@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/oauth/authorize.js

@@ -0,0 +1,98 @@
+import { checkOAuthGrant } from "./grant.js";
+
+//#region src/server/oauth/authorize.ts
+function jsonError(status, error, description) {
+	return new Response(JSON.stringify({
+		error,
+		error_description: description
+	}), {
+		status,
+		headers: { "Content-Type": "application/json" }
+	});
+}
+/**
+* Validate an RFC 8707 `resource` indicator: it must be an absolute URI with an
+* `http`/`https` scheme and no fragment. The value is an audience identifier for
+* the protected resource (e.g. the MCP endpoint URL), not a fetch target.
+*
+* @see https://www.rfc-editor.org/rfc/rfc8707
+*/
+function isValidResourceIndicator(resource) {
+	let url;
+	try {
+		url = new URL(resource);
+	} catch {
+		return false;
+	}
+	if (url.hash !== "") return false;
+	return url.protocol === "https:" || url.protocol === "http:";
+}
+/**
+* Redirect an OAuth error back to a registered `redirect_uri`. The parse is
+* guarded so a malformed (yet registered) URI yields a 400 rather than a 500.
+*/
+function oauthError(redirectUri, error, state) {
+	try {
+		const url = new URL(redirectUri);
+		url.searchParams.set("error", error);
+		if (state) url.searchParams.set("state", state);
+		return Response.redirect(url.toString(), 302);
+	} catch {
+		return jsonError(400, "invalid_request", "Invalid redirect_uri.");
+	}
+}
+/**
+* Build the `GET /oauth2/authorize` request handler.
+*
+* The client and `redirect_uri` registration are validated before any redirect:
+* an unknown client or unregistered `redirect_uri` yields a direct error
+* response, never a redirect, to avoid an open redirect (RFC 6749 §3.1.2.4,
+* RFC 9700). Only once `redirect_uri` is a registered value are subsequent
+* validation failures surfaced back via redirect. Requires PKCE `S256`. The
+* client-grant predicate is shared with the consent mutation and token endpoint
+* via {@link checkOAuthGrant}; only the error formatting differs per boundary.
+*
+* @see https://www.rfc-editor.org/rfc/rfc6749#section-3.1.2.4
+* @see https://www.rfc-editor.org/rfc/rfc9700
+* @internal
+*/
+function createAuthorizeHandler(deps) {
+	return async (ctx, request) => {
+		const p = new URL(request.url).searchParams;
+		const clientId = p.get("client_id");
+		const redirectUri = p.get("redirect_uri");
+		const responseType = p.get("response_type");
+		const scope = p.get("scope") ?? "";
+		const state = p.get("state");
+		const codeChallenge = p.get("code_challenge");
+		const codeChallengeMethod = p.get("code_challenge_method");
+		const resource = p.get("resource");
+		if (!clientId || !redirectUri || !codeChallenge) return jsonError(400, "invalid_request", "Missing required parameter.");
+		const check = checkOAuthGrant({
+			client: await deps.getClient(ctx, clientId),
+			grantType: "authorization_code",
+			redirectUri,
+			requestedScopes: scope ? scope.split(" ").filter(Boolean) : []
+		});
+		if (!check.ok && check.denial.reason === "client_not_found") return jsonError(401, "invalid_client", "Unknown or inactive client.");
+		if (!check.ok && check.denial.reason === "redirect_uri_mismatch") return jsonError(400, "invalid_request", "redirect_uri mismatch.");
+		if (responseType !== "code") return oauthError(redirectUri, "unsupported_response_type", state);
+		if (codeChallengeMethod !== "S256") return oauthError(redirectUri, "invalid_request", state);
+		if (!check.ok && check.denial.reason === "grant_type_not_allowed") return oauthError(redirectUri, "unauthorized_client", state);
+		if (!check.ok && check.denial.reason === "scope_not_allowed") return oauthError(redirectUri, "invalid_scope", state);
+		if (resource !== null && !isValidResourceIndicator(resource)) return oauthError(redirectUri, "invalid_target", state);
+		const authorizeUrl = new URL(deps.consentPage, deps.authSiteUrl());
+		authorizeUrl.searchParams.set("client_id", clientId);
+		authorizeUrl.searchParams.set("scope", scope);
+		authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+		authorizeUrl.searchParams.set("code_challenge", codeChallenge);
+		authorizeUrl.searchParams.set("code_challenge_method", "S256");
+		if (state) authorizeUrl.searchParams.set("state", state);
+		if (resource !== null) authorizeUrl.searchParams.set("resource", resource);
+		return Response.redirect(authorizeUrl.toString(), 302);
+	};
+}
+
+//#endregion
+export { createAuthorizeHandler };
+//# sourceMappingURL=authorize.js.map

