@frigear-nu/oauth-server 0.0.0-stage → 0.0.3

package/dist/runtime/server/utils/oauth-applications.js

@@ -0,0 +1,126 @@
+import { and, desc, eq, inArray } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+import { z } from "zod";
+import { isSecureOrigin, matchesAllowedRoles, newId, normalizeWebsiteUrl } from "../../utils/index.js";
+const fail = (statusCode, statusMessage) => createError({ statusCode, statusMessage });
+const httpsUrl = z.string().trim().max(2048).refine((value) => {
+  try {
+    return isSecureOrigin(new URL(value));
+  } catch {
+    return false;
+  }
+}, "Must be a https URL (http is only allowed for localhost).");
+const names = z.array(z.string().trim().min(1).max(64)).max(50);
+export const applicationInputSchema = z.object({
+  name: z.string().trim().min(1).max(120),
+  websiteUrl: z.string().trim().max(2048),
+  description: z.string().trim().max(1e3).nullish(),
+  icon: z.string().trim().max(120).nullish(),
+  priority: z.number().int().min(-1e3).max(1e3).optional(),
+  loginUrl: httpsUrl.nullish(),
+  previewUrlPattern: z.string().trim().max(2048).startsWith("https://").nullish(),
+  redirectUris: z.array(httpsUrl).max(20).optional(),
+  allowedRoles: names.optional(),
+  tags: names.optional(),
+  isActive: z.boolean().optional()
+});
+export const applicationPatchSchema = applicationInputSchema.partial();
+export function toApplication(row) {
+  const { secretHash: _secretHash, ...application } = row;
+  return application;
+}
+function normalizeInput(input) {
+  const next = { ...input };
+  if (next.websiteUrl !== void 0) {
+    try {
+      next.websiteUrl = normalizeWebsiteUrl(next.websiteUrl);
+    } catch (error) {
+      throw fail(400, error.message);
+    }
+  }
+  if (next.allowedRoles) next.allowedRoles = [...new Set(next.allowedRoles)].sort();
+  if (next.tags) next.tags = [...new Set(next.tags)];
+  return next;
+}
+export async function getApplicationRow(id) {
+  const [row] = await db.select().from(schema.oauthApplications).where(eq(schema.oauthApplications.id, id)).limit(1);
+  return row ?? null;
+}
+export async function getApplication(id) {
+  const row = await getApplicationRow(id);
+  return row ? toApplication(row) : null;
+}
+export async function listApplications() {
+  const rows = await db.select().from(schema.oauthApplications).orderBy(desc(schema.oauthApplications.priority), schema.oauthApplications.name);
+  return rows.map(toApplication);
+}
+export async function createApplication(input, ownerId) {
+  const data = normalizeInput(applicationInputSchema.parse(input));
+  const secret = generateSecret();
+  const [row] = await db.insert(schema.oauthApplications).values({
+    id: newId("app"),
+    secretHash: await sha256Hex(secret),
+    ownerId: ownerId ?? null,
+    ...data
+  }).returning();
+  return { application: toApplication(row), secret };
+}
+export async function updateApplication(id, patch) {
+  const data = normalizeInput(applicationPatchSchema.parse(patch));
+  const [row] = Object.keys(data).length ? await db.update(schema.oauthApplications).set(data).where(eq(schema.oauthApplications.id, id)).returning() : [await getApplicationRow(id)];
+  if (!row) throw fail(404, "Application not found.");
+  return toApplication(row);
+}
+export async function deleteApplication(id) {
+  await db.delete(schema.oauthRefreshTokens).where(eq(schema.oauthRefreshTokens.applicationId, id));
+  await db.delete(schema.oauthAuthorizationCodes).where(eq(schema.oauthAuthorizationCodes.applicationId, id));
+  const deleted = await db.delete(schema.oauthApplications).where(eq(schema.oauthApplications.id, id)).returning({ id: schema.oauthApplications.id });
+  if (!deleted.length) throw fail(404, "Application not found.");
+}
+export async function rotateApplicationSecret(id) {
+  const secret = generateSecret();
+  const updated = await db.update(schema.oauthApplications).set({ secretHash: await sha256Hex(secret) }).where(eq(schema.oauthApplications.id, id)).returning({ id: schema.oauthApplications.id });
+  if (!updated.length) throw fail(404, "Application not found.");
+  await revokeApplicationGrants(id);
+  return { secret };
+}
+export async function verifyApplicationSecret(row, secret) {
+  return safeEqual(await sha256Hex(secret), row.secretHash);
+}
+export async function revokeApplicationGrants(applicationId) {
+  await db.update(schema.oauthRefreshTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(eq(schema.oauthRefreshTokens.applicationId, applicationId));
+  await useNitroApp().hooks.callHook("oauth:token:revoked", { applicationId, userId: null, reason: "revoked" });
+}
+export async function revokeUserGrants(userId, applicationId) {
+  const where = applicationId ? and(eq(schema.oauthRefreshTokens.userId, userId), eq(schema.oauthRefreshTokens.applicationId, applicationId)) : eq(schema.oauthRefreshTokens.userId, userId);
+  const revoked = await db.update(schema.oauthRefreshTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(where).returning({ applicationId: schema.oauthRefreshTokens.applicationId });
+  const hooks = useNitroApp().hooks;
+  for (const id of new Set(revoked.map((row) => row.applicationId))) {
+    await hooks.callHook("oauth:token:revoked", { applicationId: id, userId, reason: "user_grants_revoked" });
+  }
+  await db.delete(schema.oauthAuthorizationCodes).where(applicationId ? and(eq(schema.oauthAuthorizationCodes.userId, userId), eq(schema.oauthAuthorizationCodes.applicationId, applicationId)) : eq(schema.oauthAuthorizationCodes.userId, userId));
+}
+export async function listUserApplications(userId, event) {
+  const roles = await resolveUserRoles(userId, event);
+  const rows = await db.select().from(schema.oauthApplications).where(eq(schema.oauthApplications.isActive, true)).orderBy(desc(schema.oauthApplications.priority), schema.oauthApplications.name);
+  return rows.filter((row) => matchesAllowedRoles(row.allowedRoles, roles)).map((row) => ({
+    id: row.id,
+    name: row.name,
+    description: row.description,
+    icon: row.icon,
+    priority: row.priority,
+    websiteUrl: row.websiteUrl,
+    tags: row.tags,
+    loginUrl: row.loginUrl || row.websiteUrl
+  }));
+}
+export async function countActiveGrants(applicationIds) {
+  if (!applicationIds.length) return {};
+  const rows = await db.select({ applicationId: schema.oauthRefreshTokens.applicationId, revokedAt: schema.oauthRefreshTokens.revokedAt, expiresAt: schema.oauthRefreshTokens.expiresAt }).from(schema.oauthRefreshTokens).where(inArray(schema.oauthRefreshTokens.applicationId, applicationIds));
+  const now = Date.now();
+  const counts = {};
+  for (const row of rows) {
+    if (!row.revokedAt && row.expiresAt.getTime() > now) counts[row.applicationId] = (counts[row.applicationId] ?? 0) + 1;
+  }
+  return counts;
+}

