@frigear-nu/oauth-server 0.0.0-stage → 0.0.2

package/dist/runtime/server/db/schema.sqlite.js

@@ -0,0 +1,60 @@
+import { sqliteTable, text, integer, index } from "drizzle-orm/sqlite-core";
+export const oauthApplications = sqliteTable("oauth_applications", {
+  /** `app_` + random id; it is the OAuth `client_id`. */
+  id: text().primaryKey(),
+  /** SHA-256 hex of the client secret. The secret itself is only shown once. */
+  secretHash: text().notNull(),
+  name: text().notNull(),
+  description: text(),
+  icon: text(),
+  priority: integer().notNull().default(0),
+  /** Origin of the application, no path. The redirect URI is derived from it. */
+  websiteUrl: text().notNull(),
+  /** Where "open application" links go; defaults to the website URL. */
+  loginUrl: text(),
+  /** e.g. `https://*.vercel.app`: preview deployments that may use the callback too. */
+  previewUrlPattern: text(),
+  /** Extra exact redirect URIs. */
+  redirectUris: text({ mode: "json" }).$type().notNull().$defaultFn(() => []),
+  /** Roles allowed to sign in. Empty = every signed-in user. Roles are resolved by the host (`oauth:user:roles`). */
+  allowedRoles: text({ mode: "json" }).$type().notNull().$defaultFn(() => []),
+  tags: text({ mode: "json" }).$type().notNull().$defaultFn(() => []),
+  ownerId: integer(),
+  isActive: integer({ mode: "boolean" }).notNull().default(true),
+  createdAt: integer({ mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  updatedAt: integer({ mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()).$onUpdateFn(() => /* @__PURE__ */ new Date())
+}, (t) => [
+  index("oauth_application_active_idx").on(t.isActive, t.priority)
+]);
+export const oauthAuthorizationCodes = sqliteTable("oauth_authorization_codes", {
+  codeHash: text().primaryKey(),
+  applicationId: text().notNull().references(() => oauthApplications.id, { onDelete: "cascade" }),
+  userId: integer().notNull(),
+  redirectUri: text().notNull(),
+  scope: text().notNull(),
+  codeChallenge: text().notNull(),
+  nonce: text(),
+  /** When the user signed in / approved; becomes `auth_time` in the ID token. */
+  authTime: integer({ mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  expiresAt: integer({ mode: "timestamp" }).notNull()
+}, (t) => [
+  index("oauth_code_application_idx").on(t.applicationId)
+]);
+export const oauthRefreshTokens = sqliteTable("oauth_refresh_tokens", {
+  id: text().primaryKey(),
+  tokenHash: text().notNull().unique(),
+  applicationId: text().notNull().references(() => oauthApplications.id, { onDelete: "cascade" }),
+  userId: integer().notNull(),
+  scope: text().notNull(),
+  /** Shared by every token of one authorization, so a reuse can revoke them all. */
+  familyId: text().notNull(),
+  /** Id of the token that replaced this one when it was rotated. */
+  replacedBy: text(),
+  authTime: integer({ mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  expiresAt: integer({ mode: "timestamp" }).notNull(),
+  revokedAt: integer({ mode: "timestamp" }),
+  createdAt: integer({ mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (t) => [
+  index("oauth_refresh_user_idx").on(t.userId, t.applicationId),
+  index("oauth_refresh_family_idx").on(t.familyId)
+]);

package/dist/runtime/server/routes/api/admin/application-revoke.post.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/api/admin/application-revoke.post.js

@@ -0,0 +1,7 @@
+export default defineEventHandler(async (event) => {
+  await requireOAuthAdmin(event);
+  const id = getRouterParam(event, "id") ?? "";
+  if (!await getApplication(id)) throw createError({ statusCode: 404, statusMessage: "Application not found." });
+  await revokeApplicationGrants(id);
+  return { revoked: true };
+});

package/dist/runtime/server/routes/api/admin/application-secret.post.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/api/admin/application-secret.post.js