package/dist/server/oauth/client.d.ts

@@ -0,0 +1,93 @@
+import { vOAuthClientDoc } from "../../component/model.js";
+import "../component/api.js";
+import { ComponentCtx, ComponentReadCtx } from "../component/context.js";
+import "../config.js";
+import { Infer } from "convex/values";
+import { PaginationResult } from "convex/server";
+
+//#region src/server/oauth/client.d.ts
+/**
+ * An OAuth client document crossing the component boundary — the single source
+ * of truth is `vOAuthClientDoc`. `clientSecretHash` is present iff the client is
+ * confidential (server-side only).
+ */
+type OAuthClientDoc = Infer<typeof vOAuthClientDoc>;
+/** Token-endpoint auth method stored on a client; `none` marks a public client. */
+type OAuthTokenEndpointAuthMethod = NonNullable<OAuthClientDoc["tokenEndpointAuthMethod"]>;
+/** Fields accepted when registering a client (the `data` payload). */
+type OAuthClientData = {
+  name: string;
+  redirectUris: string[];
+  scopes: string[];
+  grantTypes?: string[];
+  tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+  createdBy?: string;
+  extend?: Record<string, unknown>;
+};
+/** Mutable client metadata replaced by an RFC 7592 `PUT` (none of it secret). */
+type OAuthClientUpdate = {
+  name?: string;
+  redirectUris?: string[];
+  scopes?: string[];
+  grantTypes?: string[];
+  tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+};
+/** Public API surface for the OAuth client sub-domain. */
+interface OAuthClientDomain {
+  /** Register a new OAuth client. Returns the public `clientId`, the one-time
+   *  `clientSecret` (`cs_*`, omitted for public `none` clients), and the
+   *  one-time RFC 7592 `registrationAccessToken` (`reg_*`) used to manage it.
+   *  Store the secrets securely — they cannot be retrieved later. */
+  create(ctx: ComponentCtx, args: {
+    data: OAuthClientData;
+  }): Promise<{
+    clientId: string;
+    clientSecret?: string;
+    registrationAccessToken: string;
+    tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethod;
+  }>;
+  /** Fetch a client by its public `clientId`. Returns `null` if not found. */
+  get(ctx: ComponentReadCtx, args: {
+    clientId: string;
+  }): Promise<OAuthClientDoc | null>;
+  /** Replace a client's mutable registration metadata (RFC 7592 `PUT`). The
+   *  caller is responsible for validating the patch (redirect-uri rules, scope
+   *  clamping) before calling. */
+  update(ctx: ComponentCtx, args: {
+    clientId: string;
+    patch: OAuthClientUpdate;
+  }): Promise<void>;
+  /** Verify an RFC 7592 registration access token against the client named by
+   *  `clientId`. Returns the client doc on a constant-time hash match, else
+   *  `null` (unknown/revoked client, or no/again-mismatched token). */
+  verifyRegistrationToken(ctx: ComponentReadCtx, args: {
+    clientId: string;
+    token: string;
+  }): Promise<OAuthClientDoc | null>;
+  /** List clients, optionally filtered by creator. Excludes revoked by default. */
+  list(ctx: ComponentReadCtx, args?: {
+    where?: {
+      createdBy?: string;
+      includeRevoked?: boolean;
+    };
+    paginationOpts?: {
+      numItems: number;
+      cursor: string | null;
+    };
+  }): Promise<PaginationResult<OAuthClientDoc>>;
+  /** Soft-revoke a client. Revoked clients can no longer obtain tokens. */
+  revoke(ctx: ComponentCtx, args: {
+    clientId: string;
+  }): Promise<{
+    clientId: string;
+  }>;
+  /** Verify a client secret against the stored hash. Returns the client doc
+   *  on success, `null` on mismatch or if the client is revoked. */
+  verify(ctx: ComponentReadCtx, args: {
+    clientId: string;
+    clientSecret: string;
+  }): Promise<OAuthClientDoc | null>;
+}
+//#endregion
+export { OAuthClientDomain };
+//# sourceMappingURL=client.d.ts.map