package/dist/runtime/server/utils/oauth-authorize.d.ts

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+import type { H3Event } from 'h3';
+import type { OAuthApplication, OAuthUser } from '../../../types.js';
+/** The authorization request parameters (query on GET, body on POST). */
+export declare const authorizeRequestSchema: z.ZodObject<{
+    client_id: z.ZodString;
+    redirect_uri: z.ZodString;
+    response_type: z.ZodLiteral<"code">;
+    state: z.ZodString;
+    code_challenge: z.ZodString;
+    code_challenge_method: z.ZodLiteral<"S256">;
+    scope: z.ZodOptional<z.ZodString>;
+    nonce: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuthorizeRequest = z.infer<typeof authorizeRequestSchema>;
+/**
+ * Parses and validates an authorization request: known, active client, an allowed redirect URI, PKCE
+ * (S256 is mandatory) and the scopes. Failures are plain HTTP errors because the redirect URI cannot
+ * be trusted to carry them yet.
+ */
+export declare function validateAuthorizeRequest(input: unknown): Promise<{
+    request: AuthorizeRequest;
+    application: OAuthApplication;
+    scope: string[];
+}>;
+/** Throws 403 unless the user may use the application (role check, active, `oauth:application:access`). */
+export declare function assertApplicationAccess(event: H3Event, user: OAuthUser, application: OAuthApplication): Promise<void>;
+/** Where to send people who are not signed in: the configured path or the `@frigear-nu/users` login page. */
+export declare function getSignInPath(): string;

