@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.19

package/dist/OAuthDeviceAuthorization.js

@@ -0,0 +1,860 @@
+import { Brand, Context, Data, Duration, Effect, Layer, Option, Redacted, Ref, } from "effect";
+import { Crypto } from "./Crypto.js";
+import { OAuthClientId, UnixMillis } from "./Identifiers.js";
+import { currentUnixMillis } from "./Internal.js";
+import { defaultOAuthProviderModeAccessTokenBytes, defaultOAuthProviderModeAccessTokenTtl, defaultOAuthProviderModeRefreshTokenBytes, defaultOAuthProviderModeRefreshTokenTtl, OAuthAccessToken, OAuthClientRegistry, OAuthRefreshToken, } from "./OAuth.js";
+export const oauthDeviceCodeGrantType = "urn:ietf:params:oauth:grant-type:device_code";
+export const OAuthDeviceCode = Brand.nominal();
+export const OAuthDeviceUserCode = Brand.nominal();
+export const OAuthDeviceAuthorizationId = Brand.nominal();
+export const oauthDeviceUserCodeAlphabet = "BCDFGHJKLMNPQRSTVWXZ";
+export const defaultOAuthDeviceCodeBytes = 32;
+export const defaultOAuthDeviceAuthorizationIdBytes = 16;
+export const defaultOAuthDeviceAuthorizationTtl = Duration.minutes(10);
+export const defaultOAuthDeviceAuthorizationPollInterval = Duration.seconds(5);
+export const defaultOAuthDeviceAuthorizationCollisionAttempts = 8;
+export const oauthDeviceAuthorizationSlowDownSeconds = 5;
+export class OAuthDeviceAuthorizationStoreError extends Data.TaggedError("OAuthDeviceAuthorizationStoreError") {
+}
+export class OAuthDeviceAuthorizationStore extends Context.Service()("auth/OAuthDeviceAuthorizationStore") {
+}
+export class OAuthDeviceAuthorizationError extends Data.TaggedError("OAuthDeviceAuthorizationError") {
+}
+export class OAuthDeviceAuthorization extends Context.Service()("auth/OAuthDeviceAuthorization", {
+    make: (options) => buildOAuthDeviceAuthorization(options),
+}) {
+}
+export class OAuthDeviceCodeTokenIssuerError extends Data.TaggedError("OAuthDeviceCodeTokenIssuerError") {
+}
+export class OAuthDeviceCodeTokenIssuer extends Context.Service()("auth/OAuthDeviceCodeTokenIssuer") {
+}
+export class OAuthDeviceCodeTokenCommitStoreError extends Data.TaggedError("OAuthDeviceCodeTokenCommitStoreError") {
+}
+export class OAuthDeviceCodeTokenCommitStore extends Context.Service()("auth/OAuthDeviceCodeTokenCommitStore") {
+}
+export class OAuthDeviceCodeTokenGrantError extends Data.TaggedError("OAuthDeviceCodeTokenGrantError") {
+}
+export class OAuthDeviceCodeTokenGrant extends Context.Service()("auth/OAuthDeviceCodeTokenGrant", {
+    make: () => buildOAuthDeviceCodeTokenGrant(),
+}) {
+}
+const cloneMetadata = (metadata) => metadata === undefined ? undefined : structuredClone(metadata);
+const cloneClient = (client) => ({
+    ...client,
+    redirectUris: [...client.redirectUris],
+    allowedGrantTypes: [...client.allowedGrantTypes],
+    allowedResponseTypes: [...client.allowedResponseTypes],
+    ...(client.allowedScopes === undefined
+        ? {}
+        : { allowedScopes: [...client.allowedScopes] }),
+    ...(client.metadata === undefined
+        ? {}
+        : { metadata: cloneMetadata(client.metadata) }),
+});
+const cloneRecord = (record) => ({
+    ...record,
+    requestedScopes: [...record.requestedScopes],
+    ...(record.status === "approved"
+        ? { grantedScopes: [...record.grantedScopes] }
+        : {}),
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: cloneMetadata(record.metadata) }),
+});
+const clonePendingRecord = (record) => cloneRecord(record);
+const cloneApprovedRecord = (record) => cloneRecord(record);
+const cloneUnconsumedApprovedRecord = (record) => cloneRecord(record);
+const cloneDeniedRecord = (record) => cloneRecord(record);
+const cloneConsumedRecord = (record) => cloneRecord(record);
+const cloneTokenResponse = (tokens) => ({
+    accessToken: tokens.accessToken,
+    tokenType: tokens.tokenType,
+    ...(tokens.expiresIn === undefined ? {} : { expiresIn: tokens.expiresIn }),
+    ...(tokens.refreshToken === undefined
+        ? {}
+        : { refreshToken: tokens.refreshToken }),
+    ...(tokens.idToken === undefined ? {} : { idToken: tokens.idToken }),
+    ...(tokens.scopes === undefined ? {} : { scopes: [...tokens.scopes] }),
+    ...(tokens.extra === undefined ? {} : { extra: cloneMetadata(tokens.extra) }),
+});
+const authorizationDetails = (record) => ({
+    id: record.id,
+    clientId: record.clientId,
+    requestedScopes: [...record.requestedScopes],
+    status: record.status,
+    issuedAt: record.issuedAt,
+    expiresAt: record.expiresAt,