package/dist/server/oauth/client.js

@@ -0,0 +1,115 @@
+import { constantTimeEqualHex } from "../../shared/compare.js";
+import { cached, invalidateCtxCache } from "../cache/context.js";
+import { generateRandomString } from "../random.js";
+import { emitAuthEvent } from "../events.js";
+import { generateApiKey, hashApiKey } from "../keys.js";
+
+//#region src/server/oauth/client.ts
+const CLIENT_ID_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
+const CLIENT_ID_LENGTH = 24;
+/** @internal */
+function createOAuthClientDomain(deps) {
+	const component = deps.component;
+	return {
+		async create(ctx, { data }) {
+			const clientId = "oc_" + generateRandomString(CLIENT_ID_LENGTH, CLIENT_ID_ALPHABET);
+			const tokenEndpointAuthMethod = data.tokenEndpointAuthMethod ?? "client_secret_post";
+			const secret = tokenEndpointAuthMethod === "none" ? null : await generateApiKey("cs_");
+			const { raw: registrationAccessToken, hashedKey: registrationAccessTokenHash } = await generateApiKey("reg_");
+			await ctx.runMutation(component.oauth.client.create, {
+				clientId,
+				clientSecretHash: secret?.hashedKey,
+				tokenEndpointAuthMethod,
+				registrationAccessTokenHash,
+				name: data.name,
+				redirectUris: data.redirectUris,
+				scopes: data.scopes,
+				grantTypes: data.grantTypes ?? ["authorization_code", "refresh_token"],
+				createdBy: data.createdBy,
+				extend: data.extend
+			});
+			await emitAuthEvent(ctx, deps, {
+				kind: "oauth.client.created",
+				actor: data.createdBy ? {
+					type: "user",
+					id: data.createdBy
+				} : { type: "system" },
+				subject: {
+					type: "oauth_client",
+					id: clientId
+				},
+				targets: [{
+					kind: "oauth_client",
+					id: clientId
+				}, ...data.createdBy ? [{
+					kind: "user",
+					id: data.createdBy
+				}] : []],
+				outcome: "success",
+				data: {
+					clientId,
+					name: data.name,
+					scopes: data.scopes
+				}
+			});
+			return {
+				clientId,
+				clientSecret: secret?.raw,
+				registrationAccessToken,
+				tokenEndpointAuthMethod
+			};
+		},
+		async get(ctx, { clientId }) {
+			return await cached(ctx, `oauth-client:${clientId}`, () => ctx.runQuery(component.oauth.client.get, { clientId }));
+		},
+		async list(ctx, args) {
+			return await ctx.runQuery(component.oauth.client.list, {
+				where: args?.where,
+				paginationOpts: args?.paginationOpts ?? {
+					numItems: 50,
+					cursor: null
+				}
+			});
+		},
+		async revoke(ctx, { clientId }) {
+			await ctx.runMutation(component.oauth.client.revoke, { clientId });
+			invalidateCtxCache(ctx, `oauth-client:${clientId}`);
+			await emitAuthEvent(ctx, deps, {
+				kind: "oauth.client.revoked",
+				actor: { type: "system" },
+				subject: {
+					type: "oauth_client",
+					id: clientId
+				},
+				targets: [{
+					kind: "oauth_client",
+					id: clientId
+				}],
+				outcome: "success",
+				data: { clientId }
+			});
+			return { clientId };
+		},
+		async update(ctx, { clientId, patch }) {
+			await ctx.runMutation(component.oauth.client.update, {
+				clientId,
+				patch
+			});
+			invalidateCtxCache(ctx, `oauth-client:${clientId}`);
+		},
+		async verify(ctx, { clientId, clientSecret }) {
+			const doc = await cached(ctx, `oauth-client:${clientId}`, () => ctx.runQuery(component.oauth.client.get, { clientId }));
+			if (!doc || doc.revoked || doc.tokenEndpointAuthMethod === "none" || !doc.clientSecretHash) return null;
+			return constantTimeEqualHex(await hashApiKey(clientSecret), doc.clientSecretHash) ? doc : null;
+		},
+		async verifyRegistrationToken(ctx, { clientId, token }) {
+			const doc = await cached(ctx, `oauth-client:${clientId}`, () => ctx.runQuery(component.oauth.client.get, { clientId }));
+			if (!doc || doc.revoked || !doc.registrationAccessTokenHash) return null;
+			return constantTimeEqualHex(await hashApiKey(token), doc.registrationAccessTokenHash) ? doc : null;
+		}
+	};
+}
+
+//#endregion
+export { createOAuthClientDomain };
+//# sourceMappingURL=client.js.map

