@crvouga/mockingbird-service-oauth 1.2.1 → 1.3.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog — @crvouga/mockingbird-service-oauth
 
+## 1.3.0 (2026-09-29)
+
+### Features
+
+- admin read of an account's grant with a client ([90b0279](https://github.com/crvouga/mockingbird/commit/90b0279f53cb4959b18c8992ae64bb00b5de4f96))
+
 ## 1.2.1 (2026-09-29)
 
 ### Fixes and improvements

package/README.md

@@ -198,6 +198,8 @@ curl -X PUT http://localhost:8810/__admin/behavior -H 'content-type: application
 curl http://localhost:8810/__admin/behavior
 curl -X POST http://localhost:8810/__admin/consents/revoke -H 'content-type: application/json' \
   -d '{"clientId":"app","accountId":"ada"}'
+curl 'http://localhost:8810/__admin/grants?clientId=app&accountId=ada'
+curl 'http://localhost:8810/__admin/grants?clientId=app'
 curl -X POST http://localhost:8810/__admin/accounts/delete -H 'content-type: application/json' \
   -d '{"accountId":"ada"}'
 curl -X POST http://localhost:8810/__admin/relay-forwarding -H 'content-type: application/json' \
@@ -206,6 +208,8 @@ curl -X POST http://localhost:8810/__admin/keys/rotate -H 'content-type: applica
   -d '{"retainPrevious":true}'
 ```
 
+`GET /__admin/grants?clientId=<id>&accountId=<id>` (or `&email=<address>`) reads what that client sees for the account, without running a sign-in: `{ subject, granted, scopes, emailChoice, email, isPrivateEmail, userDisclosed }`. `subject` is the id token `sub` the client gets, or would get on a first authorization (it survives a consent revocation). `granted` says whether a consent exists, so whether the consent card is shown next time. `scopes` are the granted scopes, including Google `include_granted_scopes` merges. `emailChoice` is Apple's `"share"` or `"hide"`, and `null` before the first authorization, after a revocation, and on every other profile. `email` is the address the client receives: the relay for Hide My Email, the real address otherwise. `userDisclosed` is whether Apple's first-use `user` payload was already sent. Without `accountId` or `email` it returns `{ "grants": [...] }`, one row (with `accountId`) per account that currently has a grant with the client. An unknown client or account is `404`. Programmatically, `await runtime.instance().grant(clientId, accountId)` returns the same view, or `null`, and `grants(clientId)` the list. The view is read-only and follows namespaces.
+
 These routes use the shared admin-key and namespace controls. `revokeConsent(clientId, accountId)` removes that client's grants and resets first-use disclosure; it does not disable the account. It is async because it can deliver a [server-to-server notification](#sign-in-with-apple-server-to-server-notifications). `rotateSigningKey(true)` retains up to four previous public keys so existing tokens still verify; `false` withdraws them to test stale JWKS caches. Keys themselves are not included in snapshots, so restoring state does not undo a key rotation.
 
 ### Sign in with Apple server-to-server notifications
@@ -230,14 +234,14 @@ The runtime supplies `/health`, `/__admin/reset`, snapshots, mock clock, request
 
 - `createRuntime(options?)`: shared service runtime; `fetch`, `instance`, `reset`, `snapshot`, `restore`, clock, faults and journals.
 - `createMultiRuntime({ mounts })`: exact-path dispatcher for isolated provider runtimes on one origin, with aggregate health and admin controls.
-- `OAuthAPI`: standalone portable handler with `fetch`, `reset`, `seedAccount`, `registerClient`, `accounts`, `clients`, `provider`, `configureBehavior`, `behavior`, `revokeConsent`, `rotateSigningKey`.
+- `OAuthAPI`: standalone portable handler with `fetch`, `reset`, `seedAccount`, `registerClient`, `accounts`, `clients`, `provider`, `configureBehavior`, `behavior`, `revokeConsent`, `rotateSigningKey`, `grant`, `grants`.
 - `OAUTH_PRESETS`: named transport fault presets.
 - `OAUTH_SCENARIOS`: named provider-behavior scenarios.
 - `document`, `operationIds`, `supportedOperationIds`: generated OpenAPI metadata.
 - `createServer(options?)` from `./server`: Node HTTP adapter, returning `url`, `close` and `runtime`.
 - `createMultiServer({ mounts })` from `./server`: Node HTTP adapter for a multi-provider runtime.
 - `DEFAULT_PORT`, `serveTarget` from `./server`: CLI defaults and multi-service launcher integration.
-- Types: `Account`, `Client`, `Provider`, `OAuthAPIOptions`, `OAuthRuntimeOptions`, `OAuthRuntime`, `OAuthServerOptions`, `OAuthMount`, `OAuthMultiRuntimeOptions`, `OAuthMultiRuntime`, `OAuthMultiServerOptions`, `OAuthBehavior`, `BehaviorInput`, `OAuthScenario`, `EdgeCase`, `BehaviorEvent`.