+    pollIntervalSeconds: record.pollIntervalSeconds,
+    nextPollAt: record.nextPollAt,
+    ...(record.lastPolledAt === undefined
+        ? {}
+        : { lastPolledAt: record.lastPolledAt }),
+    ...(record.status === "approved"
+        ? {
+            subject: record.subject,
+            grantedScopes: [...record.grantedScopes],
+            approvedAt: record.approvedAt,
+            ...(record.consumedAt === undefined
+                ? {}
+                : { consumedAt: record.consumedAt }),
+        }
+        : record.status === "denied"
+            ? { deniedAt: record.deniedAt }
+            : {}),
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: cloneMetadata(record.metadata) }),
+});
+const tokenIssueAuthorization = (record) => ({
+    id: record.id,
+    clientId: record.clientId,
+    requestedScopes: [...record.requestedScopes],
+    issuedAt: record.issuedAt,
+    expiresAt: record.expiresAt,
+    approvedAt: record.approvedAt,
+    consumedAt: record.consumedAt,
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: cloneMetadata(record.metadata) }),
+});
+const tokenPrepareAuthorization = (record) => ({
+    id: record.id,
+    clientId: record.clientId,
+    requestedScopes: [...record.requestedScopes],
+    issuedAt: record.issuedAt,
+    expiresAt: record.expiresAt,
+    approvedAt: record.approvedAt,
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: cloneMetadata(record.metadata) }),
+});
+const cloneProviderModeTokenRecord = (record) => ({
+    ...record,
+    scopes: [...record.scopes],
+    ...(record.audience === undefined
+        ? {}
+        : {
+            audience: Array.isArray(record.audience)
+                ? [...record.audience]
+                : record.audience,
+        }),
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: cloneMetadata(record.metadata) }),
+});
+const cloneTokenIssueAuthorization = (authorization) => ({
+    ...authorization,
+    requestedScopes: [...authorization.requestedScopes],
+    ...(authorization.metadata === undefined
+        ? {}
+        : { metadata: cloneMetadata(authorization.metadata) }),
+});
+const normalizeScopes = (scopes) => {
+    const values = typeof scopes === "string" ? scopes.split(/\s+/) : (scopes ?? []);
+    const normalized = new Set();
+    for (const value of values) {
+        const scope = value.trim();
+        if (scope !== "") {
+            if (!/^[\u0021\u0023-\u005B\u005D-\u007E]+$/.test(scope)) {
+                return undefined;
+            }
+            normalized.add(scope);
+        }
+    }
+    return [...normalized];
+};
+const normalizedClientId = (value) => {
+    const clientId = value === undefined ? "" : String(value).trim();
+    return clientId === "" ? undefined : OAuthClientId(clientId);
+};
+export const normalizeOAuthDeviceUserCode = (value) => {
+    const compact = String(value).trim().toUpperCase().replaceAll(/[\s-]/g, "");
+    if (compact.length !== 8 ||
+        [...compact].some((character) => !oauthDeviceUserCodeAlphabet.includes(character))) {
+        return undefined;
+    }
+    return OAuthDeviceUserCode(`${compact.slice(0, 4)}-${compact.slice(4)}`);
+};
+const authorizationError = (operation, message, cause) => new OAuthDeviceAuthorizationError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const tokenGrantError = (message, cause) => new OAuthDeviceCodeTokenGrantError({
+    operation: "exchange",
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const deviceTokenIssuerError = (message, cause) => new OAuthDeviceCodeTokenIssuerError({
+    operation: "prepare",
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const validateByteLength = (value, label) => Number.isInteger(value) && value >= 16 && value <= 128
+    ? Effect.succeed(value)
+    : Effect.fail(authorizationError("start", `${label} byte length must be an integer between 16 and 128`));
+const validateOptions = (options) => Effect.gen(function* () {
+    const deviceCodeBytes = yield* validateByteLength(options.deviceCodeBytes ?? defaultOAuthDeviceCodeBytes, "OAuth device code");
+    const authorizationIdBytes = yield* validateByteLength(options.authorizationIdBytes ?? defaultOAuthDeviceAuthorizationIdBytes, "OAuth device authorization id");
+    const ttlMillis = Duration.toMillis(options.ttl ?? defaultOAuthDeviceAuthorizationTtl);
+    const pollIntervalMillis = Duration.toMillis(options.pollInterval ?? defaultOAuthDeviceAuthorizationPollInterval);
+    const collisionAttempts = options.collisionAttempts ??
