiring `/authorize`
 
-The decision is visa's; the page is yours.
+The decision is visa's; the page is yours. The consent page is the one place a
+user hands an application their data, so three things are not optional:
+
+- **The consent POST is CSRF-protected.** Without it, a page on another site
+  auto-submits the form — its own client, its own PKCE challenge,
+  `approve=1` — and a signed-in user grants the attacker's application without
+  seeing anything (RFC 6819 §4.4.1.9). Turn on blackhole's CSRF
+  (`csrf: true` in `config/blackhole.ts`) and put `{{ csrfField() }}` in the
+  form.
+- **The consent page cannot be framed.** A framed page lets another site lay
+  its own button over "Allow" (clickjacking, RFC 9700 §4.15). Send
+  `X-Frame-Options: DENY` from this page, and `frame-ancestors 'none'` if you
+  build its `Content-Security-Policy` yourself.
+- **The POST grants what the page showed, not what the POST says.** The
+  validated request stays on the server, in a single-use ticket bound to the
+  session and the user. The form carries only the ticket's id.
 
 ```ts
 // start/routes.ts
@@ -63,22 +89,55 @@ router.get('/oauth/authorize', async (ctx) => {
   }
   if (!ctx.auth.user) return ctx.response.redirect('/login?next=' + encodeURIComponent(ctx.request.url(true)))
 
+  // Kept server-side: the POST below grants this, whatever it is sent.
+  const ticket = visa.consentTicket(outcome.request, ctx.auth.user.id)
+  ctx.session.put('visa.consent', ticket)
+
+  ctx.response.header('x-frame-options', 'DENY')
   return ctx.view.render('oauth/consent', {
     client: outcome.request.client,
     scopes: outcome.request.scopes,
+    ticket: ticket.id,
   })
 })
 
+// CSRF-protected by blackhole, like every other form POST.
 router.post('/oauth/consent', async (ctx) => {
-  const outcome = await visa.authorize(ctx.request.all(), ctx.auth.user.id)
-  if (outcome.type !== 'consent') return ctx.response.redirect('/')
-  const url = ctx.request.input('approve')
-    ? await visa.grant(outcome.request, ctx.auth.user.id)
-    : visa.deny(outcome.request)
+  const user = ctx.auth.getUserOrFail()
+  // Pulled, not read: a second POST of the same form finds nothing.
+  const validated = await visa.redeemConsentTicket(
+    ctx.session.pull('visa.consent'),
+    ctx.request.input('ticket'),
+    user.id,
+  )
+  if (validated === null) {
+    // No ticket, another page's ticket, another user, expired, or a client
+    // that changed since the page was shown: start again.
+    return ctx.view.render('oauth/error', { error: { error: 'invalid_request' } })
+  }
+
+  const url = ctx.request.input('approve') === '1'
+    ? await visa.grant(validated, user.id)
+    : visa.deny(validated)
   return ctx.response.redirect(url)
 })
 ```
 
+```html
+<!-- resources/views/oauth/consent.inker -->
+<form method="POST" action="/oauth/consent">
+  {{ csrfField() }}
+  <input type="hidden" name="ticket" value="{{ ticket }}">
+  <button name="approve" value="1">Allow</button>
+  <button name="approve" value="0">Deny</button>
+</form>
+```
+
+`redeemConsentTicket` validates the request again (a client may have lost a
+scope or a redirect URI meanwhile) and mints nothing: the code exists only once
+`grant` runs. A ticket lasts ten minutes; `consentTicketTtlSeconds` in the
+config changes it.
+
 ## Registering a client
 
 ```ts
@@ -140,11 +199,23 @@ trailing slash is dropped — every endpoint is built by concatenation, so
 
 ## The store
 
-`MemoryStore` is for tests and a single development process. Everything else
-implements `VisaStore` — twelve methods. Two of them, `consumeAuthorizationCode`
-and `consumeRefreshToken`, **must be atomic**: two requests racing with the same
-code must not both succeed, and that single-use guarantee is what replay
-detection is built on.
+`MemoryStore` is for tests and a single development process. `AtlasStore`
+(`@c9up/visa/stores/atlas`) runs on the tables of the migration
+`ream configure` writes. Anything else implements `VisaStore`. Two of its
+methods, `consumeAuthorizationCode` and `consumeRefreshToken`, **must be
+atomic**: two requests racing with the same code must not both succeed, and
+that single-use guarantee is what replay detection is built on.
+
+`saveClient` is optional, for clients that live in a table you do not own.
+Without it `registerClient` throws, and a server with `registration.enabled`
+refuses to boot rather than answering 500 to every registration.
+
+A `visa_clients` table created by visa 0.1.3 or earlier has no
+`secret_expires_at` column, and `AtlasStore` writes it on every client — a
+secret's expiry is enforced from it. Run `ream configure @c9up/visa` again
+before upgrading: your existing `9000_create_visa_tables` is left alone and
+`9001_add_visa_client_secret_expiry` lands beside it; `migration:run` adds the
+column.
