@drawbridge/drawbridge-utils 0.0.49 → 0.0.51

package/dist/oauth/index.cjs

@@ -47,6 +47,7 @@ __export(oauth_exports, {
   scopeLabels: () => scopeLabels,
   scopeOptions: () => scopeOptions,
   scopes: () => scopes,
+  tokenFromHandshake: () => tokenFromHandshake,
   tokenTypes: () => tokenTypes,
   validate: () => validate
 });
@@ -84,9 +85,30 @@ var clients = {
   dashboard: "drawbridge-dashboard",
   share: "drawbridge-share"
 };
+var tokenFromHandshake = (socket) => {
+  var _a, _b, _c;
+  if ((_b = (_a = socket == null ? void 0 : socket.handshake) == null ? void 0 : _a.auth) == null ? void 0 : _b.token) {
+    return socket.handshake.auth.token;
+  }
+  const headers = ((_c = socket == null ? void 0 : socket.handshake) == null ? void 0 : _c.headers) || {};
+  const subprotocols = (headers["sec-websocket-protocol"] || "").split(",").map((value) => value.trim());
+  for (const subprotocol of subprotocols) {
+    if (subprotocol.startsWith("bearer.")) {
+      return subprotocol.slice("bearer.".length) || null;
+    }
+  }
+  if (!headers.cookie) return null;
+  const parsed = headers.cookie.split(";").reduce((accumulator, pair) => {
+    const index = pair.indexOf("=");
+    if (index < 0) return accumulator;
+    accumulator[pair.slice(0, index).trim()] = decodeURIComponent(pair.slice(index + 1).trim());
+    return accumulator;
+  }, {});
+  return parsed[cookies.session] || null;
+};
 var lifetimes = {
-  access: 60 * 60,
-  // 1 hour
+  access: 60 * 60 * 8,
+  // 8 hours
   authorizationCode: 10 * 60,
   // 10 minutes
   code: 15 * 60,
@@ -239,7 +261,7 @@ var createOAuthClient = ({
     const body = await response.json();
     cached = {
       accessToken: body.access_token,
-      expiresAt: Math.floor(Date.now() / 1e3) + Number(body.expires_in || 3600),
+      expiresAt: Math.floor(Date.now() / 1e3) + Number(body.expires_in || lifetimes.access),
       scope: body.scope
     };
     return cached.accessToken;
@@ -283,6 +305,7 @@ var createOAuthClient = ({
   scopeLabels,
   scopeOptions,
   scopes,
+  tokenFromHandshake,
   tokenTypes,
   validate
 });

package/dist/oauth/index.d.cts

@@ -32,10 +32,59 @@ const clients = {
 	share : 'drawbridge-share'
 };
 
+// Resolve the raw OAuth access token from a socket.io handshake. Precedence:
+//   1. handshake.auth.token — the browser client connects with
+//      io( uri, { auth : { token } } ); socket.io exposes it here.
+//   2. Sec-WebSocket-Protocol: bearer.<token> subprotocol.
+//   3. the drawbridge.session cookie on the upgrade request.
+// This is the OAuth handshake token-source contract; drawbridge-sync's WS auth
+// reads it so any future socket-authenticating service resolves it identically.
+const tokenFromHandshake = ( socket ) => {
+
+	if( socket?.handshake?.auth?.token ){
+
+		return socket.handshake.auth.token;
+
+	}
+
+	const headers = socket?.handshake?.headers || {};
+
+	const subprotocols = ( headers[ 'sec-websocket-protocol' ] || '' )
+		.split( ',' )
+		.map( ( value ) => value.trim() );
+
+	for( const subprotocol of subprotocols ){
+
+		if( subprotocol.startsWith( 'bearer.' ) ){
+
+			return subprotocol.slice( 'bearer.'.length ) || null;
+
+		}
+
+	}
+
+	if( ! headers.cookie ) return null;
+
+	const parsed = headers.cookie.split( ';' ).reduce( ( accumulator, pair ) => {
+
+		const index = pair.indexOf( '=' );
+
+		if( index < 0 ) return accumulator;
+
+		accumulator[ pair.slice( 0, index ).trim() ] = decodeURIComponent( pair.slice( index + 1 ).trim() );
+
+		return accumulator;
+
+	}, {} );
+
+	return parsed[ cookies.session ] || null;
+
+};
+
 // Token / authorization-code / OTC lifetimes in seconds (the OAuth spec's
 // unit for `expires_in`). Multiply by 1000 when feeding to JS Date math.
 const lifetimes = {
-	access : 60 * 60,               // 1 hour
+	access : 60 * 60 * 8,           // 8 hours
 	authorizationCode : 10 * 60,    // 10 minutes
 	code : 15 * 60,                 // 15 minutes (email OTC)
 	refresh : 30 * 24 * 60 * 60     // 30 days
@@ -304,7 +353,7 @@ const createOAuthClient = ({
 
