@crowi/api 2.0.0-alpha.0

package/dist/models/oauth-client.d.ts

@@ -0,0 +1,36 @@
+import { Document, Model, Types } from 'mongoose';
+import Crowi from '../crowi';
+/**
+ * RFC-0010 §Mongoose models — OAuth 2.0 client registration.
+ *
+ * v1 ships a single first-party `crowi-cli` client (seeded idempotently at
+ * boot, see `util/oauth-client-seed.ts`). The model is shaped from the
+ * start to admit operator-registered apps later (confidential clients with
+ * a `secretHash`, arbitrary `redirectUris`), but no registration UI exists
+ * in v1 — `crowi-cli` is the only row.
+ *
+ * `crowi-cli` is a **public** client: it has no secret (`secretHash: null`)
+ * and authenticates purely via PKCE (RFC-0010 §Security). `redirectUris`
+ * for it list the loopback hosts; the actual port is matched at request
+ * time by `util/oauth-redirect-uri.ts` (loopback host match, any port).
+ */
+export type OAuthClientType = 'public' | 'confidential';
+export interface OAuthClientDocument extends Document {
+    _id: Types.ObjectId;
+    clientId: string;
+    name: string;
+    type: OAuthClientType;
+    /** Confidential clients only; `null` for public (PKCE) clients. */
+    secretHash: string | null;
+    redirectUris: string[];
+    allowedScopes: string[];
+    firstParty: boolean;
+    /** Reserved: even a trusted client still shows the consent screen in v1. */
+    trusted: boolean;
+    createdAt: Date;
+}
+export interface OAuthClientModel extends Model<OAuthClientDocument> {
+    findByClientId(clientId: string): Promise<OAuthClientDocument | null>;
+}
+declare const _default: (_crowi: Crowi) => OAuthClientModel;
+export default _default;

package/dist/models/oauth-client.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const mongoose_1 = require("mongoose");
+exports.default = (_crowi) => {
+    const schema = new mongoose_1.Schema({
+        clientId: {
+            type: String,
+            required: true,
+            unique: true,
+            index: true,
+        },
+        name: {
+            type: String,
+            required: true,
+        },
+        type: {
+            type: String,
+            enum: ['public', 'confidential'],
+            required: true,
+        },
+        secretHash: {
+            type: String,
+            default: null,
+        },
+        redirectUris: {
+            type: [String],
+            required: true,
+            default: [],
+        },
+        allowedScopes: {
+            type: [String],
+            required: true,
+            default: [],
+        },
+        firstParty: {
+            type: Boolean,
+            required: true,
+            default: false,
+        },
+        trusted: {
+            type: Boolean,
+            required: true,
+            default: false,
+        },
+        createdAt: {
+            type: Date,
+            default: Date.now,
+        },
+    });
+    schema.statics.findByClientId = function (clientId) {
+        return OAuthClient.findOne({ clientId }).exec();
+    };
+    const OAuthClient = (0, mongoose_1.model)('OAuthClient', schema);
+    return OAuthClient;
+};
+//# sourceMappingURL=oauth-client.js.map

package/dist/models/oauth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.js","sourceRoot":"","sources":["../../src/models/oauth-client.ts"],"names":[],"mappings":";;AAAA,uCAAiE;AAuCjE,kBAAe,CAAC,MAAa,EAAE,EAAE;IAC/B,MAAM,MAAM,GAAG,IAAI,iBAAM,CAAwC;QAC/D,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,IAAI;SACZ;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;SACf;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC;YAChC,QAAQ,EAAE,IAAI;SACf;QACD,UAAU,EAAE;YACV,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,IAAI;SACd;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,EAAE;SACZ;QACD,aAAa,EAAE;YACb,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,EAAE;SACZ;QACD,UAAU,EAAE;YACV,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,KAAK;SACf;QACD,OAAO,EAAE;YACP,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,KAAK;SACf;QACD,SAAS,EAAE;YACT,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI,CAAC,GAAG;SAClB;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,cAAc,GAAG,UAAU,QAAgB;QACxD,OAAO,WAAW,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,IAAA,gBAAK,EAAwC,aAAa,EAAE,MAAM,CAAC,CAAC;IAExF,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC"}