 
 ## What is not here yet
 

package/dist/VisaManager.d.ts

@@ -19,6 +19,28 @@ export interface VisaConfig extends AuthorizeOptions, TokenOptions {
     store: VisaStore;
     /** Whether clients may register themselves, and on what terms (RFC 7591). */
     registration?: RegistrationOptions;
+    /**
+     * How long a consent page may stay open before its answer is refused, in
+     * seconds. Ten minutes by default — see {@link VisaManager.consentTicket}.
+     */
+    consentTicketTtlSeconds?: number;
+}
+/**
+ * What the application keeps server-side between the consent page and the
+ * POST that answers it — in the session, never in the form.
+ *
+ * Plain values only, so any session store can hold it: the request as it was
+ * validated, not the client record (which carries the secret's hash).
+ */
+export interface ConsentTicket {
+    /** Random, 256 bits. The consent form posts it back; nothing else does. */
+    id: string;
+    /** Who was asked. Another user answering it is refused. */
+    userId: string;
+    /** Milliseconds since the epoch. */
+    expiresAt: number;
+    /** The authorization request, rebuilt from what was validated. */
+    request: AuthorizationRequest;
 }
 /** What `authorize()` decided. */
 export type AuthorizationOutcome = 
@@ -87,6 +109,31 @@ export declare class VisaManager {
      * the answer to it is a POST the application owns.
      */
     grant(validated: ValidatedRequest, userId: string, now?: Date): Promise<string>;
+    /**
+     * Remember what the consent page asks, so its answer cannot change it.
+     *
+     * The application puts the ticket in the user's session, renders its `id`
+     * as a hidden field, and on the POST hands both to
+     * {@link redeemConsentTicket}. What gets granted is then the request the
+     * user was shown — not whatever parameters the POST carries — and the
+     * session makes it single use (`session.pull`) and bound to this browser.
+     */
+    consentTicket(validated: ValidatedRequest, userId: string, now?: Date): ConsentTicket;
+    /**
+     * The consent page's answer, checked against the ticket it was rendered with.
+     *
+     * `ticket` is what the session held — pulled, not read, so a second POST
+     * of the same form finds nothing. `presentedId` is the form's hidden field:
+     * it must name THIS ticket, which is what stops a form left open in one tab
+     * from approving the request another tab put in the session since. The
+     * request is validated again — the client may have lost a scope or a
+     * redirect URI meanwhile — and no code is minted: that is `grant`'s job,
+     * once the user said yes.
+     *
+     * `null` for anything wrong: no ticket, another ticket, another user,
+     * expired, or a request that no longer validates. The user starts again.
+     */
+    redeemConsentTicket(ticket: unknown, presentedId: unknown, userId: string, now?: Date): Promise<ValidatedRequest | null>;
     /** The user said no. */
     deny(validated: ValidatedRequest): string;
     token(body: Record<string, unknown>, credentials: ClientCredentials, now?: Date): Promise<TokenResponse>;

package/dist/VisaManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"VisaManager.d.ts","sourceRoot":"","sources":["../src/VisaManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EAKrB,KAAK,gBAAgB,EAErB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,UAAU,EAAa,MAAM,aAAa,CAAC;AACpD,OAAO,EAAsB,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACN,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EAIxB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,KAAK,YAAY,EAAS,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EACX,qBAAqB,EACrB,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,aAAa,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,UAAW,SAAQ,gBAAgB,EAAE,YAAY;IACjE,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;IACjB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAED,kCAAkC;AAClC,MAAM,MAAM,oBAAoB;AAC/B,0BAA0B;AACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACnC,2EAA2E;GACzE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE;AAChD;;;GAGG;GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAExC,qBAAa,WAAW;;gBAGX,MAAM,EAAE,UAAU;IAO9B,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,KAAK,IAAI,SAAS,CAErB;IAED;;;;;;OAMG;IACG,cAAc,CAAC,KAAK,EAAE;QAC3B,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;QAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,uEAAuE;QACvE,eAAe,CAAC,EAAE,IAAI,CAAC;KACvB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqChD;;;;;OAKG;IACG,QAAQ,CACb,OAAO,EAAE,yBAAyB,EAClC,cAAc,CAAC,EAAE,MAAM,EACvB,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,0BAA0B,CAAC;IAqBtC;;;;;OAKG;IACG,SAAS,CACd,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,oBAAoB,CAAC;IA2ChC;;;;;OAKG;IACG,KAAK,CACV,SAAS,EAAE,gBAAgB,EAC3B,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,MAAM,CAAC;IAiBlB,wBAAwB;IACxB,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM;IAQnC,KAAK,CACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,aAAa,CAAC;IAInB,UAAU,CACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,qBAAqB,CAAC;IAI3B,MAAM,CACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;;OAKG;IACG,MAAM,CACX,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,IAAiB,EACtB,QAAQ,CAAC,EAAE,MAAM,GACf,UAAU,CAAC,OAAO,iBAAiB,CAAC;IAIvC;;;;;;;OAOG;IACG,kBAAkB,CACvB,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAiCnC;;;;;;;;;;OAUG;IACG,mBAAmB,CACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,IAAI,CAAC;IAKhB,sEAAsE;IACtE,eAAe,CAAC,KAAK,EAAE;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC9B,GAAG,iBAAiB;CAsBrB"}