 		cached = {
 			accessToken : body.access_token,
-			expiresAt : Math.floor( Date.now() / 1000 ) + Number( body.expires_in || 3600 ),
+			expiresAt : Math.floor( Date.now() / 1000 ) + Number( body.expires_in || lifetimes.access ),
 			scope : body.scope
 		};
 
@@ -346,4 +395,4 @@ const createOAuthClient = ({
 
 };
 
-export { clients, cookieOptions, cookies, createOAuthClient, developer, developerOptions, generateToken, hashToken, intersect, isDeveloperAllowed, lifetimes, menuEndpoint, otcContexts, parse, scopeLabels, scopeOptions, scopes, tokenTypes, validate };
+export { clients, cookieOptions, cookies, createOAuthClient, developer, developerOptions, generateToken, hashToken, intersect, isDeveloperAllowed, lifetimes, menuEndpoint, otcContexts, parse, scopeLabels, scopeOptions, scopes, tokenFromHandshake, tokenTypes, validate };

package/dist/oauth/index.d.ts

@@ -32,10 +32,59 @@ const clients = {
 	share : 'drawbridge-share'
 };
 
+// Resolve the raw OAuth access token from a socket.io handshake. Precedence:
+//   1. handshake.auth.token — the browser client connects with
+//      io( uri, { auth : { token } } ); socket.io exposes it here.
+//   2. Sec-WebSocket-Protocol: bearer.<token> subprotocol.
+//   3. the drawbridge.session cookie on the upgrade request.
+// This is the OAuth handshake token-source contract; drawbridge-sync's WS auth
+// reads it so any future socket-authenticating service resolves it identically.
+const tokenFromHandshake = ( socket ) => {
+
+	if( socket?.handshake?.auth?.token ){
+
+		return socket.handshake.auth.token;
+
+	}
+
+	const headers = socket?.handshake?.headers || {};
+
+	const subprotocols = ( headers[ 'sec-websocket-protocol' ] || '' )
+		.split( ',' )
+		.map( ( value ) => value.trim() );
+
+	for( const subprotocol of subprotocols ){
+
+		if( subprotocol.startsWith( 'bearer.' ) ){
+
+			return subprotocol.slice( 'bearer.'.length ) || null;
+
+		}
+
+	}
+
+	if( ! headers.cookie ) return null;
+
+	const parsed = headers.cookie.split( ';' ).reduce( ( accumulator, pair ) => {
+
+		const index = pair.indexOf( '=' );
+
+		if( index < 0 ) return accumulator;
+
+		accumulator[ pair.slice( 0, index ).trim() ] = decodeURIComponent( pair.slice( index + 1 ).trim() );
+
+		return accumulator;
+
+	}, {} );
+
+	return parsed[ cookies.session ] || null;
+
+};
+
 // Token / authorization-code / OTC lifetimes in seconds (the OAuth spec's
 // unit for `expires_in`). Multiply by 1000 when feeding to JS Date math.
 const lifetimes = {
-	access : 60 * 60,               // 1 hour
+	access : 60 * 60 * 8,           // 8 hours
 	authorizationCode : 10 * 60,    // 10 minutes
 	code : 15 * 60,                 // 15 minutes (email OTC)
 	refresh : 30 * 24 * 60 * 60     // 30 days
@@ -304,7 +353,7 @@ const createOAuthClient = ({
 
 		cached = {
 			accessToken : body.access_token,
-			expiresAt : Math.floor( Date.now() / 1000 ) + Number( body.expires_in || 3600 ),
+			expiresAt : Math.floor( Date.now() / 1000 ) + Number( body.expires_in || lifetimes.access ),
 			scope : body.scope
 		};
 