package/dist/models/oauth-device-code.d.ts

@@ -0,0 +1,55 @@
+import { Document, Model, Types } from 'mongoose';
+import Crowi from '../crowi';
+export type OAuthDeviceCodeStatus = 'pending' | 'approved' | 'denied';
+export interface OAuthDeviceCodeDocument extends Document {
+    _id: Types.ObjectId;
+    deviceCodeHash: string;
+    userCode: string;
+    clientId: string;
+    requestedScopes: string[];
+    grantedScopes: string[];
+    status: OAuthDeviceCodeStatus;
+    userId: Types.ObjectId | null;
+    expiresAt: Date;
+    interval: number;
+    lastPolledAt: Date | null;
+    consumedAt: Date | null;
+    createdAt: Date;
+}
+export interface OAuthDeviceCodeModel extends Model<OAuthDeviceCodeDocument> {
+    /** SHA-256-hex of an opaque device code (the form stored in `deviceCodeHash`). */
+    hashDeviceCode(deviceCode: string): string;
+    /** Generate a fresh opaque device-code plaintext + its SHA-256 hash. */
+    generateDeviceCode(): {
+        deviceCode: string;
+        deviceCodeHash: string;
+    };
+    /**
+     * Create a pending device code, retrying `generateUserCode()` on a
+     * `userCode` collision (unique index). Returns the saved document plus the
+     * one-time plaintext `deviceCode`.
+     */
+    createPending(input: {
+        clientId: string;
+        requestedScopes: string[];
+        expiresAt: Date;
+        interval: number;
+    }): Promise<{
+        doc: OAuthDeviceCodeDocument;
+        deviceCode: string;
+    }>;
+    /** A usable (unconsumed, unexpired) device code by hash, or null. */
+    findByDeviceCodeHash(deviceCodeHash: string): Promise<OAuthDeviceCodeDocument | null>;
+    /** An unexpired device code by its human `user_code`, or null. */
+    findByUserCode(userCode: string): Promise<OAuthDeviceCodeDocument | null>;
+    /** Lightweight `lastPolledAt` bump on the poll path (failures swallowed). */
+    touchPolled(deviceCodeHash: string): Promise<void>;
+    /**
+     * Atomically mark an approved, unconsumed, unexpired code consumed and
+     * return it, or null otherwise. Prevents a device code from minting tokens
+     * twice even under concurrent polls.
+     */
+    consume(deviceCodeHash: string): Promise<OAuthDeviceCodeDocument | null>;
+}
+declare const _default: (_crowi: Crowi) => OAuthDeviceCodeModel;
+export default _default;