package/dist/runtime/server/utils/oauth-authorize.js

@@ -0,0 +1,33 @@
+import { z } from "zod";
+import { resolveScope, validateRedirectUri } from "../../utils/index.js";
+export const authorizeRequestSchema = z.object({
+  client_id: z.string().min(1),
+  redirect_uri: z.string().min(1),
+  response_type: z.literal("code"),
+  state: z.string().min(1).max(2048),
+  code_challenge: z.string().min(43).max(128),
+  code_challenge_method: z.literal("S256"),
+  scope: z.string().max(1024).optional(),
+  nonce: z.string().max(512).optional()
+});
+const fail = (statusCode, statusMessage) => createError({ statusCode, statusMessage });
+export async function validateAuthorizeRequest(input) {
+  const parsed = authorizeRequestSchema.safeParse(input);
+  if (!parsed.success) throw fail(400, `Invalid authorization request: ${parsed.error.issues.map((issue) => `${issue.path.join(".")} ${issue.message}`).join(", ")}`);
+  const request = parsed.data;
+  const application = await getApplication(request.client_id);
+  if (!application || !application.isActive) throw fail(400, "Unknown or disabled application.");
+  const valid = validateRedirectUri(request.redirect_uri, { ...application, callbackPath: useOAuthConfig().callbackPath });
+  if (!valid) throw fail(400, "The redirect_uri is not allowed for this application.");
+  const scope = resolveScope(request.scope, getSupportedScopes());
+  if (scope.length === 0) throw fail(400, "None of the requested scopes is supported.");
+  return { request, application, scope };
+}
+export async function assertApplicationAccess(event, user, application) {
+  const access = await checkApplicationAccess(user, application, event);
+  if (!access.allowed) throw fail(403, access.reason ?? "You do not have access to this application.");
+}
+export function getSignInPath() {
+  const config = useRuntimeConfig();
+  return config.oauthServer.signInPath || config.public.users?.pages?.login || "/login";
+}

package/dist/runtime/server/utils/oauth-config.d.ts

@@ -0,0 +1,16 @@
+import type { H3Event } from 'h3';
+export declare function useOAuthConfig(): any;
+/** The configured issuer, or the origin the request came in on (honouring `x-forwarded-*`). */
+export declare function getOAuthIssuer(event: H3Event): string;
+/** Scopes this server accepts: the defaults plus whatever the host configured. */
+export declare function getSupportedScopes(): string[];
+/** The signed-in user's numeric id (the `users` table uses integer ids). Responds 401 when nobody is signed in. */
+export declare function requireSessionUserId(event: H3Event): Promise<number>;
+/**
+ * OAuth style error body (RFC 6749 §5.2). Return it from a handler:
+ * `return oauthError(event, 400, 'invalid_grant', 'The code expired.')`.
+ */
+export declare function oauthError(event: H3Event, statusCode: number, error: string, description?: string): {
+    error_description?: string | undefined;
+    error: string;
+};