@@ -346,4 +395,4 @@ const createOAuthClient = ({
 
 };
 
-export { clients, cookieOptions, cookies, createOAuthClient, developer, developerOptions, generateToken, hashToken, intersect, isDeveloperAllowed, lifetimes, menuEndpoint, otcContexts, parse, scopeLabels, scopeOptions, scopes, tokenTypes, validate };
+export { clients, cookieOptions, cookies, createOAuthClient, developer, developerOptions, generateToken, hashToken, intersect, isDeveloperAllowed, lifetimes, menuEndpoint, otcContexts, parse, scopeLabels, scopeOptions, scopes, tokenFromHandshake, tokenTypes, validate };

package/dist/oauth/index.js

@@ -30,9 +30,30 @@ var clients = {
   dashboard: "drawbridge-dashboard",
   share: "drawbridge-share"
 };
+var tokenFromHandshake = (socket) => {
+  var _a, _b, _c;
+  if ((_b = (_a = socket == null ? void 0 : socket.handshake) == null ? void 0 : _a.auth) == null ? void 0 : _b.token) {
+    return socket.handshake.auth.token;
+  }
+  const headers = ((_c = socket == null ? void 0 : socket.handshake) == null ? void 0 : _c.headers) || {};
+  const subprotocols = (headers["sec-websocket-protocol"] || "").split(",").map((value) => value.trim());
+  for (const subprotocol of subprotocols) {
+    if (subprotocol.startsWith("bearer.")) {
+      return subprotocol.slice("bearer.".length) || null;
+    }
+  }
+  if (!headers.cookie) return null;
+  const parsed = headers.cookie.split(";").reduce((accumulator, pair) => {
+    const index = pair.indexOf("=");
+    if (index < 0) return accumulator;
+    accumulator[pair.slice(0, index).trim()] = decodeURIComponent(pair.slice(index + 1).trim());
+    return accumulator;
+  }, {});
+  return parsed[cookies.session] || null;
+};
 var lifetimes = {
-  access: 60 * 60,
-  // 1 hour
+  access: 60 * 60 * 8,
+  // 8 hours
   authorizationCode: 10 * 60,
   // 10 minutes
   code: 15 * 60,
@@ -185,7 +206,7 @@ var createOAuthClient = ({
     const body = await response.json();
     cached = {
       accessToken: body.access_token,
-      expiresAt: Math.floor(Date.now() / 1e3) + Number(body.expires_in || 3600),
+      expiresAt: Math.floor(Date.now() / 1e3) + Number(body.expires_in || lifetimes.access),
       scope: body.scope
     };
     return cached.accessToken;
@@ -228,6 +249,7 @@ export {
   scopeLabels,
   scopeOptions,
   scopes,
+  tokenFromHandshake,
   tokenTypes,
   validate
 };

package/dist/oauth/server.cjs

@@ -60,8 +60,8 @@ var compare = (a, b) => {
 
 // lib/oauth/index.js
 var lifetimes = {
-  access: 60 * 60,
-  // 1 hour
+  access: 60 * 60 * 8,
+  // 8 hours
   authorizationCode: 10 * 60,
   // 10 minutes
   code: 15 * 60,
@@ -146,19 +146,20 @@ var hashToken = (raw) => hash(raw, process.env.OAUTH_TOKEN_HMAC_KEY);
 var generateToken = () => generate(32, "base64url");
 