+        defaultOAuthDeviceAuthorizationCollisionAttempts;
+    if (!Number.isSafeInteger(ttlMillis) ||
+        ttlMillis < 1000 ||
+        ttlMillis % 1000 !== 0) {
+        return yield* authorizationError("start", "OAuth device authorization TTL must be a positive whole number of seconds");
+    }
+    if (!Number.isFinite(pollIntervalMillis) ||
+        pollIntervalMillis < 1000 ||
+        pollIntervalMillis % 1000 !== 0) {
+        return yield* authorizationError("start", "OAuth device authorization poll interval must be a positive whole number of seconds");
+    }
+    const secretBytes = options.userCodeSecret instanceof Uint8Array
+        ? options.userCodeSecret.byteLength
+        : new TextEncoder().encode(Redacted.value(options.userCodeSecret))
+            .byteLength;
+    if (secretBytes < 32) {
+        return yield* authorizationError("start", "OAuth device user code secret must contain at least 32 bytes");
+    }
+    if (!Number.isInteger(collisionAttempts) ||
+        collisionAttempts < 1 ||
+        collisionAttempts > 100) {
+        return yield* authorizationError("start", "OAuth device authorization collision attempts must be an integer between 1 and 100");
+    }
+    return {
+        deviceCodeBytes,
+        authorizationIdBytes,
+        ttlMillis,
+        pollIntervalSeconds: pollIntervalMillis / 1000,
+        collisionAttempts,
+    };
+});
+const deviceCodeHash = (crypto, deviceCode, error) => crypto.digestSha256({ data: deviceCode }).pipe(Effect.map((hash) => `sha256:${hash}`), Effect.mapError((cause) => error("Failed to hash OAuth device code", cause)));
+const userCodeHash = (crypto, secret, userCode, operation) => crypto.hmacSha256({ key: secret, data: userCode }).pipe(Effect.map((hash) => `hmac-sha256:${hash}`), Effect.mapError((cause) => authorizationError(operation, "Failed to hash OAuth device user code", cause)));
+const generateUserCode = (crypto) => Effect.gen(function* () {
+    const characters = [];
+    for (let batch = 0; characters.length < 8 && batch < 16; batch += 1) {
+        const bytes = yield* crypto
+            .randomBytes(16)
+            .pipe(Effect.mapError((cause) => authorizationError("start", "Failed to generate OAuth device user code", cause)));
+        for (const byte of bytes) {
+            if (byte < 240) {
+                characters.push(oauthDeviceUserCodeAlphabet[byte % 20]);
+                if (characters.length === 8) {
+                    break;
+                }
+            }
+        }
+    }
+    if (characters.length !== 8) {
+        return yield* authorizationError("start", "Failed to generate an unbiased OAuth device user code");
+    }
+    return OAuthDeviceUserCode(`${characters.slice(0, 4).join("")}-${characters.slice(4).join("")}`);
+});
+const startInvalid = (reason) => ({ valid: false, reason });
+const decisionInvalid = (reason) => ({ valid: false, reason });
+const tokenGrantInvalid = (reason) => ({ valid: false, reason });
+const buildOAuthDeviceAuthorization = (constructionOptions) => Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const store = yield* OAuthDeviceAuthorizationStore;
+    const clients = yield* OAuthClientRegistry;
+    const options = yield* validateOptions(constructionOptions);
+    const { userCodeSecret } = constructionOptions;
+    return {
+        start: Effect.fn("auth.oauth.device_authorization.start")(function* (input) {
+            const clientId = normalizedClientId(input.clientId);
+            if (clientId === undefined) {
+                return startInvalid("invalid_request");
+            }
+            const clientOption = yield* clients
+                .find({ clientId })
+                .pipe(Effect.mapError((cause) => authorizationError("start", "Failed to load OAuth client", cause)));
+            if (Option.isNone(clientOption) ||
+                clientOption.value.status !== "active") {
+                return startInvalid("invalid_client");
+            }
+            const client = clientOption.value;
+            if (!client.allowedGrantTypes.includes(oauthDeviceCodeGrantType)) {
+                return startInvalid("unauthorized_client");
+            }
+            const requestedScopes = normalizeScopes(input.scopes);
+            if (requestedScopes === undefined) {
+                return startInvalid("invalid_scope");
+            }
+            if (client.allowedScopes !== undefined &&
+                requestedScopes.some((scope) => !client.allowedScopes?.includes(scope))) {
+                return startInvalid("invalid_scope");
+            }
+            const issuedAt = yield* currentUnixMillis;
+            const expiresAt = UnixMillis(Number(issuedAt) + options.ttlMillis);
+            const nextPollAt = UnixMillis(Number(issuedAt) + options.pollIntervalSeconds * 1000);
+            for (let attempt = 0; attempt < options.collisionAttempts; attempt += 1) {
+                const authorizationId = OAuthDeviceAuthorizationId(yield* crypto
+                    .randomToken(options.authorizationIdBytes)
+                    .pipe(Effect.mapError((cause) => authorizationError("start", "Failed to generate OAuth device authorization id", cause))));
+                const rawDeviceCode = OAuthDeviceCode(yield* crypto
+                    .randomToken(options.deviceCodeBytes)
+                    .pipe(Effect.mapError((cause) => authorizationError("start", "Failed to generate OAuth device code", cause))));
+                const rawUserCode = yield* generateUserCode(crypto);
+                const hashedDeviceCode = yield* deviceCodeHash(crypto, rawDeviceCode, (message, cause) => authorizationError("start", message, cause));