+{"version":3,"file":"VisaManager.d.ts","sourceRoot":"","sources":["../src/VisaManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EAKrB,KAAK,gBAAgB,EAErB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,UAAU,EAAa,MAAM,aAAa,CAAC;AACpD,OAAO,EAAsB,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACN,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EAIxB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,KAAK,YAAY,EAAS,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EACX,qBAAqB,EACrB,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,aAAa,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,UAAW,SAAQ,gBAAgB,EAAE,YAAY;IACjE,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;IACjB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,oBAAoB,CAAC;CAC9B;AAID,kCAAkC;AAClC,MAAM,MAAM,oBAAoB;AAC/B,0BAA0B;AACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACnC,2EAA2E;GACzE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE;AAChD;;;GAGG;GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAExC,qBAAa,WAAW;;gBAGX,MAAM,EAAE,UAAU;IAQ9B,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,KAAK,IAAI,SAAS,CAErB;IAED;;;;;;OAMG;IACG,cAAc,CAAC,KAAK,EAAE;QAC3B,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;QAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,uEAAuE;QACvE,eAAe,CAAC,EAAE,IAAI,CAAC;KACvB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA+BhD;;;;;OAKG;IACG,QAAQ,CACb,OAAO,EAAE,yBAAyB,EAClC,cAAc,CAAC,EAAE,MAAM,EACvB,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,0BAA0B,CAAC;IAqBtC;;;;;OAKG;IACG,SAAS,CACd,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,oBAAoB,CAAC;IA2ChC;;;;;OAKG;IACG,KAAK,CACV,SAAS,EAAE,gBAAgB,EAC3B,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,MAAM,CAAC;IAiBlB;;;;;;;;OAQG;IACH,aAAa,CACZ,SAAS,EAAE,gBAAgB,EAC3B,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACpB,aAAa;IA2BhB;;;;;;;;;;;;;OAaG;IACG,mBAAmB,CACxB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,OAAO,EACpB,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IA2BnC,wBAAwB;IACxB,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM;IAQnC,KAAK,CACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,aAAa,CAAC;IAInB,UAAU,CACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,qBAAqB,CAAC;IAI3B,MAAM,CACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;;OAKG;IACG,MAAM,CACX,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,IAAiB,EACtB,QAAQ,CAAC,EAAE,MAAM,GACf,UAAU,CAAC,OAAO,iBAAiB,CAAC;IAIvC;;;;;;;OAOG;IACG,kBAAkB,CACvB,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAiCnC;;;;;;;;;;OAUG;IACG,mBAAmB,CACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,IAAI,CAAC;IAKhB,sEAAsE;IACtE,eAAe,CAAC,KAAK,EAAE;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC9B,GAAG,iBAAiB;CAsBrB"}

package/dist/VisaManager.js

@@ -7,11 +7,12 @@
  */
 import { errorRedirect, issueAuthorizationCode, successRedirect, UnredirectableError, validateAuthorizationRequest, } from "./authorize.js";
 import { readCredentials, redirectUriMatches, } from "./clients.js";
-import { hashSecret, randomToken } from "./crypto.js";
+import { hashMatches, hashSecret, randomToken, sha256 } from "./crypto.js";
 import { OAuthError, VisaError } from "./errors.js";
 import { introspect, revoke, verifyAccessToken } from "./introspect.js";
 import { registrationResponse, secretExpiryFor, validateRegistration, } from "./register.js";
 import { token } from "./token.js";
+const DEFAULT_CONSENT_TICKET_TTL_SECONDS = 600;
 export class VisaManager {
     #config;
     constructor(config) {
@@ -19,6 +20,7 @@ export class VisaManager {
         // with a broken issuer answers every metadata fetch with something no
         // client can use, and says so nowhere.
         this.#config = { ...config, issuer: normalizeIssuer(config.issuer) };
+        assertRegistration(config);
     }
     get issuer() {
         return this.#config.issuer;
@@ -57,12 +59,11 @@ export class VisaManager {
                 : { secretExpiresAt: input.secretExpiresAt }),
         };
         const store = this.#config.store;
-        if (!("addClient" in store) || typeof store.addClient !== "function") {
-            throw new VisaError("E_VISA_STORE_READ_ONLY", "This store cannot register clients; create them where they live.", {
-                hint: "MemoryStore.addClient exists; a database store registers rows.",
-            });
-        }
-        store.addClient(client);
+        if (store.saveClient === undefined)
+            throw readOnlyStore();
+        // Awaited: the secret below is handed out once, and handing it out for a
+        // client whose write failed is a credential nothing will ever accept.
+        await store.saveClient(client);
         return secret === undefined ? { client } : { client, secret };
     }
     /**
@@ -146,6 +147,81 @@ export class VisaManager {
         const code = await issueAuthorizationCode(validated, userId, this.#config.store, this.#config, now);
         return successRedirect(validated, code);
     }
+    /**
+     * Remember what the consent page asks, so its answer cannot change it.
+     *
+     * The application puts the ticket in the user's session, renders its `id`
+     * as a hidden field, and on the POST hands both to
+     * {@link redeemConsentTicket}. What gets granted is then the request the
+     * user was shown — not whatever parameters the POST carries — and the
+     * session makes it single use (`session.pull`) and bound to this browser.
+     */
+    consentTicket(validated, userId, now = new Date()) {
+        const ttl = this.#config.consentTicketTtlSeconds ??