 // lib/oauth/server.js
+var SUPPORTED_GRANTS = ["authorization_code", "client_credentials", "refresh_token"];
 var createOAuthModel = ({ controller }) => ({
   getClient: async (clientId, clientSecret) => {
     var _a;
-    const client = await controller.get({
+    const record = await controller.get({
       collection: "oauth",
       query: {
-        clientId,
+        client: clientId,
         status: "active"
       }
     });
-    if (!client) return false;
+    if (!record) return false;
     if (clientSecret) {
-      const validSecret = (_a = client.clientSecretHashes) == null ? void 0 : _a.some((entry) => {
+      const validSecret = (_a = record.hashes) == null ? void 0 : _a.some((entry) => {
         if (entry.retiredAt) return false;
         return compare(hashToken(clientSecret), entry.hash);
       });
@@ -166,11 +167,11 @@ var createOAuthModel = ({ controller }) => ({
     }
     ;
     return {
-      clientId: client.clientId,
-      grants: ["authorization_code", "client_credentials", "refresh_token"],
-      id: client.id,
-      redirectUris: client.redirectUris ?? [],
-      scopes: client.allowedScopes ?? []
+      clientId: record.client,
+      grants: SUPPORTED_GRANTS,
+      id: record.id,
+      redirectUris: record.redirects ?? [],
+      scopes: record.scopes ?? []
     };
   },
   saveAuthorizationCode: async (code, client, user) => {
@@ -375,17 +376,16 @@ var createOAuthServer = ({ controller }) => new import_oauth2_server.default({
   }
 });
 var createClient = async ({
-  allowedScopes = [],
   controller,
   createdBy = null,
   description = null,
-  grantTypes = ["authorization_code"],
   name,
   organization = null,
-  redirectUris = [],
-  webOrigins = []
+  redirects = [],
+  scopes: scopes2 = [],
+  origins = []
 }) => {
-  const invalid = allowedScopes.filter((scope) => !developer.includes(scope));
+  const invalid = scopes2.filter((scope) => !developer.includes(scope));
   if (invalid.length > 0) {
     const error = new Error("Scopes not permitted for developer apps: " + invalid.join(", "));
     error.status = 400;
@@ -393,37 +393,38 @@ var createClient = async ({
   }
   ;
   const rawClientId = generateToken();
-  const clientId = "drawbridge." + rawClientId;
+  const client = "drawbridge." + rawClientId;
   const rawSecret = generateToken();
   const secretHash = hashToken(rawSecret);
   const now = /* @__PURE__ */ new Date();
-  const doc = await controller.insert({
+  const record = await controller.create({
     collection: "oauth",
     data: {
-      allowedScopes,
-      clientId,
-      clientSecretHashes: [
+      client,
+      createdBy,
+      description,
+      endpoint: {
+        auth: "client_secret_basic"
+      },
+      hashes: [
         {
           createdAt: now,
           hash: secretHash,
           retiredAt: null
         }
       ],
-      clientType: "confidential",
-      createdBy,
-      description,
-      grantTypes,
+      limits: null,
       name,
       organization,
-      rateLimitOverrides: null,
-      redirectUris,
+      origins,
+      redirects,
+      scopes: scopes2,
       status: "active",
-      tokenEndpointAuthMethod: "client_secret_basic",
-      webOrigins
+      type: "confidential"
     }
   });
   return {
-    client: doc,
+    record,
     rawSecret
   };
 };

package/dist/oauth/server.d.cts

@@ -14,34 +14,43 @@ import 'crypto';
 //       { collection, query, data } works. drawbridge-api passes its base
 //       controller; tests can pass an in-memory mock.
 //
+//       Boundary translation: the DB uses our renamed schema (client,
+//       scopes, redirects, hashes, ...), but the @node-oauth library
+//       expects spec-named keys (clientId, scope, redirectUris, ...).
+//       Each model method translates at the return boundary.
+//
 //   - createOAuthServer({ controller })
 //       Convenience: creates the model + wraps it in an OAuth2Server with
 //       the standard Drawbridge lifetimes (1h access / 30d refresh) and
 //       client-authentication requirements.
 //
-//   - createClient({ base, allowedScopes, name, organization, ... })
+//   - createClient({ controller, scopes, name, organization, ... })
 //       Inserts a new oauth client row. Validates scopes against the
 //       developer set; throws 400 on invalid. Returns
-//       { client, rawSecret } — secret is plaintext, return ONCE.
+//       { record, rawSecret } — secret is plaintext, return ONCE.
+
 
+// Hardcoded — the supported grants don't vary per client today. If they
+// ever need to, store `grants` on the oauth doc and read it here.
+const SUPPORTED_GRANTS = [ 'authorization_code', 'client_credentials', 'refresh_token' ];
 
 const createOAuthModel = ({ controller }) => ({
 
 	getClient : async ( clientId, clientSecret ) => {
 
-		const client = await controller.get({
+		const record = await controller.get({
 			collection : 'oauth',
 			query : {
-				clientId,
+				client : clientId,
 				status : 'active'
 			}
 		});
 