package/dist/models/oauth-device-code.js

@@ -0,0 +1,158 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const mongoose_1 = require("mongoose");
+const user_code_1 = require("../util/user-code");
+/**
+ * RFC-0010 Phase 4 — OAuth 2.0 Device Authorization Grant device code
+ * (RFC 8628).
+ *
+ * Issued by `POST /oauth/device/authorize` for a headless client, approved
+ * (or denied) by the user at `POST /oauth/device/verify` on a second device,
+ * and polled at `POST /oauth/token` (device_code grant). Storage mirrors the
+ * authorization-code model:
+ *
+ *  - Only the SHA-256 **hash** of the opaque `device_code` is stored; the
+ *    plaintext is returned once from `/oauth/device/authorize` and never
+ *    persisted. `user_code` is the human-typed handle and *is* stored
+ *    verbatim (it is short, single-use, and only meaningful while the row
+ *    lives), guarded by a unique index.
+ *  - A TTL index on `expiresAt` sweeps stale rows (~10min lifetime); the
+ *    query side (`findByDeviceCodeHash` / `findByUserCode`) also filters
+ *    `expiresAt > now` because the TTL monitor lags by up to a minute.
+ *  - `consume` flips `consumedAt` atomically so two concurrent token polls of
+ *    an approved code cannot both mint tokens.
+ */
+const DEVICE_CODE_RANDOM_BYTES = 32;
+/** Retries on a `userCode` unique-index collision before giving up. */
+const USER_CODE_MAX_ATTEMPTS = 5;
+exports.default = (_crowi) => {
+    const schema = new mongoose_1.Schema({
+        deviceCodeHash: {
+            type: String,
+            required: true,
+            unique: true,
+            index: true,
+        },
+        userCode: {
+            type: String,
+            required: true,
+            unique: true,
+            index: true,
+        },
+        clientId: {
+            type: String,
+            required: true,
+            index: true,
+        },
+        requestedScopes: {
+            type: [String],
+            required: true,
+            default: [],
+        },
+        grantedScopes: {
+            type: [String],
+            required: true,
+            default: [],
+        },
+        status: {
+            type: String,
+            enum: ['pending', 'approved', 'denied'],
+            required: true,
+            default: 'pending',
+        },
+        userId: {
+            type: mongoose_1.Schema.Types.ObjectId,
+            ref: 'User',
+            default: null,
+        },
+        expiresAt: {
+            type: Date,
+            required: true,
+        },
+        interval: {
+            type: Number,
+            required: true,
+            default: 5,
+        },
+        lastPolledAt: {
+            type: Date,
+            default: null,
+        },
+        consumedAt: {
+            type: Date,
+            default: null,
+        },
+        createdAt: {
+            type: Date,
+            default: Date.now,
+        },
+    });
+    // TTL — MongoDB removes rows once `expiresAt` is past. The sweep can lag the
+    // ~10min lifetime by up to a minute, so the lookups re-check `expiresAt`.
+    schema.index({ expiresAt: 1 }, { expireAfterSeconds: 0, name: 'oauthDeviceCode_ttl' });
+    schema.statics.hashDeviceCode = function (deviceCode) {
+        return node_crypto_1.default.createHash('sha256').update(deviceCode).digest('hex');
+    };
+    schema.statics.generateDeviceCode = function () {
+        const deviceCode = node_crypto_1.default.randomBytes(DEVICE_CODE_RANDOM_BYTES).toString('base64url');
+        return { deviceCode, deviceCodeHash: OAuthDeviceCode.hashDeviceCode(deviceCode) };
+    };
+    schema.statics.createPending = async function (input) {
+        const { deviceCode, deviceCodeHash } = OAuthDeviceCode.generateDeviceCode();
+        let lastErr;
+        for (let attempt = 0; attempt < USER_CODE_MAX_ATTEMPTS; attempt += 1) {
+            try {
+                const doc = await OAuthDeviceCode.create({
+                    deviceCodeHash,
+                    userCode: (0, user_code_1.generateUserCode)(),
+                    clientId: input.clientId,
+                    requestedScopes: input.requestedScopes,
+                    status: 'pending',
+                    expiresAt: input.expiresAt,
+                    interval: input.interval,
+                });
+                return { doc, deviceCode };
+            }
+            catch (err) {
+                // Retry only on a duplicate `userCode`; rethrow anything else.
+                if (err != null && typeof err === 'object' && 'code' in err && err.code === 11000) {
+                    lastErr = err;
+                    continue;
+                }
+                throw err;
+            }
+        }
+        throw lastErr ?? new Error('Failed to allocate a unique user_code');
+    };
+    schema.statics.findByDeviceCodeHash = function (deviceCodeHash) {
+        return OAuthDeviceCode.findOne({
+            deviceCodeHash,
+            consumedAt: null,
+            expiresAt: { $gt: new Date() },
+        }).exec();
+    };
+    schema.statics.findByUserCode = function (userCode) {
+        return OAuthDeviceCode.findOne({
+            userCode,
+            expiresAt: { $gt: new Date() },
+        }).exec();
+    };
+    schema.statics.touchPolled = async function (deviceCodeHash) {
+        try {
+            await OAuthDeviceCode.updateOne({ deviceCodeHash }, { lastPolledAt: new Date() }).exec();
+        }
+        catch {
+            // Best-effort: a failed poll-timestamp bump must not block the poll.
+        }
+    };
+    schema.statics.consume = function (deviceCodeHash) {
+        return OAuthDeviceCode.findOneAndUpdate({ deviceCodeHash, status: 'approved', consumedAt: null, expiresAt: { $gt: new Date() } }, { consumedAt: new Date() }, { new: true }).exec();
+    };
+    const OAuthDeviceCode = (0, mongoose_1.model)('OAuthDeviceCode', schema);
+    return OAuthDeviceCode;
+};
+//# sourceMappingURL=oauth-device-code.js.map