+                const hashedUserCode = yield* userCodeHash(crypto, userCodeSecret, rawUserCode, "start");
+                const record = {
+                    id: authorizationId,
+                    deviceCodeHash: hashedDeviceCode,
+                    userCodeHash: hashedUserCode,
+                    clientId,
+                    requestedScopes: [...requestedScopes],
+                    status: "pending",
+                    issuedAt,
+                    expiresAt,
+                    pollIntervalSeconds: options.pollIntervalSeconds,
+                    nextPollAt,
+                    ...(input.metadata === undefined
+                        ? {}
+                        : { metadata: cloneMetadata(input.metadata) }),
+                };
+                const inserted = yield* store
+                    .insert(record)
+                    .pipe(Effect.mapError((cause) => authorizationError("start", "Failed to store OAuth device authorization", cause)));
+                if (inserted) {
+                    return {
+                        valid: true,
+                        authorization: authorizationDetails(record),
+                        client: cloneClient(client),
+                        deviceCode: Redacted.make(rawDeviceCode),
+                        userCode: rawUserCode,
+                        expiresIn: options.ttlMillis / 1000,
+                        interval: options.pollIntervalSeconds,
+                    };
+                }
+            }
+            return yield* authorizationError("start", "OAuth device authorization code collision limit exceeded");
+        }),
+        inspect: Effect.fn("auth.oauth.device_authorization.inspect")(function* (input) {
+            const normalized = normalizeOAuthDeviceUserCode(input.userCode);
+            if (normalized === undefined) {
+                return { valid: false, reason: "invalid_user_code" };
+            }
+            const hash = yield* userCodeHash(crypto, userCodeSecret, normalized, "inspect");
+            const recordOption = yield* store
+                .findByUserCodeHash({ userCodeHash: hash })
+                .pipe(Effect.mapError((cause) => authorizationError("inspect", "Failed to load OAuth device authorization", cause)));
+            if (Option.isNone(recordOption)) {
+                return { valid: false, reason: "invalid_user_code" };
+            }
+            const now = yield* currentUnixMillis;
+            if (Number(now) >= Number(recordOption.value.expiresAt)) {
+                return { valid: false, reason: "expired_token" };
+            }
+            return {
+                valid: true,
+                authorization: authorizationDetails(recordOption.value),
+            };
+        }),
+        approve: Effect.fn("auth.oauth.device_authorization.approve")(function* (input) {
+            const subject = input.subject.trim();
+            if (subject === "") {
+                return decisionInvalid("invalid_request");
+            }
+            const currentOption = yield* store
+                .findById(input.authorizationId)
+                .pipe(Effect.mapError((cause) => authorizationError("approve", "Failed to load OAuth device authorization", cause)));
+            if (Option.isNone(currentOption)) {
+                return decisionInvalid("invalid_request");
+            }
+            const current = currentOption.value;
+            const grantedScopes = input.scopes === undefined
+                ? [...current.requestedScopes]
+                : normalizeScopes(input.scopes);
+            if (grantedScopes === undefined) {
+                return decisionInvalid("invalid_scope");
+            }
+            if (grantedScopes.some((scope) => !current.requestedScopes.includes(scope))) {
+                return decisionInvalid("invalid_scope");
+            }
+            const now = yield* currentUnixMillis;
+            const decided = yield* store
+                .decide({
+                id: input.authorizationId,
+                decision: "approve",
+                subject,
+                grantedScopes: [...grantedScopes],
+                decidedAt: now,
+                metadata: current.metadata === undefined && input.metadata === undefined
+                    ? undefined
+                    : {
+                        ...cloneMetadata(current.metadata),
+                        ...cloneMetadata(input.metadata),
+                    },
+            })
+                .pipe(Effect.mapError((cause) => authorizationError("approve", "Failed to approve OAuth device authorization", cause)));
+            switch (decided.status) {
+                case "approved": {
+                    return {
+                        valid: true,
+                        authorization: authorizationDetails(decided.record),
+                    };
+                }
+                case "expired": {
+                    return decisionInvalid("expired_token");
+                }
+                case "already_decided": {
+                    return decisionInvalid("already_decided");
+                }
+                case "missing": {
+                    return decisionInvalid("invalid_request");
+                }
+                case "denied": {
+                    return decisionInvalid("already_decided");
+                }
+            }
+        }),
+        deny: Effect.fn("auth.oauth.device_authorization.deny")(function* (input) {
+            const now = yield* currentUnixMillis;
+            const decided = yield* store
+                .decide({
+                id: input.authorizationId,
+                decision: "deny",
+                decidedAt: now,
