@crvouga/mockingbird-service-oauth 1.2.1 → 1.4.0

package/dist/cli.js

@@ -3,8 +3,8 @@ import {
   runCli,
   serveCommand,
   serveTarget
-} from "./chunk-2JIADQOV.js";
-import "./chunk-XP2AEPEJ.js";
+} from "./chunk-D4IAZYMT.js";
+import "./chunk-SYFF4UFD.js";
 
 // src/cli.ts
 var code = await runCli(

package/dist/index.d.ts

@@ -775,6 +775,29 @@ declare class BehaviorState {
     decisions(): Decisions;
 }
 
+/** A caller-supplied RS256 signing key pair. `kid` is published in the JWKS and token headers. */
+type SigningKey = {
+    privateJwk: JsonWebKey;
+    publicJwk: JsonWebKey;
+    kid: string;
+};
+/**
+ * Opt-in control over every opaque value the provider mints. With none of these set the provider
+ * uses cryptographic randomness, exactly as before.
+ */
+type CredentialOptions = {
+    /**
+     * Derive authorization codes, tokens, transaction ids, session ids, CSP nonces and signing keys
+     * from `seed` (default 0) instead of `crypto`, so the same seed and the same requests replay
+     * byte-for-byte. Test-only: the values are guessable.
+     */
+    deterministicCredentials?: boolean;
+    /** Replaces `crypto.getRandomValues` for every minted value, and wins over the seeded source. */
+    randomBytes?: (length: number) => Uint8Array;
+    /** Signing keys used in order: the first is current and each rotation takes the next. */
+    signingKeys?: SigningKey[];
+};
+
 type Provider = "google" | "apple" | "oidc" | "microsoft" | "github";
 type Account = {
     id: string;
@@ -839,6 +862,16 @@ type NotificationDelivery = {
     status?: number;
     error?: string;
 };
+/** What one client sees for one account: see `OAuthAPI.grant`. */
+type GrantView = {
+    subject: string;
+    granted: boolean;
+    scopes: string[];
+    emailChoice: "share" | "hide" | null;
+    email: string;
+    isPrivateEmail: boolean;
+    userDisclosed: boolean;
+};
 
 /**
  * The slice of OpenAPI 3.1 (and JSON Schema 2020-12) Mockingbird understands.
@@ -1043,7 +1076,7 @@ type OAuthMultiRuntime = {
 /** Compose independent provider runtimes behind exact path mounts on one listener. */
 declare function createMultiRuntime(options: OAuthMultiRuntimeOptions): OAuthMultiRuntime;
 
-type OAuthAPIOptions = APIOptions & {
+type OAuthAPIOptions = APIOptions & CredentialOptions & {
     /** Browser Fetch forbids Cookie/Set-Cookie; local transports may explicitly remap them. */
     cookieHeaders?: {
         request: string;
@@ -1058,7 +1091,7 @@ type OAuthAPIOptions = APIOptions & {
     accounts?: Account[];
     clients?: Client[];
     behavior?: BehaviorInput;
-    /** Replays behavior choices, never credentials. */
+    /** Replays behavior choices; also credentials when `deterministicCredentials` is set. */
     seed?: number | string;
     /** CSP nonce source for form-post responses. Defaults to `crypto.randomUUID`. */
     nonce?: () => string;
@@ -1078,9 +1111,10 @@ declare class OAuthAPI {
     private readonly sessions;
     private readonly consents;
     private signer;
+    private readonly credentials;
     private previousSigners;
     /** Never published: signs ID tokens for `tokens.idTokenSigningKey: "unpublished"`. */
-    private unpublishedSigner?;
+    private unpublishedSigner;
     readonly behavior: BehaviorState;
     private readonly identities;
     private readonly appleDisclosures;
@@ -1119,6 +1153,16 @@ declare class OAuthAPI {
     private notify;
     /** Drops one client's grant for an account: consent, identity, first-use disclosure, codes, tokens. */
     private forget;
+    /**
+     * What `clientId` sees for `accountId` (a test control mirroring private provider state), or
+     * `null` for an unknown client or account. For a client that never authorized the account,
+     * `subject` is the id token `sub` it would receive and `email` the real address.
+     */
+    grant(clientId: string, accountId: string): Promise<GrantView | null>;
+    /** The grant view of every account that has authorized `clientId`, oldest account first. */
+    grants(clientId: string): Promise<(GrantView & {
+        accountId: string;
+    })[] | null>;
     private paths;
     private supportedScopes;
     private identityKey;
@@ -1140,4 +1184,4 @@ declare class OAuthAPI {
 }
 
 export { OAUTH_PRESETS, OAUTH_SCENARIOS, OAuthAPI, createMultiRuntime, createRuntime, document, operationIds, supportedOperationIds };
-export type { Account, AppleNotificationType, BehaviorEvent, BehaviorInput, Client, EdgeCase, NotificationDelivery, OAuthAPIOptions, OAuthBehavior, OAuthMount, OAuthMultiRuntime, OAuthMultiRuntimeOptions, OAuthRuntime, OAuthRuntimeOptions, OAuthScenario, Provider };
+export type { Account, AppleNotificationType, BehaviorEvent, BehaviorInput, Client, CredentialOptions, EdgeCase, GrantView, NotificationDelivery, OAuthAPIOptions, OAuthBehavior, OAuthMount, OAuthMultiRuntime, OAuthMultiRuntimeOptions, OAuthRuntime, OAuthRuntimeOptions, OAuthScenario, Provider, SigningKey };