package/dist/models/oauth-device-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-device-code.js","sourceRoot":"","sources":["../../src/models/oauth-device-code.ts"],"names":[],"mappings":";;;;;AAAA,8DAAiC;AAEjC,uCAAiE;AAGjE,kDAAsD;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,uEAAuE;AACvE,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAkDjC,kBAAe,CAAC,MAAa,EAAE,EAAE;IAC/B,MAAM,MAAM,GAAG,IAAI,iBAAM,CAAgD;QACvE,cAAc,EAAE;YACd,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,IAAI;SACZ;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,IAAI;SACZ;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,IAAI;SACZ;QACD,eAAe,EAAE;YACf,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,EAAE;SACZ;QACD,aAAa,EAAE;YACb,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,EAAE;SACZ;QACD,MAAM,EAAE;YACN,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC;YACvC,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,SAAS;SACnB;QACD,MAAM,EAAE;YACN,IAAI,EAAE,iBAAM,CAAC,KAAK,CAAC,QAAQ;YAC3B,GAAG,EAAE,MAAM;YACX,OAAO,EAAE,IAAI;SACd;QACD,SAAS,EAAE;YACT,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,IAAI;SACf;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,CAAC;SACX;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;SACd;QACD,UAAU,EAAE;YACV,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;SACd;QACD,SAAS,EAAE;YACT,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI,CAAC,GAAG;SAClB;KACF,CAAC,CAAC;IAEH,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAEvF,MAAM,CAAC,OAAO,CAAC,cAAc,GAAG,UAAU,UAAkB;QAC1D,OAAO,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,kBAAkB,GAAG;QAClC,MAAM,UAAU,GAAG,qBAAM,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IACpF,CAAC,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,aAAa,GAAG,KAAK,WAAW,KAK9C;QACC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,eAAe,CAAC,kBAAkB,EAAE,CAAC;QAC5E,IAAI,OAAgB,CAAC;QACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,sBAAsB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC;oBACvC,cAAc;oBACd,QAAQ,EAAE,IAAA,4BAAgB,GAAE;oBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,eAAe,EAAE,KAAK,CAAC,eAAe;oBACtC,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;gBACH,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,+DAA+D;gBAC/D,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAK,GAAyB,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBACzG,OAAO,GAAG,GAAG,CAAC;oBACd,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,MAAM,OAAO,IAAI,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,oBAAoB,GAAG,UAAU,cAAsB;QACpE,OAAO,eAAe,CAAC,OAAO,CAAC;YAC7B,cAAc;YACd,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;SAC/B,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,cAAc,GAAG,UAAU,QAAgB;QACxD,OAAO,eAAe,CAAC,OAAO,CAAC;YAC7B,QAAQ;YACR,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;SAC/B,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,WAAW,GAAG,KAAK,WAAW,cAAsB;QACjE,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3F,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,UAAU,cAAsB;QACvD,OAAO,eAAe,CAAC,gBAAgB,CACrC,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,EACxF,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,EAC1B,EAAE,GAAG,EAAE,IAAI,EAAE,CACd,CAAC,IAAI,EAAE,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,IAAA,gBAAK,EAAgD,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAExG,OAAO,eAAe,CAAC;AACzB,CAAC,CAAC"}

package/dist/models/oauth-refresh-token.d.ts

@@ -0,0 +1,31 @@
+import { Document, Model, Types } from 'mongoose';
+import Crowi from '../crowi';
+export interface OAuthRefreshTokenDocument extends Document {
+    _id: Types.ObjectId;
+    tokenHash: string;
+    clientId: string;
+    userId: Types.ObjectId;
+    scopes: string[];
+    expiresAt: Date;
+    createdAt: Date;
+    revokedAt: Date | null;
+    /** Successor token's hash once this one is rotated; null while active. */
+    rotatedTo: string | null;
+}
+export interface OAuthRefreshTokenModel extends Model<OAuthRefreshTokenDocument> {
+    generateToken(): {
+        token: string;
+        tokenHash: string;
+    };
+    hashToken(token: string): string;
+    /** Active (= not revoked, not expired) token matching `tokenHash`, or null. */
+    findActiveByHash(tokenHash: string): Promise<OAuthRefreshTokenDocument | null>;
+    /**
+     * Revoke the entire rotation chain a token belongs to (reuse detection).
+     * Walks descendants via `rotatedTo` and ancestors via the reverse link.
+     */
+    revokeChain(tokenHash: string): Promise<void>;
+    TOKEN_PREFIX: string;
+}
+declare const _default: (_crowi: Crowi) => OAuthRefreshTokenModel;
+export default _default;