@@ -0,0 +1,5 @@
+export default defineEventHandler(async (event) => {
+  await requireOAuthAdmin(event);
+  const { secret } = await rotateApplicationSecret(getRouterParam(event, "id") ?? "");
+  return { clientSecret: secret };
+});

package/dist/runtime/server/routes/api/admin/application.delete.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/api/admin/application.delete.js

@@ -0,0 +1,6 @@
+export default defineEventHandler(async (event) => {
+  await requireOAuthAdmin(event);
+  await deleteApplication(getRouterParam(event, "id") ?? "");
+  setResponseStatus(event, 204);
+  return null;
+});

package/dist/runtime/server/routes/api/admin/application.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/api/admin/application.get.js

@@ -0,0 +1,6 @@
+export default defineEventHandler(async (event) => {
+  await requireOAuthAdmin(event);
+  const application = await getApplication(getRouterParam(event, "id") ?? "");
+  if (!application) throw createError({ statusCode: 404, statusMessage: "Application not found." });
+  return { ...application, callbackUrl: `${application.websiteUrl}${useOAuthConfig().callbackPath}` };
+});

package/dist/runtime/server/routes/api/admin/application.patch.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/api/admin/application.patch.js

@@ -0,0 +1,9 @@
+import { applicationPatchSchema } from "../../../utils/oauth-applications.js";
+export default defineEventHandler(async (event) => {
+  await requireOAuthAdmin(event);
+  const id = getRouterParam(event, "id") ?? "";
+  const patch = await readValidatedBody(event, applicationPatchSchema.parse);
+  const application = await updateApplication(id, patch);
+  if (patch.isActive === false) await revokeApplicationGrants(id);
+  return application;
+});

package/dist/runtime/server/routes/api/admin/applications.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/api/admin/applications.get.js

@@ -0,0 +1,11 @@
+export default defineEventHandler(async (event) => {
+  await requireOAuthAdmin(event);
+  const applications = await listApplications();
+  const grants = await countActiveGrants(applications.map((application) => application.id));
+  return applications.map((application) => ({
+    ...application,
+    activeGrants: grants[application.id] ?? 0,
+    // The redirect URI applications have to register on their side.
+    callbackUrl: `${application.websiteUrl}${useOAuthConfig().callbackPath}`
+  }));
+});

package/dist/runtime/server/routes/api/admin/applications.post.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/api/admin/applications.post.js

@@ -0,0 +1,8 @@
+import { applicationInputSchema } from "../../../utils/oauth-applications.js";
+export default defineEventHandler(async (event) => {
+  const { userId } = await requireOAuthAdmin(event);
+  const input = await readValidatedBody(event, applicationInputSchema.parse);
+  const { application, secret } = await createApplication(input, userId);
+  setResponseStatus(event, 201);
+  return { ...application, clientId: application.id, clientSecret: secret };
+});

package/dist/runtime/server/routes/api/consent.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/api/consent.get.js

@@ -0,0 +1,19 @@
+import { getQuery } from "h3";
+export default defineEventHandler(async (event) => {
+  const userId = await requireSessionUserId(event);
+  const { application, scope } = await validateAuthorizeRequest(getQuery(event));
+  const user = await getOAuthUser(userId);
+  if (!user) throw createError({ statusCode: 401, statusMessage: "Unknown user." });
+  await assertApplicationAccess(event, user, application);
+  return {
+    application: {
+      id: application.id,
+      name: application.name,
+      description: application.description,
+      icon: application.icon,
+      websiteUrl: application.websiteUrl
+    },
+    scope,
+    user: { name: user.name, email: user.email, avatar: user.avatar }
+  };
+});

package/dist/runtime/server/routes/api/me-applications.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/api/me-applications.get.js

@@ -0,0 +1,4 @@
+export default defineEventHandler(async (event) => {
+  const userId = await requireSessionUserId(event);
+  return listUserApplications(userId, event);
+});

package/dist/runtime/server/routes/oidc/authorize.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/oidc/authorize.get.js