package/dist/runtime/server/utils/oauth-config.js

@@ -0,0 +1,20 @@
+export function useOAuthConfig() {
+  return useRuntimeConfig().oauthServer;
+}
+export function getOAuthIssuer(event) {
+  const configured = useOAuthConfig().issuer;
+  const issuer = configured || getRequestURL(event, { xForwardedHost: true, xForwardedProto: true }).origin;
+  return issuer.replace(/\/+$/, "");
+}
+export function getSupportedScopes() {
+  return [.../* @__PURE__ */ new Set(["openid", "profile", "email", ...useOAuthConfig().scopes])];
+}
+export async function requireSessionUserId(event) {
+  const { user } = await requireUserSession(event);
+  return Number(user.id);
+}
+export function oauthError(event, statusCode, error, description) {
+  setResponseStatus(event, statusCode);
+  setResponseHeader(event, "Cache-Control", "no-store");
+  return { error, ...description ? { error_description: description } : {} };
+}

package/dist/runtime/server/utils/oauth-crypto.d.ts

@@ -0,0 +1,18 @@
+import type { H3Event } from 'h3';
+/** Random, URL-safe secret (codes, refresh tokens, client secrets). */
+export declare function generateSecret(bytes?: number): string;
+export declare function sha256Hex(value: string): Promise<string>;
+/** Constant-time string comparison. */
+export declare function safeEqual(a: string, b: string): boolean;
+/** PKCE S256: `BASE64URL(SHA256(verifier))`. */
+export declare function computeCodeChallenge(verifier: string): Promise<string>;
+export declare function verifyCodeChallenge(verifier: string, challenge: string): Promise<boolean>;
+/**
+ * Client credentials from the `Authorization: Basic` header (id and secret are form-urlencoded and
+ * split on the *first* colon, RFC 6749 §2.3.1) or from the request body.
+ */
+export declare function readClientCredentials(event: H3Event, body: Record<string, unknown> | undefined): {
+    clientId: string;
+    clientSecret: string;
+    basic: boolean;
+} | null;

package/dist/runtime/server/utils/oauth-crypto.js

@@ -0,0 +1,48 @@
+const encoder = new TextEncoder();
+function toHex(bytes) {
+  return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function toBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export function generateSecret(bytes = 32) {
+  return toHex(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+export async function sha256Hex(value) {
+  return toHex(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(value))));
+}
+export function safeEqual(a, b) {
+  const left = encoder.encode(a);
+  const right = encoder.encode(b);
+  let diff = left.length ^ right.length;
+  for (let i = 0; i < Math.max(left.length, right.length); i++) diff |= (left[i] ?? 0) ^ (right[i] ?? 0);
+  return diff === 0;
+}
+export async function computeCodeChallenge(verifier) {
+  return toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(verifier))));
+}
+export async function verifyCodeChallenge(verifier, challenge) {
+  return safeEqual(await computeCodeChallenge(verifier), challenge);
+}
+export function readClientCredentials(event, body) {
+  const header = getHeader(event, "authorization");
+  if (header?.toLowerCase().startsWith("basic ")) {
+    try {
+      const decoded = atob(header.slice(6).trim());
+      const index = decoded.indexOf(":");
+      if (index === -1) return null;
+      return {
+        clientId: decodeURIComponent(decoded.slice(0, index).replace(/\+/g, " ")),
+        clientSecret: decodeURIComponent(decoded.slice(index + 1).replace(/\+/g, " ")),
+        basic: true
+      };
+    } catch {
+      return null;
+    }
+  }
+  const clientId = typeof body?.client_id === "string" ? body.client_id : "";
+  const clientSecret = typeof body?.client_secret === "string" ? body.client_secret : "";
+  return clientId && clientSecret ? { clientId, clientSecret, basic: false } : null;
+}