package/dist/models/oauth-refresh-token.js

@@ -0,0 +1,118 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const mongoose_1 = require("mongoose");
+/**
+ * RFC-0010 §Mongoose models — OAuth 2.0 refresh token with rotation +
+ * reuse detection.
+ *
+ * `POST /oauth/token` issues a refresh token alongside every access token.
+ * On each refresh the old token is **rotated**: it is revoked (`revokedAt`
+ * set) and its `rotatedTo` is stamped with the successor's hash, then a
+ * fresh token is issued. This makes refresh tokens single-use.
+ *
+ * Reuse detection (RFC-0010 §Security, PHASE3-Q5): if a *revoked* refresh
+ * token is presented again — the hallmark of a stolen-token replay — the
+ * whole rotation chain is revoked via `revokeChain`, walking both backward
+ * (ancestors) via `findOne({ rotatedTo })` and forward (descendants) via
+ * `rotatedTo`. Both the attacker's and the legitimate client's tokens die,
+ * forcing a fresh authorization.
+ *
+ * Only the SHA-256 hash of the opaque `crowi_rt_…` secret is stored; the
+ * `crowi_rt_` prefix lets `POST /oauth/revoke` tell a refresh token from a
+ * PAT (`crowi_pat_`) without a DB round-trip.
+ */
+const RT_PREFIX = 'crowi_rt_';
+const RT_RANDOM_BYTES = 32;
+exports.default = (_crowi) => {
+    const schema = new mongoose_1.Schema({
+        tokenHash: {
+            type: String,
+            required: true,
+            unique: true,
+            index: true,
+        },
+        clientId: {
+            type: String,
+            required: true,
+            index: true,
+        },
+        userId: {
+            type: mongoose_1.Schema.Types.ObjectId,
+            ref: 'User',
+            required: true,
+            index: true,
+        },
+        scopes: {
+            type: [String],
+            required: true,
+            default: [],
+        },
+        expiresAt: {
+            type: Date,
+            required: true,
+        },
+        createdAt: {
+            type: Date,
+            default: Date.now,
+        },
+        revokedAt: {
+            type: Date,
+            default: null,
+        },
+        rotatedTo: {
+            type: String,
+            default: null,
+        },
+    });
+    // TTL on `expiresAt` — sweeps long-dead tokens. Active lookups filter
+    // `expiresAt > now` so the sweep lag never lets an expired token through.
+    schema.index({ expiresAt: 1 }, { expireAfterSeconds: 0, name: 'oauthRefreshToken_ttl' });
+    schema.statics.hashToken = function (token) {
+        return node_crypto_1.default.createHash('sha256').update(token).digest('hex');
+    };
+    schema.statics.generateToken = function () {
+        const token = `${RT_PREFIX}${node_crypto_1.default.randomBytes(RT_RANDOM_BYTES).toString('base64url')}`;
+        return { token, tokenHash: OAuthRefreshToken.hashToken(token) };
+    };
+    schema.statics.findActiveByHash = function (tokenHash) {
+        return OAuthRefreshToken.findOne({
+            tokenHash,
+            revokedAt: null,
+            expiresAt: { $gt: new Date() },
+        }).exec();
+    };
+    schema.statics.revokeChain = async function (tokenHash) {
+        const now = new Date();
+        const seen = new Set();
+        // Forward + backward frontier of hashes to revoke.
+        const queue = [tokenHash];
+        while (queue.length > 0) {
+            const hash = queue.shift();
+            if (hash == null || seen.has(hash))
+                continue;
+            seen.add(hash);
+            const node = await OAuthRefreshToken.findOne({ tokenHash: hash }).exec();
+            if (!node)
+                continue;
+            // Descendant (the token this one rotated to).
+            if (node.rotatedTo && !seen.has(node.rotatedTo)) {
+                queue.push(node.rotatedTo);
+            }
+            // Ancestor(s) — whoever rotated *into* this hash.
+            const ancestors = await OAuthRefreshToken.find({ rotatedTo: hash }).exec();
+            for (const anc of ancestors) {
+                if (!seen.has(anc.tokenHash))
+                    queue.push(anc.tokenHash);
+            }
+        }
+        await OAuthRefreshToken.updateMany({ tokenHash: { $in: [...seen] }, revokedAt: null }, { revokedAt: now });
+    };
+    const OAuthRefreshToken = (0, mongoose_1.model)('OAuthRefreshToken', schema);
+    OAuthRefreshToken.TOKEN_PREFIX = RT_PREFIX;
+    return OAuthRefreshToken;
+};
+//# sourceMappingURL=oauth-refresh-token.js.map