@@ -0,0 +1,15 @@
+import { getQuery, getRequestURL, sendRedirect } from "h3";
+export default defineEventHandler(async (event) => {
+  const query = getQuery(event);
+  const { application } = await validateAuthorizeRequest(query);
+  const session = await getUserSession(event);
+  if (!session.user) {
+    const url2 = getRequestURL(event);
+    return sendRedirect(event, `${getSignInPath()}?redirect=${encodeURIComponent(`${url2.pathname}${url2.search}`)}`, 302);
+  }
+  const user = await getOAuthUser(Number(session.user.id));
+  if (!user) throw createError({ statusCode: 401, statusMessage: "Unknown user." });
+  await assertApplicationAccess(event, user, application);
+  const url = getRequestURL(event);
+  return sendRedirect(event, `${useOAuthConfig().authorizePath}${url.search}`, 302);
+});

package/dist/runtime/server/routes/oidc/authorize.post.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/oidc/authorize.post.js

@@ -0,0 +1,27 @@
+import { z } from "zod";
+import { authorizeRequestSchema } from "../../utils/oauth-authorize.js";
+const bodySchema = authorizeRequestSchema.extend({ approved: z.boolean() });
+export default defineEventHandler(async (event) => {
+  const userId = await requireSessionUserId(event);
+  const { approved, ...params } = await readValidatedBody(event, bodySchema.parse);
+  const { request, application, scope } = await validateAuthorizeRequest(params);
+  const redirect = new URL(request.redirect_uri);
+  redirect.searchParams.set("state", request.state);
+  if (!approved) {
+    redirect.searchParams.set("error", "access_denied");
+    return { redirectUrl: redirect.toString() };
+  }
+  const user = await getOAuthUser(userId);
+  if (!user) throw createError({ statusCode: 401, statusMessage: "Unknown user." });
+  await assertApplicationAccess(event, user, application);
+  const code = await createAuthorizationCode({
+    application,
+    userId,
+    redirectUri: request.redirect_uri,
+    scope,
+    codeChallenge: request.code_challenge,
+    nonce: request.nonce
+  });
+  redirect.searchParams.set("code", code);
+  return { redirectUrl: redirect.toString() };
+});

package/dist/runtime/server/routes/oidc/jwks.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/oidc/jwks.get.js

@@ -0,0 +1,4 @@
+export default defineEventHandler(async (event) => {
+  setResponseHeader(event, "Cache-Control", "public, max-age=300");
+  return getJwks();
+});

package/dist/runtime/server/routes/oidc/openid-configuration.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/oidc/openid-configuration.get.js

@@ -0,0 +1,21 @@
+export default defineEventHandler((event) => {
+  const issuer = getOAuthIssuer(event);
+  setResponseHeader(event, "Cache-Control", "public, max-age=3600");
+  return {
+    issuer,
+    authorization_endpoint: `${issuer}/oauth/authorize`,
+    token_endpoint: `${issuer}/oauth/token`,
+    userinfo_endpoint: `${issuer}/oauth/userinfo`,
+    revocation_endpoint: `${issuer}/oauth/revoke`,
+    jwks_uri: `${issuer}/.well-known/jwks.json`,
+    response_types_supported: ["code"],
+    response_modes_supported: ["query"],
+    grant_types_supported: ["authorization_code", "refresh_token"],
+    subject_types_supported: ["public"],
+    id_token_signing_alg_values_supported: ["RS256"],
+    scopes_supported: getSupportedScopes(),
+    token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
+    code_challenge_methods_supported: ["S256"],
+    claims_supported: ["sub", "iss", "aud", "exp", "iat", "auth_time", "nonce", "name", "picture", "email"]
+  };
+});

package/dist/runtime/server/routes/oidc/revoke.post.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/oidc/revoke.post.js