+            DEFAULT_CONSENT_TICKET_TTL_SECONDS;
+        return {
+            id: randomToken(),
+            userId,
+            expiresAt: now.getTime() + ttl * 1000,
+            request: {
+                response_type: "code",
+                client_id: validated.client.id,
+                redirect_uri: validated.redirectUri,
+                // Joined from what was resolved, so an omitted `scope` that
+                // defaulted to the client's list is the list the user saw, even
+                // if the client registers more by the time the user answers.
+                scope: validated.scopes.join(" "),
+                code_challenge: validated.codeChallenge,
+                code_challenge_method: validated.codeChallengeMethod,
+                ...(validated.state === undefined ? {} : { state: validated.state }),
+                ...(validated.nonce === undefined ? {} : { nonce: validated.nonce }),
+                ...(validated.resources.length === 0
+                    ? {}
+                    : { resource: [...validated.resources] }),
+            },
+        };
+    }
+    /**
+     * The consent page's answer, checked against the ticket it was rendered with.
+     *
+     * `ticket` is what the session held — pulled, not read, so a second POST
+     * of the same form finds nothing. `presentedId` is the form's hidden field:
+     * it must name THIS ticket, which is what stops a form left open in one tab
+     * from approving the request another tab put in the session since. The
+     * request is validated again — the client may have lost a scope or a
+     * redirect URI meanwhile — and no code is minted: that is `grant`'s job,
+     * once the user said yes.
+     *
+     * `null` for anything wrong: no ticket, another ticket, another user,
+     * expired, or a request that no longer validates. The user starts again.
+     */
+    async redeemConsentTicket(ticket, presentedId, userId, now = new Date()) {
+        const read = readConsentTicket(ticket);
+        if (read === null || typeof presentedId !== "string")
+            return null;
+        if (!hashMatches(sha256(presentedId), sha256(read.id)))
+            return null;
+        if (read.userId !== userId)
+            return null;
+        if (read.expiresAt <= now.getTime())
+            return null;
+        try {
+            const validated = await validateAuthorizationRequest(read.request, this.#config.store, this.#config);
+            // An empty `scope` resolves to the client's registered list, which
+            // may have grown since the page was shown: the user agreed to the
+            // list on the page, and to nothing it has become.
+            if (validated.scopes.join(" ") !== (read.request.scope ?? "")) {
+                return null;
+            }
+            return validated;
+        }
+        catch (error) {
+            if (error instanceof UnredirectableError || error instanceof OAuthError) {
+                return null;
+            }
+            throw error;
+        }
+    }
     /** The user said no. */
     deny(validated) {
         return errorRedirect(validated.redirectUri, new OAuthError("access_denied", "The user refused the request."), validated.state);
@@ -270,6 +346,92 @@ function normalizeIssuer(issuer) {
     }
     return issuer.replace(/\/+$/, "");
 }
+/**
+ * A ticket as a session store hands it back: untyped, so read field by field.
+ *
+ * A session serialises to JSON and back, and a store an application wrote
+ * itself may hand back anything — a value that is not exactly a ticket is no
+ * ticket.
+ */
+function readConsentTicket(value) {
+    if (typeof value !== "object" || value === null)
+        return null;
+    if (!("id" in value) || typeof value.id !== "string" || value.id === "")
+        return null;
+    if (!("userId" in value) || typeof value.userId !== "string")
+        return null;
+    if (!("expiresAt" in value) || typeof value.expiresAt !== "number")
+        return null;
+    if (!("request" in value))
+        return null;
+    const request = readTicketRequest(value.request);
+    if (request === null)
+        return null;
+    return {
+        id: value.id,
+        userId: value.userId,
+        expiresAt: value.expiresAt,
+        request,
+    };
+}
+/** `prompt` is left out on purpose: the ticket IS the consent being asked. */
+const TICKET_STRING_FIELDS = [
+    "response_type",
+    "client_id",
+    "redirect_uri",
+    "scope",
+    "state",
+    "code_challenge",
+    "code_challenge_method",
+    "nonce",
+];
+function readTicketRequest(value) {
+    if (typeof value !== "object" || value === null)
+        return null;
+    const request = {};
+    for (const key of TICKET_STRING_FIELDS) {
+        const field = Reflect.get(value, key);
+        if (field === undefined)
+            continue;
+        if (typeof field !== "string")
+            return null;
+        request[key] = field;
+    }
+    const resource = Reflect.get(value, "resource");
+    if (resource !== undefined) {
+        if (!Array.isArray(resource) ||
+            !resource.every((entry) => typeof entry === "string")) {
+            return null;
+        }
+        request.resource = resource;
+    }
+    return request;
+}
+/**
+ * Registration that can actually register, checked at boot.
+ *
+ * Both failures would otherwise surface on the first `POST /register`: a store
+ * with nowhere to write a client answers every MCP client a 500, and an empty
+ * initial access token is matched by `Authorization: Bearer ` — an endpoint
+ * the deployment meant to close, open to anyone who sends the header.