package/dist/models/oauth-refresh-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-refresh-token.js","sourceRoot":"","sources":["../../src/models/oauth-refresh-token.ts"],"names":[],"mappings":";;;;;AAAA,8DAAiC;AAEjC,uCAAiE;AAIjE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,SAAS,GAAG,WAAW,CAAC;AAC9B,MAAM,eAAe,GAAG,EAAE,CAAC;AA6B3B,kBAAe,CAAC,MAAa,EAAE,EAAE;IAC/B,MAAM,MAAM,GAAG,IAAI,iBAAM,CAAoD;QAC3E,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,IAAI;SACZ;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,IAAI;SACZ;QACD,MAAM,EAAE;YACN,IAAI,EAAE,iBAAM,CAAC,KAAK,CAAC,QAAQ;YAC3B,GAAG,EAAE,MAAM;YACX,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,IAAI;SACZ;QACD,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,EAAE;SACZ;QACD,SAAS,EAAE;YACT,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,IAAI;SACf;QACD,SAAS,EAAE;YACT,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI,CAAC,GAAG;SAClB;QACD,SAAS,EAAE;YACT,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;SACd;QACD,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,IAAI;SACd;KACF,CAAC,CAAC;IAEH,sEAAsE;IACtE,0EAA0E;IAC1E,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAEzF,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,UAAU,KAAa;QAChD,OAAO,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,aAAa,GAAG;QAC7B,MAAM,KAAK,GAAG,GAAG,SAAS,GAAG,qBAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACzF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IAClE,CAAC,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,gBAAgB,GAAG,UAAU,SAAiB;QAC3D,OAAO,iBAAiB,CAAC,OAAO,CAAC;YAC/B,SAAS;YACT,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;SAC/B,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,WAAW,GAAG,KAAK,WAAW,SAAiB;QAC5D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,mDAAmD;QACnD,MAAM,KAAK,GAAa,CAAC,SAAS,CAAC,CAAC;QAEpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC7C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAEf,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACzE,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,8CAA8C;YAC9C,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;YACD,kDAAkD;YAClD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3E,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,MAAM,iBAAiB,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,IAAA,gBAAK,EAAoD,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAEhH,iBAAiB,CAAC,YAAY,GAAG,SAAS,CAAC;IAE3C,OAAO,iBAAiB,CAAC;AAC3B,CAAC,CAAC"}

package/dist/models/page-yjs-update.d.ts

@@ -0,0 +1,35 @@
+import type Crowi from '../crowi';
+import { type Document, type Model, type Types } from 'mongoose';
+/**
+ * Append-only log of high-frequency Yjs updates for a page.
+ *
+ * RFC-0003 Phase 4 will write one document per Yjs `onChange` event so
+ * Hocuspocus can recover edits made between the periodic checkpoints
+ * that compact into `Page.yjsState`. Compaction (Phase 4) batches the
+ * latest N documents per `pageId`, encodes them into `Page.yjsState`,
+ * then deletes the source rows. Anything left behind is swept by the
+ * TTL index after 1 hour — a safety net against crashed Hocuspocus
+ * instances that fail to checkpoint.
+ *
+ * Indexes:
+ *   1. compound `(pageId, createdAt)` — drives "load all updates for a
+ *      page newer than the last checkpoint" on Hocuspocus recovery.
+ *   2. `createdAt` TTL (`expireAfterSeconds: 3600`) — MongoDB sweeps
+ *      rows older than 1 hour. Compaction normally clears them sooner;
+ *      the TTL only kicks in for orphaned updates whose owning page
+ *      was deleted or whose Hocuspocus instance crashed before
+ *      checkpointing.
+ *
+ * Phase 1 only introduces the schema. The append + compaction paths
+ * land in Phase 4 once Hocuspocus is wired up.
+ */
+export interface PageYjsUpdateDocument extends Document {
+    _id: Types.ObjectId;
+    pageId: Types.ObjectId;
+    payload: Buffer;
+    createdAt: Date;
+}
+export interface PageYjsUpdateModel extends Model<PageYjsUpdateDocument> {
+}
+declare const _default: (_crowi: Crowi) => PageYjsUpdateModel;
+export default _default;