+                ...(input.metadata === undefined
+                    ? {}
+                    : { metadata: cloneMetadata(input.metadata) }),
+            })
+                .pipe(Effect.mapError((cause) => authorizationError("deny", "Failed to deny OAuth device authorization", cause)));
+            switch (decided.status) {
+                case "denied": {
+                    return {
+                        valid: true,
+                        authorization: authorizationDetails(decided.record),
+                    };
+                }
+                case "expired": {
+                    return decisionInvalid("expired_token");
+                }
+                case "already_decided": {
+                    return decisionInvalid("already_decided");
+                }
+                case "missing": {
+                    return decisionInvalid("invalid_request");
+                }
+                case "approved": {
+                    return decisionInvalid("already_decided");
+                }
+            }
+        }),
+    };
+});
+const buildOAuthDeviceCodeTokenGrant = () => Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const store = yield* OAuthDeviceAuthorizationStore;
+    const clients = yield* OAuthClientRegistry;
+    const issuer = yield* OAuthDeviceCodeTokenIssuer;
+    const commitStore = yield* OAuthDeviceCodeTokenCommitStore;
+    return {
+        exchange: Effect.fn("auth.oauth.device_code_token.exchange")(function* (input) {
+            if (input.grantType !== oauthDeviceCodeGrantType) {
+                return tokenGrantInvalid("unsupported_grant_type");
+            }
+            const clientId = normalizedClientId(input.clientId);
+            const rawDeviceCode = input.deviceCode === undefined
+                ? ""
+                : String(Redacted.value(input.deviceCode)).trim();
+            if (clientId === undefined || rawDeviceCode === "") {
+                return tokenGrantInvalid("invalid_request");
+            }
+            const clientOption = yield* clients
+                .find({ clientId })
+                .pipe(Effect.mapError((cause) => tokenGrantError("Failed to load OAuth client", cause)));
+            if (Option.isNone(clientOption) ||
+                clientOption.value.status !== "active") {
+                return tokenGrantInvalid("invalid_client");
+            }
+            const client = clientOption.value;
+            if (!client.allowedGrantTypes.includes(oauthDeviceCodeGrantType)) {
+                return tokenGrantInvalid("unauthorized_client");
+            }
+            if (client.type === "confidential" &&
+                input.clientAuthenticated !== true) {
+                return tokenGrantInvalid("invalid_client");
+            }
+            const hash = yield* deviceCodeHash(crypto, rawDeviceCode, tokenGrantError);
+            const now = yield* currentUnixMillis;
+            const polled = yield* store
+                .poll({ deviceCodeHash: hash, clientId, now })
+                .pipe(Effect.mapError((cause) => tokenGrantError("Failed to poll OAuth device authorization", cause)));
+            switch (polled.status) {
+                case "missing":
+                case "already_consumed": {
+                    return tokenGrantInvalid("invalid_grant");
+                }
+                case "expired": {
+                    return tokenGrantInvalid("expired_token");
+                }
+                case "denied": {
+                    return tokenGrantInvalid("access_denied");
+                }
+                case "pending": {
+                    return tokenGrantInvalid("authorization_pending");
+                }
+                case "slow_down": {
+                    return tokenGrantInvalid("slow_down");
+                }
+                case "approved": {
+                    const preparation = yield* issuer
+                        .prepare({
+                        client: cloneClient(client),
+                        authorization: tokenPrepareAuthorization(polled.record),
+                        subject: polled.record.subject,
+                        scopes: [...polled.record.grantedScopes],
+                        now,
+                    })
+                        .pipe(Effect.mapError((cause) => tokenGrantError("Failed to prepare OAuth device tokens", cause)));
+                    const committed = yield* commitStore
+                        .commit({
+                        authorization: polled.record,
+                        consumedAt: now,
+                        tokenRecords: preparation.tokenRecords.map(cloneProviderModeTokenRecord),
+                    })
+                        .pipe(Effect.mapError((cause) => tokenGrantError("Failed to commit OAuth device token exchange", cause)));
+                    if (committed.status === "missing") {
+                        return tokenGrantInvalid("invalid_grant");
+                    }
+                    if (committed.status === "already_consumed") {
+                        return tokenGrantInvalid("invalid_grant");
+                    }
+                    if (committed.status === "expired") {
+                        return tokenGrantInvalid("expired_token");
+                    }
+                    const authorization = tokenIssueAuthorization(committed.record);
+                    const scopes = [...committed.record.grantedScopes];
+                    return {
+                        valid: true,
+                        client: cloneClient(client),
+                        authorization: cloneTokenIssueAuthorization(authorization),
+                        subject: committed.record.subject,