@@ -0,0 +1,13 @@
+import { readBody } from "h3";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event).catch(() => void 0);
+  const credentials = readClientCredentials(event, body);
+  const row = credentials ? await getApplicationRow(credentials.clientId) : null;
+  if (!credentials || !row || !await verifyApplicationSecret(row, credentials.clientSecret)) {
+    if (credentials?.basic) setResponseHeader(event, "WWW-Authenticate", "Basic");
+    return oauthError(event, 401, "invalid_client", "Client authentication failed.");
+  }
+  if (typeof body?.token === "string") await revokeRefreshToken(body.token, row.id);
+  setResponseStatus(event, 200);
+  return {};
+});

package/dist/runtime/server/routes/oidc/token.post.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/oidc/token.post.js

@@ -0,0 +1,56 @@
+import { readBody } from "h3";
+export default defineEventHandler(async (event) => {
+  setResponseHeader(event, "Cache-Control", "no-store");
+  setResponseHeader(event, "Pragma", "no-cache");
+  const body = await readBody(event).catch(() => void 0);
+  const credentials = readClientCredentials(event, body);
+  const row = credentials ? await getApplicationRow(credentials.clientId) : null;
+  if (!credentials || !row || !await verifyApplicationSecret(row, credentials.clientSecret)) {
+    if (credentials?.basic) setResponseHeader(event, "WWW-Authenticate", "Basic");
+    return oauthError(event, 401, "invalid_client", "Client authentication failed.");
+  }
+  const application = toApplication(row);
+  const grantType = body?.grant_type;
+  let grant;
+  let refreshToken;
+  if (grantType === "authorization_code") {
+    const { code, redirect_uri: redirectUri, code_verifier: codeVerifier } = body;
+    if (typeof code !== "string" || typeof redirectUri !== "string" || typeof codeVerifier !== "string") {
+      return oauthError(event, 400, "invalid_request", "code, redirect_uri and code_verifier are required.");
+    }
+    const result = await exchangeAuthorizationCode({ code, application, redirectUri, codeVerifier });
+    if ("error" in result) return oauthError(event, 400, "invalid_grant", result.error);
+    grant = result.grant;
+    refreshToken = (await createRefreshToken({ applicationId: application.id, ...grant })).token;
+  } else if (grantType === "refresh_token") {
+    if (typeof body?.refresh_token !== "string") return oauthError(event, 400, "invalid_request", "refresh_token is required.");
+    const result = await rotateRefreshToken({ token: body.refresh_token, application });
+    if ("error" in result) return oauthError(event, 400, "invalid_grant", result.error);
+    grant = result.grant;
+    refreshToken = result.token;
+  } else {
+    return oauthError(event, 400, "unsupported_grant_type", "Supported grants: authorization_code, refresh_token.");
+  }
+  const user = await getOAuthUser(grant.userId);
+  if (!user) return oauthError(event, 400, "invalid_grant", "The user no longer exists.");
+  const access = await checkApplicationAccess(user, application, event);
+  if (!access.allowed) return oauthError(event, 400, "access_denied", access.reason);
+  const input = { event, user, application, scope: grant.scope, roles: access.roles };
+  const response = {
+    access_token: await signAccessToken(input),
+    token_type: "Bearer",
+    expires_in: useOAuthConfig().accessTokenTtl,
+    refresh_token: refreshToken,
+    scope: grant.scope.join(" ")
+  };
+  if (grant.scope.includes("openid")) {
+    response.id_token = await signIdToken({ ...input, nonce: grant.nonce, authTime: grant.authTime });
+  }
+  await useNitroApp().hooks.callHook("oauth:token:issued", {
+    userId: user.id,
+    applicationId: application.id,
+    scope: grant.scope,
+    grant: grantType
+  });
+  return response;
+});

package/dist/runtime/server/routes/oidc/userinfo.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/oidc/userinfo.get.js