package/dist/models/page-yjs-update.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const mongoose_1 = require("mongoose");
+exports.default = (_crowi) => {
+    const PageYjsUpdateSchema = new mongoose_1.Schema({
+        pageId: { type: mongoose_1.Schema.Types.ObjectId, required: true, ref: 'Page' },
+        // Binary Yjs update payload (`Y.encodeStateAsUpdate` or the
+        // delta from `onChange`). Buffer (not Mixed) so the BSON driver
+        // round-trips a typed binary blob rather than a generic sub-doc.
+        // Named `payload` rather than `update` to avoid colliding with
+        // Mongoose's `Document.prototype.update()` method in TS typings.
+        // Subject to MongoDB's 16 MB BSON document cap — Yjs delta
+        // sizes are typically well below that, but Phase 4's append
+        // step should bail out if a single delta exceeds the limit.
+        payload: { type: Buffer, required: true },
+        createdAt: { type: Date, required: true, default: () => new Date() },
+    }, {
+        // `createdAt` is declared explicitly above so the TTL index has
+        // a stable anchor; Mongoose's automatic timestamps would also
+        // add `updatedAt` which is meaningless for an append-only log.
+        timestamps: false,
+    });
+    // (1) Compound `(pageId, createdAt)` — supports the Phase 4 read
+    // pattern "all updates for this page in chronological order since
+    // the last checkpoint".
+    PageYjsUpdateSchema.index({ pageId: 1, createdAt: 1 }, { name: 'pageYjsUpdate_pageId_createdAt' });
+    // (2) TTL — MongoDB removes rows older than 1 hour. Compaction in
+    // Phase 4 normally deletes rows before this fires; the TTL is a
+    // safety net for orphaned updates after a Hocuspocus crash.
+    PageYjsUpdateSchema.index({ createdAt: 1 }, { expireAfterSeconds: 3600, name: 'pageYjsUpdate_ttl' });
+    return (0, mongoose_1.model)('PageYjsUpdate', PageYjsUpdateSchema);
+};
+//# sourceMappingURL=page-yjs-update.js.map

package/dist/models/page-yjs-update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page-yjs-update.js","sourceRoot":"","sources":["../../src/models/page-yjs-update.ts"],"names":[],"mappings":";;AACA,uCAAgF;AAmChF,kBAAe,CAAC,MAAa,EAAE,EAAE;IAC/B,MAAM,mBAAmB,GAAG,IAAI,iBAAM,CACpC;QACE,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE;QACpE,4DAA4D;QAC5D,gEAAgE;QAChE,iEAAiE;QACjE,+DAA+D;QAC/D,iEAAiE;QACjE,2DAA2D;QAC3D,4DAA4D;QAC5D,4DAA4D;QAC5D,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE;KACrE,EACD;QACE,gEAAgE;QAChE,8DAA8D;QAC9D,+DAA+D;QAC/D,UAAU,EAAE,KAAK;KAClB,CACF,CAAC;IAEF,iEAAiE;IACjE,kEAAkE;IAClE,wBAAwB;IACxB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;IAEnG,kEAAkE;IAClE,gEAAgE;IAChE,4DAA4D;IAC5D,mBAAmB,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAErG,OAAO,IAAA,gBAAK,EAA4C,eAAe,EAAE,mBAAmB,CAAC,CAAC;AAChG,CAAC,CAAC"}