package/dist/runtime/server/utils/oauth-grants.d.ts

@@ -0,0 +1,60 @@
+import { schema } from '@nuxthub/db';
+type ApplicationRow = typeof schema.oauthApplications.$inferSelect;
+export type AuthorizationGrant = {
+    userId: number;
+    scope: string[];
+    nonce: string | null;
+    authTime: Date;
+};
+/** Stores a single-use authorization code (only its hash) and returns the plain code for the redirect. */
+export declare function createAuthorizationCode(input: {
+    application: Pick<ApplicationRow, 'id'>;
+    userId: number;
+    redirectUri: string;
+    scope: string[];
+    codeChallenge: string;
+    nonce?: string | null;
+}): Promise<string>;
+/**
+ * Redeems a code. It is consumed even when validation fails afterwards (a code is only ever valid for
+ * one attempt). Returns a human readable `error` instead of throwing so the token endpoint can answer
+ * with an OAuth error body.
+ */
+export declare function exchangeAuthorizationCode(input: {
+    code: string;
+    application: Pick<ApplicationRow, 'id'>;
+    redirectUri: string;
+    codeVerifier: string;
+}): Promise<{
+    grant: AuthorizationGrant;
+} | {
+    error: string;
+}>;
+/** Creates a refresh token; pass `familyId` when rotating so the chain stays together. */
+export declare function createRefreshToken(input: {
+    applicationId: string;
+    userId: number;
+    scope: string[];
+    authTime: Date;
+    familyId?: string;
+}): Promise<{
+    token: string;
+    id: string;
+    familyId: string;
+}>;
+/**
+ * Exchanges a refresh token for a new one (rotation). Presenting a token that was already rotated or
+ * revoked is treated as theft: the whole family is revoked.
+ */
+export declare function rotateRefreshToken(input: {
+    token: string;
+    application: Pick<ApplicationRow, 'id'>;
+}): Promise<{
+    grant: AuthorizationGrant;
+    token: string;
+} | {
+    error: string;
+}>;
+/** Revokes the family of a refresh token (RFC 7009). Unknown tokens are ignored. */
+export declare function revokeRefreshToken(token: string, applicationId: string): Promise<void>;
+export {};

package/dist/runtime/server/utils/oauth-grants.js

@@ -0,0 +1,70 @@
+import { and, eq, isNull, lt } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+import { newId } from "../../utils/index.js";
+export async function createAuthorizationCode(input) {
+  const code = generateSecret();
+  await db.delete(schema.oauthAuthorizationCodes).where(lt(schema.oauthAuthorizationCodes.expiresAt, /* @__PURE__ */ new Date()));
+  await db.insert(schema.oauthAuthorizationCodes).values({
+    codeHash: await sha256Hex(code),
+    applicationId: input.application.id,
+    userId: input.userId,
+    redirectUri: input.redirectUri,
+    scope: input.scope.join(" "),
+    codeChallenge: input.codeChallenge,
+    nonce: input.nonce ?? null,
+    expiresAt: new Date(Date.now() + useOAuthConfig().codeTtl * 1e3)
+  });
+  return code;
+}
+export async function exchangeAuthorizationCode(input) {
+  const [row] = await db.delete(schema.oauthAuthorizationCodes).where(eq(schema.oauthAuthorizationCodes.codeHash, await sha256Hex(input.code))).returning();
+  if (!row) return { error: "The authorization code is invalid or already used." };
+  if (row.applicationId !== input.application.id) return { error: "The authorization code was issued to another application." };
+  if (row.expiresAt.getTime() < Date.now()) return { error: "The authorization code has expired." };
+  if (row.redirectUri !== input.redirectUri) return { error: "The redirect_uri does not match the authorization request." };
+  if (!await verifyCodeChallenge(input.codeVerifier, row.codeChallenge)) return { error: "The code_verifier does not match the code_challenge." };
+  return { grant: { userId: row.userId, scope: row.scope.split(" ").filter(Boolean), nonce: row.nonce, authTime: row.authTime } };
+}
+export async function createRefreshToken(input) {
+  const token = generateSecret(48);
+  const id = newId("rt");
+  const familyId = input.familyId ?? newId("rtf");
+  await db.insert(schema.oauthRefreshTokens).values({
+    id,
+    tokenHash: await sha256Hex(token),
+    applicationId: input.applicationId,
+    userId: input.userId,
+    scope: input.scope.join(" "),
+    familyId,
+    authTime: input.authTime,
+    expiresAt: new Date(Date.now() + useOAuthConfig().refreshTokenTtl * 1e3)
+  });
+  return { token, id, familyId };
+}
+async function revokeFamily(familyId) {
+  await db.update(schema.oauthRefreshTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and(eq(schema.oauthRefreshTokens.familyId, familyId), isNull(schema.oauthRefreshTokens.revokedAt)));
+}
+export async function rotateRefreshToken(input) {
+  const [row] = await db.select().from(schema.oauthRefreshTokens).where(eq(schema.oauthRefreshTokens.tokenHash, await sha256Hex(input.token))).limit(1);
+  if (!row || row.applicationId !== input.application.id) return { error: "The refresh token is invalid." };
+  if (row.revokedAt || row.replacedBy) {
+    await revokeFamily(row.familyId);
+    await useNitroApp().hooks.callHook("oauth:token:revoked", { applicationId: row.applicationId, userId: row.userId, reason: "reuse_detected" });
+    return { error: "The refresh token was already used or revoked." };
+  }
+  if (row.expiresAt.getTime() < Date.now()) return { error: "The refresh token has expired." };
+  const scope = row.scope.split(" ").filter(Boolean);
+  const next = await createRefreshToken({ applicationId: row.applicationId, userId: row.userId, scope, authTime: row.authTime, familyId: row.familyId });
+  const claimed = await db.update(schema.oauthRefreshTokens).set({ replacedBy: next.id, revokedAt: /* @__PURE__ */ new Date() }).where(and(eq(schema.oauthRefreshTokens.id, row.id), isNull(schema.oauthRefreshTokens.replacedBy), isNull(schema.oauthRefreshTokens.revokedAt))).returning({ id: schema.oauthRefreshTokens.id });
+  if (!claimed.length) {
+    await revokeFamily(row.familyId);
+    return { error: "The refresh token was already used or revoked." };
+  }
+  return { grant: { userId: row.userId, scope, nonce: null, authTime: row.authTime }, token: next.token };
+}
+export async function revokeRefreshToken(token, applicationId) {
+  const [row] = await db.select().from(schema.oauthRefreshTokens).where(eq(schema.oauthRefreshTokens.tokenHash, await sha256Hex(token))).limit(1);
+  if (!row || row.applicationId !== applicationId) return;
+  await revokeFamily(row.familyId);
+  await useNitroApp().hooks.callHook("oauth:token:revoked", { applicationId, userId: row.userId, reason: "revoked" });
+}