+ */
+function assertRegistration(config) {
+    const registration = config.registration;
+    if (registration?.enabled !== true)
+        return;
+    if (config.store.saveClient === undefined)
+        throw readOnlyStore();
+    if (registration.initialAccessToken === "") {
+        throw new VisaError("E_VISA_INVALID_INITIAL_ACCESS_TOKEN", "registration.initialAccessToken is empty, which would accept an empty bearer token.", {
+            hint: "Set a long random value, or leave it out for open registration.",
+        });
+    }
+}
+function readOnlyStore() {
+    return new VisaError("E_VISA_STORE_READ_ONLY", "This store cannot register clients; create them where they live.", {
+        hint: "Implement saveClient(client) on the store — MemoryStore and AtlasStore both do.",
+    });
+}
 /**
  * Every redirect URI a client registers, checked once.
  *

package/dist/VisaManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"VisaManager.js","sourceRoot":"","sources":["../src/VisaManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAGN,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EAEnB,4BAA4B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEN,eAAe,EACf,kBAAkB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAIN,oBAAoB,EACpB,eAAe,EACf,oBAAoB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAqB,KAAK,EAAE,MAAM,YAAY,CAAC;AA8BtD,MAAM,OAAO,WAAW;IACd,OAAO,CAAa;IAE7B,YAAY,MAAkB;QAC7B,uEAAuE;QACvE,sEAAsE;QACtE,uCAAuC;QACvC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,MAAM;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,KAUpB;QACA,qEAAqE;QACrE,yDAAyD;QACzD,qEAAqE;QACrE,yBAAyB;QACzB,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,uBAAuB,IAAI,qBAAqB,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAW;YACtB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACvE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;YAC1B,uBAAuB,EAAE,MAAM;YAC/B,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,oEAAoE;YACpE,gCAAgC;YAChC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;gBAC9D,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;SAC9C,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACtE,MAAM,IAAI,SAAS,CAClB,wBAAwB,EACxB,kEAAkE,EAClE;gBACC,IAAI,EAAE,gEAAgE;aACtE,CACD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxB,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACb,OAAkC,EAClC,cAAuB,EACvB,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;QACxE,kEAAkE;QAClE,uEAAuE;QACvE,oBAAoB;QACpB,MAAM,eAAe,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;YACpD,mEAAmE;YACnE,6DAA6D;YAC7D,EAAE,EAAE,WAAW,EAAE;YACjB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO,oBAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CACd,OAA6B,EAC7B,MAA0B;QAE1B,IAAI,SAA2B,CAAC;QAChC,IAAI,CAAC;YACJ,SAAS,GAAG,MAAM,4BAA4B,CAC7C,OAAO,EACP,IAAI,CAAC,OAAO,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,CACZ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC9C,CAAC;YACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBACjC,4DAA4D;gBAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBAChD,IAAI,GAAG,KAAK,IAAI;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAClD,OAAO;oBACN,IAAI,EAAE,UAAU;oBAChB,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;iBAC7C,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CACnD,MAAM,EACN,SAAS,CAAC,MAAM,CAAC,EAAE,CACnB,CAAC;QACF,MAAM,OAAO,GACZ,OAAO,KAAK,IAAI;YAChB,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;QAC5C,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CACV,SAA2B,EAC3B,MAAc,EACd,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;YACpC,MAAM;YACN,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE;YAC7B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,SAAS,EAAE,GAAG;SACd,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,sBAAsB,CACxC,SAAS,EACT,MAAM,EACN,IAAI,CAAC,OAAO,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,EACZ,GAAG,CACH,CAAC;QACF,OAAO,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC,SAA2B;QAC/B,OAAO,aAAa,CACnB,SAAS,CAAC,WAAW,EACrB,IAAI,UAAU,CAAC,eAAe,EAAE,+BAA+B,CAAC,EAChE,SAAS,CAAC,KAAK,CACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CACV,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,UAAU,CACf,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,MAAM,CACX,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CACX,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE,EACtB,QAAiB;QAEjB,OAAO,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACvB,MAAc,EACd,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAEpD,OAAO,OAAO,CAAC,GAAG,CACjB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAC9C,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;gBAClE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;oBAAE,OAAO,MAAM,CAAC;gBAClD,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,UAAU,CAAC;gBAClD,OAAO,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9D,CAAC,EAAE,SAAS,CAAC,CAAC;YAEd,OAAO;gBACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,kEAAkE;gBAClE,2DAA2D;gBAC3D,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,QAAQ;gBACtC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;gBACnD,MAAM,EAAE,IAAI,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,CACjE;aACD,CAAC;QACH,CAAC,CAAC,CACF,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,mBAAmB,CACxB,MAAc,EACd,QAAgB,EAChB,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED,sEAAsE;IACtE,eAAe,CAAC,KAGf;QACA,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,OAA6B;QAClD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBACtC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;gBAClC,CAAC,CAAC,IAAI,CAAC;QACT,CAAC;QACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;YACnE,CAAC,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