@@ -0,0 +1,18 @@
+export default defineEventHandler(async (event) => {
+  setResponseHeader(event, "Cache-Control", "no-store");
+  const header = getHeader(event, "authorization");
+  const token = header?.toLowerCase().startsWith("bearer ") ? header.slice(7).trim() : "";
+  const payload = token ? await verifyAccessToken(event, token) : null;
+  if (!payload) {
+    setResponseHeader(event, "WWW-Authenticate", 'Bearer error="invalid_token"');
+    return oauthError(event, 401, "invalid_token", "The access token is missing, invalid or expired.");
+  }
+  const application = await getApplication(payload.client_id);
+  const user = await getOAuthUser(Number(payload.sub));
+  if (!application || !user) return oauthError(event, 401, "invalid_token", "The access token is no longer valid.");
+  const access = await checkApplicationAccess(user, application, event);
+  if (!access.allowed) return oauthError(event, 403, "access_denied", access.reason);
+  const scope = payload.scope.split(" ").filter(Boolean);
+  const claims = await buildClaims({ user, application, scope, roles: access.roles, tokenType: "userinfo" });
+  return { sub: String(user.id), ...claims };
+});

package/dist/runtime/server/utils/oauth-access.d.ts

@@ -0,0 +1,34 @@
+import type { H3Event } from 'h3';
+import type { OAuthApplication, OAuthUser, TokenType } from '../../../types.js';
+/**
+ * Gate for the admin routes. This repo has no shared permission system, so the host decides through
+ * the `oauth:authorize` Nitro hook. Denied by default:
+ *
+ *     nitroApp.hooks.hook('oauth:authorize', (ctx) => { ctx.allowed = isStaff(ctx.userId) })
+ */
+export declare function requireOAuthAdmin(event: H3Event): Promise<{
+    userId: number;
+}>;
+/** The user's roles as reported by the `oauth:user:roles` hook listeners (none without a listener). */
+export declare function resolveUserRoles(userId: number, event?: H3Event): Promise<string[]>;
+/** The user row without the password hash; includes columns the host added to `users`. */
+export declare function getOAuthUser(userId: number): Promise<OAuthUser | null>;
+export type ApplicationAccess = {
+    allowed: boolean;
+    reason?: string;
+    roles: string[];
+};
+/** Active, role allowed and not vetoed through `oauth:application:access`. */
+export declare function checkApplicationAccess(user: OAuthUser, application: OAuthApplication, event?: H3Event): Promise<ApplicationAccess>;
+export declare function userCanAccessApplication(userId: number, application: OAuthApplication, event?: H3Event): Promise<boolean>;
+/**
+ * Builds the claims for a token: standard profile claims by scope, then the `oauth:claims` hook so the
+ * host can add or change anything. Registered claims are re-applied by the signer afterwards.
+ */
+export declare function buildClaims(input: {
+    user: OAuthUser;
+    application: OAuthApplication;
+    scope: string[];
+    roles: string[];
+    tokenType: TokenType;
+}): Promise<Record<string, unknown>>;

package/dist/runtime/server/utils/oauth-access.js

@@ -0,0 +1,49 @@
+import { eq } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+import { matchesAllowedRoles } from "../../utils/index.js";
+export async function requireOAuthAdmin(event) {
+  const userId = await requireSessionUserId(event);
+  const ctx = { event, userId, allowed: false };
+  await useNitroApp().hooks.callHook("oauth:authorize", ctx);
+  if (!ctx.allowed) throw createError({ statusCode: 403, statusMessage: "You are not allowed to manage OAuth applications." });
+  return { userId };
+}
+export async function resolveUserRoles(userId, event) {
+  const ctx = { event, userId, roles: [] };
+  await useNitroApp().hooks.callHook("oauth:user:roles", ctx);
+  return [...new Set(ctx.roles)];
+}
+export async function getOAuthUser(userId) {
+  const [row] = await db.select().from(schema.users).where(eq(schema.users.id, userId)).limit(1);
+  if (!row) return null;
+  const { password: _password, ...user } = row;
+  return user;
+}
+export async function checkApplicationAccess(user, application, event) {
+  const roles = await resolveUserRoles(user.id, event);
+  if (!application.isActive) return { allowed: false, reason: "This application is disabled.", roles };
+  if (!matchesAllowedRoles(application.allowedRoles, roles)) {
+    return { allowed: false, reason: "You do not have permission to access this application.", roles };
+  }
+  const ctx = { event, user, application, roles, allowed: true };
+  await useNitroApp().hooks.callHook("oauth:application:access", ctx);
+  return ctx.allowed ? { allowed: true, roles } : { allowed: false, reason: ctx.reason || "Access to this application was denied.", roles };
+}
+export async function userCanAccessApplication(userId, application, event) {
+  const user = await getOAuthUser(userId);
+  return user ? (await checkApplicationAccess(user, application, event)).allowed : false;
+}
+const RESERVED_CLAIMS = ["iss", "sub", "aud", "exp", "iat", "nbf", "jti", "nonce", "auth_time", "scope", "client_id"];
+export async function buildClaims(input) {
+  const claims = {};
+  if (input.tokenType !== "access_token") {
+    if (input.scope.includes("profile")) {
+      claims.name = input.user.name;
+      if (input.user.avatar) claims.picture = input.user.avatar;
+    }
+    if (input.scope.includes("email")) claims.email = input.user.email;
+  }
+  const ctx = { ...input, claims };
+  await useNitroApp().hooks.callHook("oauth:claims", ctx);
+  return Object.fromEntries(Object.entries(ctx.claims).filter(([name]) => !RESERVED_CLAIMS.includes(name)));
+}