+                        scopes: [...scopes],
+                        tokens: cloneTokenResponse(preparation.tokens),
+                    };
+                }
+            }
+        }),
+    };
+});
+const validateOpaqueTokenBytes = (value, label) => Number.isInteger(value) && value >= 16 && value <= 128
+    ? Effect.succeed(value)
+    : Effect.fail(deviceTokenIssuerError(`${label} byte length must be an integer between 16 and 128`));
+const validateOpaqueTokenTtl = (value, label) => {
+    const millis = Duration.toMillis(value);
+    return Number.isSafeInteger(millis) && millis >= 1000 && millis % 1000 === 0
+        ? Effect.succeed(millis)
+        : Effect.fail(deviceTokenIssuerError(`${label} TTL must be a positive whole number of seconds`));
+};
+const generateOpaqueToken = (crypto, byteLength, brand, label) => crypto.randomToken(byteLength).pipe(Effect.map((value) => Redacted.make(brand(value))), Effect.mapError((cause) => deviceTokenIssuerError(`Failed to generate OAuth ${label} token`, cause)));
+const hashOpaqueToken = (crypto, token) => crypto.digestSha256({ data: Redacted.value(token) }).pipe(Effect.map((hash) => `sha256:${hash}`), Effect.mapError((cause) => deviceTokenIssuerError("Failed to hash OAuth provider-mode token", cause)));
+export var OAuthDeviceProviderModeOpaqueTokenIssuer;
+(function (OAuthDeviceProviderModeOpaqueTokenIssuer) {
+    OAuthDeviceProviderModeOpaqueTokenIssuer.make = (options = {}) => Effect.gen(function* () {
+        const crypto = yield* Crypto;
+        const accessTokenBytes = yield* validateOpaqueTokenBytes(options.accessTokenBytes ?? defaultOAuthProviderModeAccessTokenBytes, "OAuth access token");
+        const refreshTokenBytes = yield* validateOpaqueTokenBytes(options.refreshTokenBytes ?? defaultOAuthProviderModeRefreshTokenBytes, "OAuth refresh token");
+        const accessTokenTtlMillis = yield* validateOpaqueTokenTtl(options.accessTokenTtl ?? defaultOAuthProviderModeAccessTokenTtl, "OAuth access token");
+        const refreshTokenTtlMillis = yield* validateOpaqueTokenTtl(options.refreshTokenTtl ?? defaultOAuthProviderModeRefreshTokenTtl, "OAuth refresh token");
+        const configuredIssuer = options.issuer;
+        const configuredMetadata = cloneMetadata(options.metadata);
+        const configuredAudience = Array.isArray(options.audience)
+            ? [...options.audience]
+            : options.audience;
+        return OAuthDeviceCodeTokenIssuer.of({
+            prepare: Effect.fn("auth.oauth.device_code.provider_mode_opaque.prepare")(function* (input) {
+                const issueRefreshToken = input.client.allowedGrantTypes.includes("refresh_token");
+                const refreshTokenExpiresAt = UnixMillis(Number(input.now) + refreshTokenTtlMillis);
+                const accessTokenExpiresAt = UnixMillis(Math.min(Number(input.now) + accessTokenTtlMillis, issueRefreshToken
+                    ? Number(refreshTokenExpiresAt)
+                    : Number.POSITIVE_INFINITY));
+                const metadata = {
+                    ...cloneMetadata(configuredMetadata),
+                    grantType: oauthDeviceCodeGrantType,
+                    authorizationId: input.authorization.id,
+                };
+                const baseRecord = {
+                    clientId: input.client.id,
+                    subject: input.subject,
+                    scopes: [...input.scopes],
+                    issuedAt: input.now,
+                    ...(configuredIssuer === undefined
+                        ? {}
+                        : { issuer: configuredIssuer }),
+                    ...(configuredAudience === undefined
+                        ? {}
+                        : {
+                            audience: Array.isArray(configuredAudience)
+                                ? [...configuredAudience]
+                                : configuredAudience,
+                        }),
+                    metadata,
+                };
+                const accessToken = yield* generateOpaqueToken(crypto, accessTokenBytes, OAuthAccessToken, "access");
+                const accessTokenHash = yield* hashOpaqueToken(crypto, accessToken);
+                const accessTokenRecord = {
+                    ...baseRecord,
+                    tokenHash: accessTokenHash,
+                    tokenType: "access_token",
+                    expiresAt: accessTokenExpiresAt,
+                };
+                if (!issueRefreshToken) {
+                    return {
+                        tokens: {
+                            accessToken,
+                            tokenType: "Bearer",
+                            expiresIn: Math.floor((Number(accessTokenExpiresAt) - Number(input.now)) / 1000),
+                            ...(input.scopes.length === 0
+                                ? {}
+                                : { scopes: [...input.scopes] }),
+                        },
+                        tokenRecords: [accessTokenRecord],
+                    };
+                }
+                const refreshToken = yield* generateOpaqueToken(crypto, refreshTokenBytes, OAuthRefreshToken, "refresh");
+                const refreshTokenHash = yield* hashOpaqueToken(crypto, refreshToken);
+                const refreshTokenRecord = {
+                    ...baseRecord,
+                    tokenHash: refreshTokenHash,
+                    tokenType: "refresh_token",
+                    expiresAt: refreshTokenExpiresAt,
+                };
+                return {
+                    tokens: {
+                        accessToken,
+                        tokenType: "Bearer",
+                        expiresIn: Math.floor((Number(accessTokenExpiresAt) - Number(input.now)) / 1000),