,IAAI,CAAC;IACT,CAAC;CACD;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,MAAc;IACtC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,6EAA6E,EAC7E,EAAE,IAAI,EAAE,+DAA+D,EAAE,CACzE,CAAC;IACH,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,+BAA+B,MAAM,EAAE,EACvC,EAAE,IAAI,EAAE,wDAAwD,EAAE,CAClE,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC/D,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,IAAI,SAAS,CAClB,wBAAwB,EACxB,qDAAqD,MAAM,EAAE,CAC7D,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,2DAA2D,CAC3D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAuB;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAClB,wBAAwB,EACxB,2CAA2C,CAC3C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACJ,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,SAAS,CAAC,6BAA6B,EAAE,cAAc,GAAG,EAAE,EAAE;gBACvE,IAAI,EAAE,sDAAsD;aAC5D,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,SAAS,CAClB,6BAA6B,EAC7B,0CAA0C,GAAG,EAAE,CAC/C,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAClB,6BAA6B,EAC7B,mEAAmE,GAAG,EAAE,CACxE,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"VisaManager.js","sourceRoot":"","sources":["../src/VisaManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAGN,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EAEnB,4BAA4B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEN,eAAe,EACf,kBAAkB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAIN,oBAAoB,EACpB,eAAe,EACf,oBAAoB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAqB,KAAK,EAAE,MAAM,YAAY,CAAC;AAyCtD,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAc/C,MAAM,OAAO,WAAW;IACd,OAAO,CAAa;IAE7B,YAAY,MAAkB;QAC7B,uEAAuE;QACvE,sEAAsE;QACtE,uCAAuC;QACvC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,KAUpB;QACA,qEAAqE;QACrE,yDAAyD;QACzD,qEAAqE;QACrE,yBAAyB;QACzB,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,uBAAuB,IAAI,qBAAqB,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAW;YACtB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACvE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;YAC1B,uBAAuB,EAAE,MAAM;YAC/B,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,oEAAoE;YACpE,gCAAgC;YAChC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;gBAC9D,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;SAC9C,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,aAAa,EAAE,CAAC;QAC1D,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACb,OAAkC,EAClC,cAAuB,EACvB,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;QACxE,kEAAkE;QAClE,uEAAuE;QACvE,oBAAoB;QACpB,MAAM,eAAe,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;YACpD,mEAAmE;YACnE,6DAA6D;YAC7D,EAAE,EAAE,WAAW,EAAE;YACjB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO,oBAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CACd,OAA6B,EAC7B,MAA0B;QAE1B,IAAI,SAA2B,CAAC;QAChC,IAAI,CAAC;YACJ,SAAS,GAAG,MAAM,4BAA4B,CAC7C,OAAO,EACP,IAAI,CAAC,OAAO,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,CACZ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC9C,CAAC;YACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBACjC,4DAA4D;gBAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBAChD,IAAI,GAAG,KAAK,IAAI;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAClD,OAAO;oBACN,IAAI,EAAE,UAAU;oBAChB,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;iBAC7C,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CACnD,MAAM,EACN,SAAS,CAAC,MAAM,CAAC,EAAE,CACnB,CAAC;QACF,MAAM,OAAO,GACZ,OAAO,KAAK,IAAI;YAChB,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;QAC5C,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CACV,SAA2B,EAC3B,MAAc,EACd,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;YACpC,MAAM;YACN,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE;YAC7B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,SAAS,EAAE,GAAG;SACd,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,sBAAsB,CACxC,SAAS,EACT,MAAM,EACN,IAAI,CAAC,OAAO,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,EACZ,GAAG,CACH,CAAC;QACF,OAAO,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;;;OAQG;IACH,aAAa,CACZ,SAA2B,EAC3B,MAAc,EACd,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,GAAG,GACR,IAAI,CAAC,OAAO,CAAC,uBAAuB;YACpC,kCAAkC,CAAC;QACpC,OAAO;YACN,EAAE,EAAE,WAAW,EAAE;YACjB,MAAM;YACN,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,IAAI;YACrC,OAAO,EAAE;gBACR,aAAa,EAAE,MAAM;gBACrB,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE;gBAC9B,YAAY,EAAE,SAAS,CAAC,WAAW;gBACnC,4DAA4D;gBAC5D,gEAAgE;gBAChE,6DAA6D;gBAC7D,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBACjC,cAAc,EAAE,SAAS,CAAC,aAAa;gBACvC,qBAAqB,EAAE,SAAS,CAAC,mBAAmB;gBACpD,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;gBACpE,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;gBACpE,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBACnC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;aAC1C;SACD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,mBAAmB,CACxB,MAAe,EACf,WAAoB,EACpB,MAAc,EACd,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,4BAA4B,CACnD,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,OAAO,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,CACZ,CAAC;YACF,mEAAmE;YACnE,kEAAkE;YAClE,kDAAkD;YAClD,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAC;YACb,CAAC;YACD,OAAO,SAAS,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBACzE,OAAO,IAAI,CAAC;YACb,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC,SAA2B;QAC/B,OAAO,aAAa,CACnB,SAAS,CAAC,WAAW,EACrB,IAAI,UAAU,CAAC,eAAe,EAAE,+BAA+B,CAAC,EAChE,SAAS,CAAC,KAAK,CACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CACV,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,UAAU,CACf,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,MAAM,CACX,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