-		if( ! client ) return false;
+		if( ! record ) return false;
 
 		if( clientSecret ){
 
-			const validSecret = client.clientSecretHashes?.some( ( entry ) => {
+			const validSecret = record.hashes?.some( ( entry ) => {
 
 				if( entry.retiredAt ) return false;
 
@@ -53,11 +62,11 @@ const createOAuthModel = ({ controller }) => ({
 
 		}
 		return {
-			clientId : client.clientId,
-			grants : [ 'authorization_code', 'client_credentials', 'refresh_token' ],
-			id : client.id,
-			redirectUris : client.redirectUris ?? [],
-			scopes : client.allowedScopes ?? []
+			clientId : record.client,
+			grants : SUPPORTED_GRANTS,
+			id : record.id,
+			redirectUris : record.redirects ?? [],
+			scopes : record.scopes ?? []
 		};
 
 	},
@@ -312,23 +321,22 @@ const createOAuthServer = ({ controller }) => new OAuth2Server({
 	}
 });
 
-// Inserts a new oauth client row. Validates allowedScopes against the
+// Inserts a new oauth client row. Validates scopes against the
 // developer-allowed subset; throws a 400-flagged error on invalid scopes.
-// Returns { client: <inserted-doc>, rawSecret: <plaintext> }. The raw
+// Returns { record: <inserted-doc>, rawSecret: <plaintext> }. The raw
 // secret is only available here — store immediately.
 const createClient = async ({
-	allowedScopes = [],
 	controller,
 	createdBy = null,
 	description = null,
-	grantTypes = [ 'authorization_code' ],
 	name,
 	organization = null,
-	redirectUris = [],
-	webOrigins = []
+	redirects = [],
+	scopes = [],
+	origins = []
 }) => {
 
-	const invalid = allowedScopes.filter( ( scope ) => ! developer.includes( scope ) );
+	const invalid = scopes.filter( ( scope ) => ! developer.includes( scope ) );
 
 	if( invalid.length > 0 ){
 
@@ -340,41 +348,42 @@ const createClient = async ({
 
 	}
 	const rawClientId = generateToken();
-	const clientId = 'drawbridge.' + rawClientId;
+	const client = 'drawbridge.' + rawClientId;
 
 	const rawSecret = generateToken();
 	const secretHash = hashToken( rawSecret );
 
 	const now = new Date();
 
-	const doc = await controller.insert({
+	const record = await controller.create({
 		collection : 'oauth',
 		data : {
-			allowedScopes,
-			clientId,
-			clientSecretHashes : [
+			client,
+			createdBy,
+			description,
+			endpoint : {
+				auth : 'client_secret_basic'
+			},
+			hashes : [
 				{
 					createdAt : now,
 					hash : secretHash,
 					retiredAt : null
 				}
 			],
-			clientType : 'confidential',
-			createdBy,
-			description,
-			grantTypes,
+			limits : null,
 			name,
 			organization,
-			rateLimitOverrides : null,
-			redirectUris,
+			origins,
+			redirects,
+			scopes,
 			status : 'active',
-			tokenEndpointAuthMethod : 'client_secret_basic',
-			webOrigins
+			type : 'confidential'
 		}
 	});
 
 	return {
-		client : doc,
+		record,
 		rawSecret
 	};
 

package/dist/oauth/server.d.ts

@@ -14,34 +14,43 @@ import 'crypto';
 //       { collection, query, data } works. drawbridge-api passes its base
 //       controller; tests can pass an in-memory mock.
 //
+//       Boundary translation: the DB uses our renamed schema (client,
+//       scopes, redirects, hashes, ...), but the @node-oauth library
+//       expects spec-named keys (clientId, scope, redirectUris, ...).
+//       Each model method translates at the return boundary.
+//
 //   - createOAuthServer({ controller })
 //       Convenience: creates the model + wraps it in an OAuth2Server with
 //       the standard Drawbridge lifetimes (1h access / 30d refresh) and
 //       client-authentication requirements.
 //
-//   - createClient({ base, allowedScopes, name, organization, ... })
+//   - createClient({ controller, scopes, name, organization, ... })
 //       Inserts a new oauth client row. Validates scopes against the
 //       developer set; throws 400 on invalid. Returns
-//       { client, rawSecret } — secret is plaintext, return ONCE.
+//       { record, rawSecret } — secret is plaintext, return ONCE.
+
 