+                        refreshToken,
+                        ...(input.scopes.length === 0
+                            ? {}
+                            : { scopes: [...input.scopes] }),
+                    },
+                    tokenRecords: [accessTokenRecord, refreshTokenRecord],
+                };
+            }),
+        });
+    });
+})(OAuthDeviceProviderModeOpaqueTokenIssuer || (OAuthDeviceProviderModeOpaqueTokenIssuer = {}));
+const initialMemoryStoreState = (records) => {
+    const recordsById = new Map();
+    const idsByDeviceCodeHash = new Map();
+    const idsByUserCodeHash = new Map();
+    for (const source of records) {
+        if (recordsById.has(source.id) ||
+            idsByDeviceCodeHash.has(source.deviceCodeHash) ||
+            idsByUserCodeHash.has(source.userCodeHash)) {
+            continue;
+        }
+        const record = cloneRecord(source);
+        recordsById.set(record.id, record);
+        idsByDeviceCodeHash.set(record.deviceCodeHash, record.id);
+        idsByUserCodeHash.set(record.userCodeHash, record.id);
+    }
+    return { recordsById, idsByDeviceCodeHash, idsByUserCodeHash };
+};
+const memoryStoreRecordByHash = (state, index, hash) => {
+    const id = index.get(hash);
+    const record = id === undefined ? undefined : state.recordsById.get(id);
+    return record === undefined
+        ? Option.none()
+        : Option.some(cloneRecord(record));
+};
+const memoryStoreWithRecord = (state, record) => {
+    const recordsById = new Map([
+        ...state.recordsById,
+        [record.id, record],
+    ]);
+    return { ...state, recordsById };
+};
+export var OAuthDeviceAuthorizationStoreMemory;
+(function (OAuthDeviceAuthorizationStoreMemory) {
+    OAuthDeviceAuthorizationStoreMemory.make = (records = []) => Effect.gen(function* () {
+        const state = yield* Ref.make(initialMemoryStoreState(records));
+        return OAuthDeviceAuthorizationStore.of({
+            insert: (source) => Ref.modify(state, (current) => {
+                if (current.recordsById.has(source.id) ||
+                    current.idsByDeviceCodeHash.has(source.deviceCodeHash) ||
+                    current.idsByUserCodeHash.has(source.userCodeHash)) {
+                    return [false, current];
+                }
+                const record = clonePendingRecord(source);
+                const recordsById = new Map(current.recordsById);
+                const idsByDeviceCodeHash = new Map(current.idsByDeviceCodeHash);
+                const idsByUserCodeHash = new Map(current.idsByUserCodeHash);
+                recordsById.set(record.id, record);
+                idsByDeviceCodeHash.set(record.deviceCodeHash, record.id);
+                idsByUserCodeHash.set(record.userCodeHash, record.id);
+                return [
+                    true,
+                    { recordsById, idsByDeviceCodeHash, idsByUserCodeHash },
+                ];
+            }),
+            findByDeviceCodeHash: (input) => Ref.get(state).pipe(Effect.map((current) => memoryStoreRecordByHash(current, current.idsByDeviceCodeHash, input.deviceCodeHash))),
+            findByUserCodeHash: (input) => Ref.get(state).pipe(Effect.map((current) => memoryStoreRecordByHash(current, current.idsByUserCodeHash, input.userCodeHash))),
+            findById: (id) => Ref.get(state).pipe(Effect.map((current) => {
+                const record = current.recordsById.get(id);
+                return record === undefined
+                    ? Option.none()
+                    : Option.some(cloneRecord(record));
+            })),
+            decide: (input) => Ref.modify(state, (current) => {
+                const record = current.recordsById.get(input.id);
+                if (record === undefined) {
+                    return [{ status: "missing" }, current];
+                }
+                if (Number(input.decidedAt) >= Number(record.expiresAt)) {
+                    return [
+                        { status: "expired", record: cloneRecord(record) },
+                        current,
+                    ];
+                }
+                if (record.status !== "pending") {
+                    return [
+                        {
+                            status: "already_decided",
+                            record: record.status === "approved"
+                                ? cloneApprovedRecord(record)
+                                : cloneDeniedRecord(record),
+                        },
+                        current,
+                    ];
+                }
+                if (input.decision === "approve") {
+                    const approved = {
+                        ...record,
+                        status: "approved",
+                        subject: input.subject,
+                        grantedScopes: [...input.grantedScopes],
+                        approvedAt: input.decidedAt,
+                        ...(input.metadata === undefined
+                            ? {}
+                            : { metadata: cloneMetadata(input.metadata) }),
+                    };
+                    return [
+                        {
+                            status: "approved",
+                            record: cloneApprovedRecord(approved),
+                        },
+                        memoryStoreWithRecord(current, approved),
+                    ];
+                }
+                const denied = {
+                    ...record,
+                    status: "denied",
+                    deniedAt: input.decidedAt,
+                    ...(input.metadata === undefined
+                        ? {}