package/dist/runtime/server/utils/oauth-keys.d.ts

@@ -0,0 +1,41 @@
+import type { JWK } from 'jose';
+/** Accepts PEMs pasted into env files: strips wrapping quotes and turns literal `\n` into newlines. */
+export declare function normalizePemKey(raw: string): string;
+export declare function getSigningKey(): Promise<globalThis.CryptoKey>;
+/**
+ * The JSON Web Key Set served at `/.well-known/jwks.json`: the current key plus the previous public keys
+ * that are kept during a rotation. Never contains private key material.
+ */
+export declare function getJwks(): Promise<{
+    keys: (JWK | {
+        kid: any;
+        alg: string;
+        use: string;
+        kty?: import("jose").JWKKeyType;
+        key_ops?: string[];
+        ext?: boolean;
+        x5c?: string[];
+        x5t?: string;
+        'x5t#S256'?: string;
+        x5u?: string;
+        crv?: string;
+        d?: string;
+        dp?: string;
+        dq?: string;
+        e?: string;
+        k?: string;
+        n?: string;
+        p?: string;
+        q?: string;
+        qi?: string;
+        x?: string;
+        y?: string;
+        pub?: string;
+        priv?: string;
+        oth?: Array<{
+            d?: string;
+            r?: string;
+            t?: string;
+        }>;
+    })[];
+}>;