package/dist/server/oauth/code.d.ts

@@ -0,0 +1,63 @@
+import { vOAuthCodeDoc } from "../../component/model.js";
+import { ComponentCtx } from "../component/context.js";
+import { Infer } from "convex/values";
+
+//#region src/server/oauth/code.d.ts
+/**
+ * Stored authorization-code grant consumed at the token endpoint — derived from
+ * `vOAuthCodeDoc` (the single source of truth) so it never drifts from storage.
+ */
+type OAuthCodeRecord = Infer<typeof vOAuthCodeDoc>;
+/** Public API surface for the OAuth authorization-code sub-domain. */
+interface OAuthCodeDomain {
+  /**
+   * Record a user's approval of a client's access request and mint a single-use
+   * authorization code (plain returned, hash stored). Validates the client grant
+   * via the shared {@link checkOAuthGrant} predicate, inserts an `OAuthCode` with
+   * the PKCE challenge and TTL, and emits `oauth.code.created`.
+   *
+   * Call this from an app mutation after confirming the user's intent on the
+   * consent page. `userId` MUST be the authenticated caller resolved via
+   * `ctx.auth.getUserIdentity()` — never a value from request input, or a client
+   * could mint codes for arbitrary users.
+   */
+  authorize(ctx: ComponentCtx, args: {
+    userId: string;
+    clientId: string;
+    scopes: string[];
+    redirectUri: string;
+    codeChallenge: string;
+    resource?: string;
+    state?: string | null;
+  }): Promise<{
+    code: string;
+    redirectUri: string;
+    state?: string | null;
+  }>;
+  /**
+   * Accept (consume) a single-use authorization code by its hash, enforcing the
+   * `clientId`, `redirectUri`, and PKCE `codeChallenge` bindings in-transaction.
+   * Returns the grant, or `null` if the hash is unknown or any binding fails (the
+   * code is NOT burned). Throws `OAUTH_CODE_ALREADY_USED` on replay /
+   * `OAUTH_CODE_EXPIRED` if stale.
+   *
+   * When `refresh` is supplied, its grant + token are minted in the SAME
+   * transaction that consumes the code, so a refresh-creation failure rolls back
+   * the code consumption too (the caller can retry) instead of burning the code
+   * and returning an access token with no refresh token. The caller generates the
+   * refresh secret (CSPRNG requires an action); only its `tokenHash` is passed.
+   */
+  accept(ctx: ComponentCtx, args: {
+    codeHash: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    refresh?: {
+      tokenHash: string;
+      expiresAt: number;
+    };
+  }): Promise<OAuthCodeRecord | null>;
+}
+//#endregion
+export { OAuthCodeDomain };
+//# sourceMappingURL=code.d.ts.map