CACX,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE,EACtB,QAAiB;QAEjB,OAAO,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACvB,MAAc,EACd,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAEpD,OAAO,OAAO,CAAC,GAAG,CACjB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAC9C,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;gBAClE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;oBAAE,OAAO,MAAM,CAAC;gBAClD,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,UAAU,CAAC;gBAClD,OAAO,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9D,CAAC,EAAE,SAAS,CAAC,CAAC;YAEd,OAAO;gBACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,kEAAkE;gBAClE,2DAA2D;gBAC3D,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,QAAQ;gBACtC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;gBACnD,MAAM,EAAE,IAAI,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,CACjE;aACD,CAAC;QACH,CAAC,CAAC,CACF,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,mBAAmB,CACxB,MAAc,EACd,QAAgB,EAChB,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED,sEAAsE;IACtE,eAAe,CAAC,KAGf;QACA,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,OAA6B;QAClD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBACtC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;gBAClC,CAAC,CAAC,IAAI,CAAC;QACT,CAAC;QACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;YACnE,CAAC,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,IAAI,CAAC;IACT,CAAC;CACD;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,MAAc;IACtC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,6EAA6E,EAC7E,EAAE,IAAI,EAAE,+DAA+D,EAAE,CACzE,CAAC;IACH,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,+BAA+B,MAAM,EAAE,EACvC,EAAE,IAAI,EAAE,wDAAwD,EAAE,CAClE,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC/D,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,IAAI,SAAS,CAClB,wBAAwB,EACxB,qDAAqD,MAAM,EAAE,CAC7D,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,2DAA2D,CAC3D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE;QACtE,OAAO,IAAI,CAAC;IACb,IAAI,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACjE,OAAO,IAAI,CAAC;IACb,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO;QACN,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO;KACP,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,oBAAoB,GAGpB;IACL,eAAe;IACf,WAAW;IACX,cAAc;IACd,OAAO;IACP,OAAO;IACP,gBAAgB;IAChB,uBAAuB;IACvB,OAAO;CACP,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,MAAM,QAAQ,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YACxB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACpD,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,MAAkB;IAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACzC,IAAI,YAAY,EAAE,OAAO,KAAK,IAAI;QAAE,OAAO;IAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,aAAa,EAAE,CAAC;IACjE,IAAI,YAAY,CAAC,kBAAkB,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAClB,qCAAqC,EACrC,qFAAqF,EACrF;YACC,IAAI,EAAE,iEAAiE;SACvE,CACD,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,aAAa;IACrB,OAAO,IAAI,SAAS,CACnB,wBAAwB,EACxB,kEAAkE,EAClE;QACC,IAAI,EAAE,iFAAiF;KACvF,CACD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAuB;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAClB,wBAAwB,EACxB,2CAA2C,CAC3C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACJ,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,SAAS,CAAC,6BAA6B,EAAE,cAAc,GAAG,EAAE,EAAE;gBACvE,IAAI,EAAE,sDAAsD;aAC5D,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,SAAS,CAClB,6BAA6B,EAC7B,0CAA0C,GAAG,EAAE,CAC/C,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAClB,6BAA6B,EAC7B,mEAAmE,GAAG,EAAE,CACxE,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/VisaProvider.d.ts

@@ -14,6 +14,10 @@
  * decision; the page around it is yours. The README shows the ten lines.
  *
  * Duck-typed throughout: visa must not import its host's HTTP types.
+ *
+ * NAMED DEVIATION from the usual `request.all()`: these endpoints read the
+ * body only, and refuse a request that puts an OAuth parameter in the query
+ * string — see `readBody`.
  */
 import "./augmentations.js";
 interface VisaContainer {

package/dist/VisaProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"VisaProvider.d.ts","sourceRoot":"","sources":["../src/VisaProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,oBAAoB,CAAC;AAW5B,UAAU,aAAa;IACtB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CAC7B;AACD,UAAU,eAAe;IACxB,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CAC7C;AACD,MAAM,WAAW,cAAc;IAC9B,SAAS,EAAE,aAAa,CAAC;IACzB,MAAM,EAAE,eAAe,CAAC;CACxB;AAqBD,MAAM,CAAC,OAAO,OAAO,YAAY;;IAGpB,SAAS,CAAC,GAAG,EAAE,cAAc;gBAAnB,GAAG,EAAE,cAAc;IAEzC,QAAQ,IAAI,IAAI;IAiBV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAMrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA8HtB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CA8B/B"}
+{"version":3,"file":"VisaProvider.d.ts","sourceRoot":"","sources":["../src/VisaProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,oBAAoB,CAAC;AAW5B,UAAU,aAAa;IACtB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CAC7B;AACD,UAAU,eAAe;IACxB,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CAC7C;AACD,MAAM,WAAW,cAAc;IAC9B,SAAS,EAAE,aAAa,CAAC;IACzB,MAAM,EAAE,eAAe,CAAC;CACxB;AAwBD,MAAM,CAAC,OAAO,OAAO,YAAY;;IAGpB,SAAS,CAAC,GAAG,EAAE,cAAc;gBAAnB,GAAG,EAAE,cAAc;IAEzC,QAAQ,IAAI,IAAI;IAiBV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAMrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiItB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CA8B/B"}

package/dist/VisaProvider.js

@@ -14,6 +14,10 @@
  * decision; the page around it is yours. The README shows the ten lines.
  *
  * Duck-typed throughout: visa must not import its host's HTTP types.