+// Hardcoded — the supported grants don't vary per client today. If they
+// ever need to, store `grants` on the oauth doc and read it here.
+const SUPPORTED_GRANTS = [ 'authorization_code', 'client_credentials', 'refresh_token' ];
 
 const createOAuthModel = ({ controller }) => ({
 
 	getClient : async ( clientId, clientSecret ) => {
 
-		const client = await controller.get({
+		const record = await controller.get({
 			collection : 'oauth',
 			query : {
-				clientId,
+				client : clientId,
 				status : 'active'
 			}
 		});
 
-		if( ! client ) return false;
+		if( ! record ) return false;
 
 		if( clientSecret ){
 
-			const validSecret = client.clientSecretHashes?.some( ( entry ) => {
+			const validSecret = record.hashes?.some( ( entry ) => {
 
 				if( entry.retiredAt ) return false;
 
@@ -53,11 +62,11 @@ const createOAuthModel = ({ controller }) => ({
 
 		}
 		return {
-			clientId : client.clientId,
-			grants : [ 'authorization_code', 'client_credentials', 'refresh_token' ],
-			id : client.id,
-			redirectUris : client.redirectUris ?? [],
-			scopes : client.allowedScopes ?? []
+			clientId : record.client,
+			grants : SUPPORTED_GRANTS,
+			id : record.id,
+			redirectUris : record.redirects ?? [],
+			scopes : record.scopes ?? []
 		};
 
 	},
@@ -312,23 +321,22 @@ const createOAuthServer = ({ controller }) => new OAuth2Server({
 	}
 });
 
-// Inserts a new oauth client row. Validates allowedScopes against the
+// Inserts a new oauth client row. Validates scopes against the
 // developer-allowed subset; throws a 400-flagged error on invalid scopes.
-// Returns { client: <inserted-doc>, rawSecret: <plaintext> }. The raw
+// Returns { record: <inserted-doc>, rawSecret: <plaintext> }. The raw
 // secret is only available here — store immediately.
 const createClient = async ({
-	allowedScopes = [],
 	controller,
 	createdBy = null,
 	description = null,
-	grantTypes = [ 'authorization_code' ],
 	name,
 	organization = null,
-	redirectUris = [],
-	webOrigins = []
+	redirects = [],
+	scopes = [],
+	origins = []
 }) => {
 
-	const invalid = allowedScopes.filter( ( scope ) => ! developer.includes( scope ) );
+	const invalid = scopes.filter( ( scope ) => ! developer.includes( scope ) );
 
 	if( invalid.length > 0 ){
 
@@ -340,41 +348,42 @@ const createClient = async ({
 
 	}
 	const rawClientId = generateToken();
-	const clientId = 'drawbridge.' + rawClientId;
+	const client = 'drawbridge.' + rawClientId;
 
 	const rawSecret = generateToken();
 	const secretHash = hashToken( rawSecret );
 
 	const now = new Date();
 
-	const doc = await controller.insert({
+	const record = await controller.create({
 		collection : 'oauth',
 		data : {
-			allowedScopes,
-			clientId,
-			clientSecretHashes : [
+			client,
+			createdBy,
+			description,
+			endpoint : {
+				auth : 'client_secret_basic'
+			},
+			hashes : [
 				{
 					createdAt : now,
 					hash : secretHash,
 					retiredAt : null
 				}
 			],
-			clientType : 'confidential',
-			createdBy,
-			description,
-			grantTypes,
+			limits : null,
 			name,
 			organization,
-			rateLimitOverrides : null,
-			redirectUris,
+			origins,
+			redirects,
+			scopes,
 			status : 'active',
-			tokenEndpointAuthMethod : 'client_secret_basic',
-			webOrigins
+			type : 'confidential'
 		}
 	});
 