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   document,
   operationIds,
   supportedOperationIds
-} from "./chunk-XP2AEPEJ.js";
+} from "./chunk-SYFF4UFD.js";
 export {
   OAUTH_PRESETS,
   OAUTH_SCENARIOS,

package/dist/server.d.ts

@@ -1314,6 +1314,29 @@ declare class BehaviorState {
     decisions(): Decisions;
 }
 
+/** A caller-supplied RS256 signing key pair. `kid` is published in the JWKS and token headers. */
+type SigningKey = {
+    privateJwk: JsonWebKey;
+    publicJwk: JsonWebKey;
+    kid: string;
+};
+/**
+ * Opt-in control over every opaque value the provider mints. With none of these set the provider
+ * uses cryptographic randomness, exactly as before.
+ */
+type CredentialOptions = {
+    /**
+     * Derive authorization codes, tokens, transaction ids, session ids, CSP nonces and signing keys
+     * from `seed` (default 0) instead of `crypto`, so the same seed and the same requests replay
+     * byte-for-byte. Test-only: the values are guessable.
+     */
+    deterministicCredentials?: boolean;
+    /** Replaces `crypto.getRandomValues` for every minted value, and wins over the seeded source. */
+    randomBytes?: (length: number) => Uint8Array;
+    /** Signing keys used in order: the first is current and each rotation takes the next. */
+    signingKeys?: SigningKey[];
+};
+
 type Provider = "google" | "apple" | "oidc" | "microsoft" | "github";
 type Account = {
     id: string;
@@ -1378,8 +1401,18 @@ type NotificationDelivery = {
     status?: number;
     error?: string;
 };
+/** What one client sees for one account: see `OAuthAPI.grant`. */
+type GrantView = {
+    subject: string;
+    granted: boolean;
+    scopes: string[];
+    emailChoice: "share" | "hide" | null;
+    email: string;
+    isPrivateEmail: boolean;
+    userDisclosed: boolean;
+};
 
-type OAuthAPIOptions = APIOptions & {
+type OAuthAPIOptions = APIOptions & CredentialOptions & {
     /** Browser Fetch forbids Cookie/Set-Cookie; local transports may explicitly remap them. */
     cookieHeaders?: {
         request: string;
@@ -1394,7 +1427,7 @@ type OAuthAPIOptions = APIOptions & {
     accounts?: Account[];
     clients?: Client[];
     behavior?: BehaviorInput;
-    /** Replays behavior choices, never credentials. */
+    /** Replays behavior choices; also credentials when `deterministicCredentials` is set. */
     seed?: number | string;
     /** CSP nonce source for form-post responses. Defaults to `crypto.randomUUID`. */
     nonce?: () => string;
@@ -1414,9 +1447,10 @@ declare class OAuthAPI {
     private readonly sessions;
     private readonly consents;
     private signer;
+    private readonly credentials;
     private previousSigners;
     /** Never published: signs ID tokens for `tokens.idTokenSigningKey: "unpublished"`. */
-    private unpublishedSigner?;
+    private unpublishedSigner;
     readonly behavior: BehaviorState;
     private readonly identities;
     private readonly appleDisclosures;
@@ -1455,6 +1489,16 @@ declare class OAuthAPI {
     private notify;
     /** Drops one client's grant for an account: consent, identity, first-use disclosure, codes, tokens. */
     private forget;
+    /**
+     * What `clientId` sees for `accountId` (a test control mirroring private provider state), or
+     * `null` for an unknown client or account. For a client that never authorized the account,
+     * `subject` is the id token `sub` it would receive and `email` the real address.
+     */
+    grant(clientId: string, accountId: string): Promise<GrantView | null>;
+    /** The grant view of every account that has authorized `clientId`, oldest account first. */
+    grants(clientId: string): Promise<(GrantView & {
+        accountId: string;
+    })[] | null>;
     private paths;
     private supportedScopes;
     private identityKey;

package/dist/server.js

@@ -3,8 +3,8 @@ import {
   createMultiServer,
   createServer,
   serveTarget
-} from "./chunk-2JIADQOV.js";
-import "./chunk-XP2AEPEJ.js";
+} from "./chunk-D4IAZYMT.js";
+import "./chunk-SYFF4UFD.js";
 export {
   DEFAULT_PORT,
   createMultiServer,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crvouga/mockingbird-service-oauth",
-  "version": "1.2.1",
+  "version": "1.4.0",
   "description": "Portable social-login mock with Google, Apple, Microsoft, GitHub and generic OIDC profiles, private relay identities, reproducible edge cases, signed tokens and an accessible UI.",
   "license": "MIT",
   "type": "module",