+- Types: `Account`, `Client`, `GrantView`, `Provider`, `OAuthAPIOptions`, `OAuthRuntimeOptions`, `OAuthRuntime`, `OAuthServerOptions`, `OAuthMount`, `OAuthMultiRuntimeOptions`, `OAuthMultiRuntime`, `OAuthMultiServerOptions`, `OAuthBehavior`, `BehaviorInput`, `OAuthScenario`, `EdgeCase`, `BehaviorEvent`.
 
 ## Verification
 

package/dist/{chunk-2JIADQOV.js → chunk-MKBPAVYU.js}

@@ -2,7 +2,7 @@ import {
   OAUTH_SCENARIOS,
   createMultiRuntime,
   createRuntime
-} from "./chunk-XP2AEPEJ.js";
+} from "./chunk-WHI7Y2UA.js";
 
 // src/server.ts
 import { readFile as readFile2 } from "node:fs/promises";
@@ -377,4 +377,4 @@ export {
   createMultiServer,
   serveTarget
 };
-//# sourceMappingURL=chunk-2JIADQOV.js.map
+//# sourceMappingURL=chunk-MKBPAVYU.js.map

package/dist/{chunk-XP2AEPEJ.js → chunk-WHI7Y2UA.js}

@@ -1384,7 +1384,7 @@ var restoreNamespace = (sqlite, namespace, snapshot) => {
 };
 
 // ../core/dist/version.js
-var PACKAGE_VERSION = true ? "1.2.1" : UNRELEASED_VERSION;
+var PACKAGE_VERSION = true ? "1.3.0" : UNRELEASED_VERSION;
 
 // ../core/dist/webhooks.js
 var json2 = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
@@ -2472,6 +2472,24 @@ function createRuntime2(options = {}) {
         );
         return Response.json({ forwarding: input.forwarding, notifications });
       },
+      "GET /grants": async ({ namespace, url }) => {
+        const api = runtime.instance(namespace);
+        const clientId = url.searchParams.get("clientId");
+        const accountId = url.searchParams.get("accountId");
+        const email = url.searchParams.get("email")?.toLowerCase().trim();
+        if (!clientId || accountId !== null && email !== void 0)
+          return Response.json(
+            { error: "clientId is required, with at most one of accountId or email" },
+            { status: 400 }
+          );
+        if (accountId === null && email === void 0) {
+          const grants = await api.grants(clientId);
+          return grants ? Response.json({ grants }) : Response.json({ error: "Unknown client" }, { status: 404 });
+        }
+        const id = accountId ?? api.accounts.list({ where: (a) => a.email.toLowerCase() === email })[0]?.value.id ?? "";
+        const grant = await api.grant(clientId, id);
+        return grant ? Response.json(grant) : Response.json({ error: "Unknown client or account" }, { status: 404 });
+      },
       "POST /keys/rotate": ({ namespace, body }) => {
         const input = body;
         if (input?.retainPrevious !== void 0 && typeof input.retainPrevious !== "boolean")
@@ -2857,6 +2875,39 @@ var OAuthAPI = class {
     }))
       this.tokens.delete(row.id);
   }
+  /**
+   * What `clientId` sees for `accountId` (a test control mirroring private provider state), or
+   * `null` for an unknown client or account. For a client that never authorized the account,
+   * `subject` is the id token `sub` it would receive and `email` the real address.
+   */
+  async grant(clientId, accountId) {
+    const client = this.clients.get(clientId);
+    const account = this.accounts.get(accountId);
+    if (!client || !account) return null;
+    const key = this.identityKey(client, account.id);
+    const identity = this.identities.get(key);
+    const consent = this.consents.get(JSON.stringify([clientId, accountId]));
+    return {
+      subject: identity?.sub ?? (this.provider === "apple" || this.provider === "microsoft" ? await hash(key) : account.id),
+      granted: consent !== void 0,
+      scopes: [...scopes(consent?.scope ?? "")],
+      emailChoice: this.provider === "apple" && identity ? identity.privateEmail ? "hide" : "share" : null,
+      email: identity?.email ?? account.email,
+      isPrivateEmail: identity?.privateEmail ?? false,
+      userDisclosed: this.appleDisclosures.has(key)
+    };
+  }
+  /** The grant view of every account that has authorized `clientId`, oldest account first. */
+  async grants(clientId) {
+    if (!this.clients.has(clientId)) return null;
+    const rows = [];
+    for (const { id, value } of this.accounts.list({ order: "oldest" })) {
+      if (!this.consents.has(JSON.stringify([clientId, id]))) continue;
+      const view = await this.grant(clientId, value.id);
+      if (view) rows.push({ accountId: value.id, ...view });
+    }
+    return rows;
+  }
   paths() {
     const paths = {
       google: {
@@ -3735,4 +3786,4 @@ export {
   createMultiRuntime,
   OAuthAPI
 };
-//# sourceMappingURL=chunk-XP2AEPEJ.js.map
+//# sourceMappingURL=chunk-WHI7Y2UA.js.map