+                        : { metadata: cloneMetadata(input.metadata) }),
+                };
+                return [
+                    { status: "denied", record: cloneDeniedRecord(denied) },
+                    memoryStoreWithRecord(current, denied),
+                ];
+            }),
+            poll: (input) => Ref.modify(state, (current) => {
+                const id = current.idsByDeviceCodeHash.get(input.deviceCodeHash);
+                const record = id === undefined ? undefined : current.recordsById.get(id);
+                if (record === undefined || record.clientId !== input.clientId) {
+                    return [{ status: "missing" }, current];
+                }
+                if (record.status === "approved" &&
+                    record.consumedAt !== undefined) {
+                    return [
+                        {
+                            status: "already_consumed",
+                            record: cloneConsumedRecord(record),
+                        },
+                        current,
+                    ];
+                }
+                if (Number(input.now) >= Number(record.expiresAt)) {
+                    return [
+                        { status: "expired", record: cloneRecord(record) },
+                        current,
+                    ];
+                }
+                if (record.status === "denied") {
+                    return [
+                        {
+                            status: "denied",
+                            record: cloneDeniedRecord(record),
+                        },
+                        current,
+                    ];
+                }
+                if (record.status === "approved") {
+                    return [
+                        {
+                            status: "approved",
+                            record: cloneUnconsumedApprovedRecord(record),
+                        },
+                        current,
+                    ];
+                }
+                if (Number(input.now) < Number(record.nextPollAt)) {
+                    const interval = record.pollIntervalSeconds +
+                        oauthDeviceAuthorizationSlowDownSeconds;
+                    const slowed = {
+                        ...record,
+                        pollIntervalSeconds: interval,
+                        lastPolledAt: input.now,
+                        nextPollAt: UnixMillis(Number(input.now) + interval * 1000),
+                    };
+                    return [
+                        {
+                            status: "slow_down",
+                            record: cloneRecord(slowed),
+                            interval,
+                        },
+                        memoryStoreWithRecord(current, slowed),
+                    ];
+                }
+                const pending = {
+                    ...record,
+                    lastPolledAt: input.now,
+                    nextPollAt: UnixMillis(Number(input.now) + record.pollIntervalSeconds * 1000),
+                };
+                return [
+                    {
+                        status: "pending",
+                        record: clonePendingRecord(pending),
+                    },
+                    memoryStoreWithRecord(current, pending),
+                ];
+            }),
+            deleteExpired: (input) => Ref.modify(state, (current) => {
+                const recordsById = new Map(current.recordsById);
+                const idsByDeviceCodeHash = new Map(current.idsByDeviceCodeHash);
+                const idsByUserCodeHash = new Map(current.idsByUserCodeHash);
+                let deleted = 0;
+                for (const [id, record] of current.recordsById) {
+                    if (Number(record.expiresAt) > Number(input.beforeExpiresAt)) {
+                        continue;
+                    }
+                    recordsById.delete(id);
+                    idsByDeviceCodeHash.delete(record.deviceCodeHash);
+                    idsByUserCodeHash.delete(record.userCodeHash);
+                    deleted += 1;
+                }
+                return [
+                    deleted,
+                    { recordsById, idsByDeviceCodeHash, idsByUserCodeHash },
+                ];
+            }),
+        });
+    });
+})(OAuthDeviceAuthorizationStoreMemory || (OAuthDeviceAuthorizationStoreMemory = {}));
+export const OAuthDeviceAuthorizationStoreMemoryLive = (records = []) => Layer.effect(OAuthDeviceAuthorizationStore)(OAuthDeviceAuthorizationStoreMemory.make(records));
+export const OAuthDeviceAuthorizationLive = (options) => Layer.effect(OAuthDeviceAuthorization)(OAuthDeviceAuthorization.make(options));
+export const OAuthDeviceCodeTokenGrantLive = Layer.effect(OAuthDeviceCodeTokenGrant)(OAuthDeviceCodeTokenGrant.make());
+export const OAuthDeviceProviderModeOpaqueTokenIssuerLive = (options = {}) => Layer.effect(OAuthDeviceCodeTokenIssuer, OAuthDeviceProviderModeOpaqueTokenIssuer.make(options));
+export const startOAuthDeviceAuthorization = (input) => Effect.flatMap(OAuthDeviceAuthorization, (service) => service.start(input));
+export const inspectOAuthDeviceAuthorization = (input) => Effect.flatMap(OAuthDeviceAuthorization, (service) => service.inspect(input));
+export const approveOAuthDeviceAuthorization = (input) => Effect.flatMap(OAuthDeviceAuthorization, (service) => service.approve(input));
+export const denyOAuthDeviceAuthorization = (input) => Effect.flatMap(OAuthDeviceAuthorization, (service) => service.deny(input));
+export const exchangeOAuthDeviceCode = (input) => Effect.flatMap(OAuthDeviceCodeTokenGrant, (service) => service.exchange(input));
+//# sourceMappingURL=OAuthDeviceAuthorization.js.map