package/dist/server/oauth/code.js

@@ -0,0 +1,124 @@
+import { ErrorCode } from "../../shared/codes.js";
+import { cached } from "../cache/context.js";
+import { generateRandomString, sha256 } from "../random.js";
+import { emitAuthEvent } from "../events.js";
+import { checkOAuthGrant } from "./grant.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/oauth/code.ts
+const CODE_LENGTH = 32;
+const CODE_ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+const CODE_TTL_MS = 120 * 1e3;
+/** Map a grant denial to a `ConvexError` for the post-consent (mutation) boundary. */
+const GRANT_ERROR = {
+	client_not_found: {
+		code: ErrorCode.OAUTH_CLIENT_NOT_FOUND,
+		message: "Unknown or inactive OAuth client."
+	},
+	redirect_uri_mismatch: {
+		code: ErrorCode.OAUTH_REDIRECT_URI_MISMATCH,
+		message: "redirect_uri not registered for this client."
+	},
+	grant_type_not_allowed: {
+		code: ErrorCode.OAUTH_GRANT_TYPE_NOT_ALLOWED,
+		message: "authorization_code grant is not allowed for this client."
+	},
+	scope_not_allowed: {
+		code: ErrorCode.OAUTH_SCOPE_NOT_ALLOWED,
+		message: "Scope not permitted for this client."
+	}
+};
+function oauthGrantConvexError(denial) {
+	return new ConvexError(GRANT_ERROR[denial.reason]);
+}
+/**
+* Harden the library boundary for {@link OAuthCodeDomain.authorize}: the minted
+* authorization code is bound to `userId`, so that id MUST be the authenticated
+* caller — never a value taken from request input, or a client could mint codes
+* for arbitrary users. Resolve the caller from `ctx.auth.getUserIdentity()` and
+* reject unless its subject matches the passed `userId`.
+*
+* `ComponentCtx` is typed only for `runQuery`/`runMutation`, but the documented
+* caller is an authenticated app mutation whose ctx carries `auth`; so the
+* identity is read defensively. A ctx that exposes no identity capability, an
+* unauthenticated caller, or a subject mismatch all fail closed.
+*/
+async function assertAuthorizeCallerMatchesUser(ctx, userId) {
+	const auth = ctx.auth;
+	const identity = typeof auth?.getUserIdentity === "function" ? await auth.getUserIdentity() : void 0;
+	if (!identity || identity.subject !== userId) throw new ConvexError({
+		code: ErrorCode.NOT_AUTHORIZED,
+		message: "oauth.authorize must be called by the authenticated user it authorizes; resolve `userId` from ctx.auth.getUserIdentity() rather than request input."
+	});
+}
+/** @internal */
+function createOAuthCodeDomain(deps) {
+	const component = deps.component;
+	return {
+		async authorize(ctx, args) {
+			await assertAuthorizeCallerMatchesUser(ctx, args.userId);
+			const check = checkOAuthGrant({
+				client: await cached(ctx, `oauth-client:${args.clientId}`, () => ctx.runQuery(component.oauth.client.get, { clientId: args.clientId })),
+				grantType: "authorization_code",
+				redirectUri: args.redirectUri,
+				requestedScopes: args.scopes
+			});
+			if (!check.ok) throw oauthGrantConvexError(check.denial);
+			const rawCode = generateRandomString(CODE_LENGTH, CODE_ALPHABET);
+			const codeHash = await sha256(rawCode);
+			await ctx.runMutation(component.oauth.code.create, {
+				codeHash,
+				userId: args.userId,
+				clientId: args.clientId,
+				redirectUri: args.redirectUri,
+				scopes: args.scopes,
+				codeChallenge: args.codeChallenge,
+				resource: args.resource,
+				expiresAt: Date.now() + CODE_TTL_MS
+			});
+			await emitAuthEvent(ctx, deps, {
+				kind: "oauth.code.created",
+				actor: {
+					type: "user",
+					id: args.userId
+				},
+				subject: {
+					type: "oauth_code",
+					id: codeHash
+				},
+				targets: [{
+					kind: "oauth_client",
+					id: args.clientId
+				}, {
+					kind: "user",
+					id: args.userId
+				}],
+				outcome: "success",
+				data: {
+					clientId: args.clientId,
+					codeId: codeHash,
+					scopes: args.scopes,
+					redirectUri: args.redirectUri
+				}
+			});
+			return {
+				code: rawCode,
+				redirectUri: args.redirectUri,
+				state: args.state
+			};
+		},
+		async accept(ctx, { codeHash, clientId, redirectUri, codeChallenge, refresh }) {
+			return await ctx.runMutation(component.oauth.code.accept, {
+				codeHash,
+				clientId,
+				redirectUri,
+				codeChallenge,
+				...refresh === void 0 ? {} : { refresh }
+			});
+		}
+	};
+}
+
+//#endregion
+export { createOAuthCodeDomain };
+//# sourceMappingURL=code.js.map

package/dist/server/oauth/domain.d.ts

@@ -0,0 +1,23 @@
+import { OAuthClientDomain } from "./client.js";
+import { OAuthCodeDomain } from "./code.js";
+import { OAuthRefreshDomain } from "./refresh.js";
+
+//#region src/server/oauth/domain.d.ts
+/**
+ * The full `auth.oauth` runtime surface (app-as-IdP; LEXICON §8a). Pins every
+ * namespace to its domain interface, the way `connection`/`event` are pinned in
+ * the auth runtime, so the surface is documented in one place and never drifts.
+ */
+interface OAuthRuntimeDomain {
+  /** OAuth client registry: `create`/`get`/`list`/`revoke`/`verify`. */
+  client: OAuthClientDomain;
+  /** Authorization-code lifecycle: `authorize` (mint) + `accept` (consume). */
+  code: OAuthCodeDomain;
+  /** Rotating refresh tokens: `create`/`exchange`/`revoke`. */
+  refresh: OAuthRefreshDomain;
+  /** Consent shortcut — alias of `code.authorize`; preserves `auth.oauth.authorize(ctx, …)`. */
+  authorize: OAuthCodeDomain["authorize"];
+}
+//#endregion
+export { OAuthRuntimeDomain };
+//# sourceMappingURL=domain.d.ts.map