package/dist/runtime/server/utils/oauth-applications.d.ts

@@ -0,0 +1,65 @@
+import { schema } from '@nuxthub/db';
+import { z } from 'zod';
+import type { H3Event } from 'h3';
+import type { ApplicationInput, OAuthApplication, UserApplicationDto } from '../../../types.js';
+type ApplicationRow = typeof schema.oauthApplications.$inferSelect;
+/** Validation shared by the admin API and `createApplication` / `updateApplication`. */
+export declare const applicationInputSchema: z.ZodObject<{
+    name: z.ZodString;
+    websiteUrl: z.ZodString;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    icon: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    loginUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    previewUrlPattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    redirectUris: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    allowedRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    isActive: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const applicationPatchSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    websiteUrl: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    icon: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    priority: z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
+    loginUrl: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    previewUrlPattern: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    redirectUris: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+    allowedRoles: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+    tags: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+    isActive: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+}, z.core.$strip>;
+export declare function toApplication(row: ApplicationRow): OAuthApplication;
+/** The row including `secretHash`; only for credential checks. Use `getApplication` everywhere else. */
+export declare function getApplicationRow(id: string): Promise<ApplicationRow | null>;
+export declare function getApplication(id: string): Promise<OAuthApplication | null>;
+export declare function listApplications(): Promise<OAuthApplication[]>;
+/** Creates an application. The returned `secret` is the only time the plain secret is available. */
+export declare function createApplication(input: ApplicationInput, ownerId?: number | null): Promise<{
+    application: OAuthApplication;
+    secret: string;
+}>;
+export declare function updateApplication(id: string, patch: Partial<ApplicationInput>): Promise<OAuthApplication>;
+/** Deletes the application with its authorization codes and refresh tokens. */
+export declare function deleteApplication(id: string): Promise<void>;
+/** Replaces the client secret and revokes the refresh tokens issued with the old one. */
+export declare function rotateApplicationSecret(id: string): Promise<{
+    secret: string;
+}>;
+export declare function verifyApplicationSecret(row: ApplicationRow, secret: string): Promise<boolean>;
+/** Revokes every refresh token of an application (e.g. after a secret leak). */
+export declare function revokeApplicationGrants(applicationId: string): Promise<void>;
+/**
+ * Revokes a user's refresh tokens, for one application or all of them. Call it when a user is
+ * deactivated or loses a role; already issued access tokens stay valid until they expire.
+ */
+export declare function revokeUserGrants(userId: number, applicationId?: string): Promise<void>;
+/**
+ * The active applications a user may sign in to (role check through `oauth:user:roles`), highest
+ * priority first. Applications with a `loginUrl` link there, the others to their website.
+ */
+export declare function listUserApplications(userId: number, event?: H3Event): Promise<UserApplicationDto[]>;
+/** Counts the refresh tokens still valid per application (admin overview). */
+export declare function countActiveGrants(applicationIds: string[]): Promise<Record<string, number>>;
+export {};