+ *
+ * NAMED DEVIATION from the usual `request.all()`: these endpoints read the
+ * body only, and refuse a request that puts an OAuth parameter in the query
+ * string — see `readBody`.
  */
 import "./augmentations.js";
 import { OAuthError } from "./errors.js";
@@ -52,7 +56,7 @@ export default class VisaProvider {
         const prefix = config?.prefix ?? "/oauth";
         router.post(`${prefix}/token`, async (ctx) => {
             await this.#answer(ctx, async () => {
-                const body = ctx.request.all();
+                const body = readBody(ctx);
                 const credentials = manager.readCredentials({
                     body,
                     ...readAuthorization(ctx),
@@ -68,7 +72,7 @@ export default class VisaProvider {
         });
         router.post(`${prefix}/introspect`, async (ctx) => {
             await this.#answer(ctx, async () => {
-                const body = ctx.request.all();
+                const body = readBody(ctx);
                 const credentials = manager.readCredentials({
                     body,
                     ...readAuthorization(ctx),
@@ -79,7 +83,7 @@ export default class VisaProvider {
         });
         router.post(`${prefix}/revoke`, async (ctx) => {
             await this.#answer(ctx, async () => {
-                const body = ctx.request.all();
+                const body = readBody(ctx);
                 const credentials = manager.readCredentials({
                     body,
                     ...readAuthorization(ctx),
@@ -97,7 +101,7 @@ export default class VisaProvider {
             router.post(`${prefix}/register`, async (ctx) => {
                 await this.#answer(ctx, async () => {
                     const bearer = readBearer(ctx);
-                    const created = await manager.register(ctx.request.all(), bearer);
+                    const created = await manager.register(readBody(ctx, REGISTRATION_PARAMETERS), bearer);
                     // §3.2.1: 201, and the body carries a secret — no cache may
                     // keep it.
                     ctx.response.status(201);
@@ -192,13 +196,91 @@ export default class VisaProvider {
         }
     }
 }
+/**
+ * What may never travel in the URL of these endpoints.
+ *
+ * Every credential and every parameter the spec defines for them: the client's
+ * own (§2.3.1, RFC 7523), each grant's (§4), introspection's and revocation's
+ * (RFC 7662 §2.1, RFC 7009 §2.1), resource indicators (RFC 8707), a bearer
+ * token in its RFC 6750 §2.3 form, and the removed password grant's — a
+ * client still sending those sends a password.
+ */
+const OAUTH_PARAMETERS = new Set([
+    "client_id",
+    "client_secret",
+    "client_assertion",
+    "client_assertion_type",
+    "grant_type",
+    "code",
+    "code_verifier",
+    "redirect_uri",
+    "refresh_token",
+    "scope",
+    "resource",
+    "token",
+    "token_type_hint",
+    "access_token",
+    "username",
+    "password",
+]);
+/** The same, plus the client metadata a registration carries (RFC 7591 §2). */
+const REGISTRATION_PARAMETERS = new Set([
+    ...OAUTH_PARAMETERS,
+    "redirect_uris",
+    "token_endpoint_auth_method",
+    "grant_types",
+    "response_types",
+    "client_name",
+    "client_uri",
+    "logo_uri",
+    "contacts",
+    "tos_uri",
+    "policy_uri",
+    "jwks_uri",
+    "jwks",
+    "software_id",
+    "software_version",
+    "software_statement",
+]);
+/**
+ * The parameters of a machine endpoint, read from the body and nowhere else.
+ *
+ * Every one of these requests carries a credential — a client secret, a code,
+ * a refresh or access token. RFC 6749 §2.3.1 says client credentials "MUST NOT
+ * be included in the request URI", and §3.2, RFC 7009 §2.1, RFC 7662 §2.1 and
+ * RFC 7591 §3.1 all define the parameters as a POST body. A URL is kept by
+ * access logs, proxies and traces where a body is not.
+ *
+ * So the query string is never read, and a request that puts an OAuth
+ * parameter there is refused rather than answered: accepting it would teach a
+ * client that the URL works, and the secret it carries is already in a log.
+ * Anything else in the query (a tracing or cache-busting parameter a proxy
+ * added) is ignored, not refused.
+ */
+function readBody(ctx, forbidden = OAUTH_PARAMETERS) {
+    const inUrl = Object.keys(ctx.request.qs()).filter((key) => forbidden.has(key));
+    if (inUrl.length > 0) {
+        throw new OAuthError("invalid_request", `OAuth parameters go in the request body, never in the URL: ${inUrl.join(", ")}.`);
+    }
+    const body = ctx.request.body();
+    if (body === undefined || body === null)
+        return {};
+    if (!isRecord(body)) {
+        throw new OAuthError("invalid_request", "The request body must be a form or a JSON object.");
+    }
+    return body;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 /** The initial access token a registration may carry (RFC 7591 §3). */
 function readBearer(ctx) {
     const header = ctx.request.header("authorization");
     if (header === undefined)
         return undefined;
     const [scheme, value] = header.split(" ");
-    if (scheme?.toLowerCase() !== "bearer" || value === undefined)
+    // An empty value is no token at all, not a token that is the empty string.
+    if (scheme?.toLowerCase() !== "bearer" || value === undefined || value === "")
         return undefined;
     return value;
 }