 	return {
-		client : doc,
+		record,
 		rawSecret
 	};
 

package/dist/oauth/server.js

@@ -25,8 +25,8 @@ var compare = (a, b) => {
 
 // lib/oauth/index.js
 var lifetimes = {
-  access: 60 * 60,
-  // 1 hour
+  access: 60 * 60 * 8,
+  // 8 hours
   authorizationCode: 10 * 60,
   // 10 minutes
   code: 15 * 60,
@@ -111,19 +111,20 @@ var hashToken = (raw) => hash(raw, process.env.OAUTH_TOKEN_HMAC_KEY);
 var generateToken = () => generate(32, "base64url");
 
 // lib/oauth/server.js
+var SUPPORTED_GRANTS = ["authorization_code", "client_credentials", "refresh_token"];
 var createOAuthModel = ({ controller }) => ({
   getClient: async (clientId, clientSecret) => {
     var _a;
-    const client = await controller.get({
+    const record = await controller.get({
       collection: "oauth",
       query: {
-        clientId,
+        client: clientId,
         status: "active"
       }
     });
-    if (!client) return false;
+    if (!record) return false;
     if (clientSecret) {
-      const validSecret = (_a = client.clientSecretHashes) == null ? void 0 : _a.some((entry) => {
+      const validSecret = (_a = record.hashes) == null ? void 0 : _a.some((entry) => {
         if (entry.retiredAt) return false;
         return compare(hashToken(clientSecret), entry.hash);
       });
@@ -131,11 +132,11 @@ var createOAuthModel = ({ controller }) => ({
     }
     ;
     return {
-      clientId: client.clientId,
-      grants: ["authorization_code", "client_credentials", "refresh_token"],
-      id: client.id,
-      redirectUris: client.redirectUris ?? [],
-      scopes: client.allowedScopes ?? []
+      clientId: record.client,
+      grants: SUPPORTED_GRANTS,
+      id: record.id,
+      redirectUris: record.redirects ?? [],
+      scopes: record.scopes ?? []
     };
   },
   saveAuthorizationCode: async (code, client, user) => {
@@ -340,17 +341,16 @@ var createOAuthServer = ({ controller }) => new OAuth2Server({
   }
 });
 var createClient = async ({
-  allowedScopes = [],
   controller,
   createdBy = null,
   description = null,
-  grantTypes = ["authorization_code"],
   name,
   organization = null,
-  redirectUris = [],
-  webOrigins = []
+  redirects = [],
+  scopes: scopes2 = [],
+  origins = []
 }) => {
-  const invalid = allowedScopes.filter((scope) => !developer.includes(scope));
+  const invalid = scopes2.filter((scope) => !developer.includes(scope));
   if (invalid.length > 0) {
     const error = new Error("Scopes not permitted for developer apps: " + invalid.join(", "));
     error.status = 400;
@@ -358,37 +358,38 @@ var createClient = async ({
   }
   ;
   const rawClientId = generateToken();
-  const clientId = "drawbridge." + rawClientId;
+  const client = "drawbridge." + rawClientId;
   const rawSecret = generateToken();
   const secretHash = hashToken(rawSecret);
   const now = /* @__PURE__ */ new Date();
-  const doc = await controller.insert({
+  const record = await controller.create({
     collection: "oauth",
     data: {
-      allowedScopes,
-      clientId,
-      clientSecretHashes: [
+      client,
+      createdBy,
+      description,
+      endpoint: {
+        auth: "client_secret_basic"
+      },
+      hashes: [
         {
           createdAt: now,
           hash: secretHash,
           retiredAt: null
         }
       ],
-      clientType: "confidential",
-      createdBy,
-      description,
-      grantTypes,
+      limits: null,
       name,
       organization,
-      rateLimitOverrides: null,
-      redirectUris,
+      origins,
+      redirects,
+      scopes: scopes2,
       status: "active",
-      tokenEndpointAuthMethod: "client_secret_basic",
-      webOrigins
+      type: "confidential"
     }
   });
   return {
-    client: doc,
+    record,
     rawSecret
   };
 };

package/package.json

@@ -130,5 +130,5 @@
     "build": "tsup && npm publish"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.49"
+  "version": "0.0.51"
 }