package/dist/server/oauth/domain.js

@@ -0,0 +1 @@
+export {  };

package/dist/server/oauth/factory.js

@@ -0,0 +1,46 @@
+import { normalizeOAuthTokenResponse } from "./normalize.js";
+
+//#region src/server/oauth/factory.ts
+function normalizeTokens(tokens) {
+	return normalizeOAuthTokenResponse(tokens.data);
+}
+function createArcticOAuthClient(provider, options) {
+	const getProvider = (redirectUri) => typeof provider === "function" ? provider(redirectUri) : provider;
+	const pkce = options?.pkce ?? (getProvider().createAuthorizationURL.length >= 3 ? "required" : "never");
+	return {
+		pkce,
+		createAuthorizationURL({ state, codeVerifier, scopes, nonce, redirectUri }) {
+			const provider$1 = getProvider(redirectUri);
+			const url = pkce !== "never" ? provider$1.createAuthorizationURL(state, codeVerifier, scopes) : provider$1.createAuthorizationURL(state, scopes);
+			if (nonce !== void 0) url.searchParams.set("nonce", nonce);
+			return url;
+		},
+		async validateAuthorizationCode({ code, codeVerifier, redirectUri }) {
+			const provider$1 = getProvider(redirectUri);
+			return normalizeTokens(pkce !== "never" ? await provider$1.validateAuthorizationCode(code, codeVerifier) : await provider$1.validateAuthorizationCode(code));
+		}
+	};
+}
+/**
+* Materialize a validated OAuth provider definition for internal auth runtime use.
+*
+* @internal
+*/
+function createOAuthProvider(config) {
+	if (!config.provider || typeof config.provider.createAuthorizationURL !== "function" || typeof config.provider.validateAuthorizationCode !== "function") throw new Error(`OAuth provider "${config.id}" must expose createAuthorizationURL() and validateAuthorizationCode().`);
+	return {
+		id: config.id,
+		type: "oauth",
+		provider: config.provider,
+		scopes: [...config.scopes],
+		profile: config.profile,
+		nonce: config.nonce,
+		validateTokens: config.validateTokens,
+		accountLinking: config.accountLinking,
+		updateProfileOnLogin: config.updateProfileOnLogin
+	};
+}
+
+//#endregion
+export { createArcticOAuthClient, createOAuthProvider };
+//# sourceMappingURL=factory.js.map

package/dist/server/oauth/grant.js

@@ -0,0 +1,46 @@
+//#region src/server/oauth/grant.ts
+/**
+* The single source of truth for "client active, redirect_uri registered, grant
+* type allowed, requested scopes ⊆ client.scopes". Pure — the caller loads
+* `client` through its own trust path (cached `getClient`, or `verifyClientSecret`)
+* and formats `denial` per its boundary; the security checks are NOT collapsed,
+* only the duplicated predicate.
+*
+* Check order is fixed (client → redirect_uri → grant_type → scope), matching
+* what all three call sites already do. `redirectUri` is omitted for grants
+* without a redirect (`client_credentials`). On success, `scopes` is the
+* resolved effective set: the requested scopes, or — when `requestedScopes` is
+* empty and `grantType` is `client_credentials` — the client's full set.
+*/
+function checkOAuthGrant(args) {
+	const { client, grantType, redirectUri, requestedScopes } = args;
+	if (!client || client.revoked) return {
+		ok: false,
+		denial: { reason: "client_not_found" }
+	};
+	if (redirectUri !== void 0 && !client.redirectUris.includes(redirectUri)) return {
+		ok: false,
+		denial: { reason: "redirect_uri_mismatch" }
+	};
+	if (!client.grantTypes.includes(grantType)) return {
+		ok: false,
+		denial: { reason: "grant_type_not_allowed" }
+	};
+	const disallowed = requestedScopes.filter((s) => !client.scopes.includes(s));
+	if (disallowed.length > 0) return {
+		ok: false,
+		denial: {
+			reason: "scope_not_allowed",
+			disallowed
+		}
+	};
+	return {
+		ok: true,
+		client,
+		scopes: requestedScopes.length > 0 ? requestedScopes : grantType === "client_credentials" ? client.scopes : requestedScopes
+	};
+}
+
+//#endregion
+export { checkOAuthGrant };
+//# sourceMappingURL=grant.js.map