package/dist/runtime/server/utils/oauth-keys.js

@@ -0,0 +1,55 @@
+import { exportJWK, importPKCS8, importSPKI } from "jose";
+export function normalizePemKey(raw) {
+  return raw.trim().replace(/^["']|["']$/g, "").replace(/\\n/g, "\n").trim();
+}
+const notConfigured = () => createError({ statusCode: 500, statusMessage: "The OAuth server signing keys are not configured." });
+let cache;
+async function loadKeys() {
+  const config = useOAuthConfig();
+  const pem = config.privateKey ? normalizePemKey(config.privateKey) : "";
+  if (!pem) throw notConfigured();
+  const publicPem = config.publicKey ? normalizePemKey(config.publicKey) : "";
+  if (cache?.pem === pem && cache.publicPem === publicPem) return cache;
+  const privateKey = await importPKCS8(pem, "RS256", { extractable: true });
+  let publicJwk;
+  if (publicPem) {
+    publicJwk = await exportJWK(await importSPKI(publicPem, "RS256", { extractable: true }));
+  } else {
+    const { kty, n, e } = await exportJWK(privateKey);
+    publicJwk = { kty, n, e };
+  }
+  cache = { pem, publicPem, privateKey, publicJwk };
+  return cache;
+}
+export async function getSigningKey() {
+  return (await loadKeys()).privateKey;
+}
+function parsePreviousKeys() {
+  const raw = useOAuthConfig().previousPublicKeys;
+  if (!raw) return {};
+  try {
+    const parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
+    return Object.fromEntries(Object.entries(parsed).map(([kid, pem]) => [kid, normalizePemKey(String(pem))]));
+  } catch {
+    throw createError({ statusCode: 500, statusMessage: "The OAuth server previous public keys are not valid JSON." });
+  }
+}
+let previousCache;
+async function loadPreviousJwks() {
+  const keys = parsePreviousKeys();
+  const source = JSON.stringify(keys);
+  if (previousCache?.source === source) return previousCache.jwks;
+  const jwks = [];
+  for (const [kid, pem] of Object.entries(keys)) {
+    const { kty, n, e } = await exportJWK(await importSPKI(pem, "RS256", { extractable: true }));
+    jwks.push({ kty, n, e, kid, alg: "RS256", use: "sig" });
+  }
+  previousCache = { source, jwks };
+  return jwks;
+}
+export async function getJwks() {
+  const { publicJwk } = await loadKeys();
+  const keyId = useOAuthConfig().keyId;
+  const previous = (await loadPreviousJwks()).filter((jwk) => jwk.kid !== keyId);
+  return { keys: [{ ...publicJwk, kid: keyId, alg: "RS256", use: "sig" }, ...previous] };
+}

package/dist/runtime/server/utils/oauth-tokens.d.ts

@@ -0,0 +1,25 @@
+import type { H3Event } from 'h3';
+import type { OAuthApplication, OAuthUser } from '../../../types.js';
+type TokenInput = {
+    event: H3Event;
+    user: OAuthUser;
+    application: OAuthApplication;
+    scope: string[];
+    roles: string[];
+};
+/** A bare access token (`sub`, `scope`, `client_id`) plus whatever `oauth:claims` adds. Header `typ` is `at+jwt`. */
+export declare function signAccessToken(input: TokenInput): Promise<string>;
+/** An OIDC ID token with the profile claims of the granted scopes, `nonce` and `auth_time`. */
+export declare function signIdToken(input: TokenInput & {
+    nonce?: string | null;
+    authTime: Date;
+}): Promise<string>;
+export type AccessTokenPayload = {
+    sub: string;
+    aud: string;
+    scope: string;
+    client_id: string;
+} & Record<string, unknown>;
+/** Verifies signature, expiry, issuer and the `at+jwt` type of an access token. Returns `null` when invalid. */
+export declare function verifyAccessToken(event: H3Event, token: string): Promise<AccessTokenPayload | null>;
+export {};

package/dist/runtime/server/utils/oauth-tokens.js

@@ -0,0 +1,34 @@
+import { SignJWT, createLocalJWKSet, jwtVerify } from "jose";
+async function sign(event, application, userId, claims, options) {
+  const config = useOAuthConfig();
+  return new SignJWT(claims).setProtectedHeader({ alg: "RS256", typ: options.typ, kid: config.keyId }).setIssuer(getOAuthIssuer(event)).setSubject(String(userId)).setAudience(application.id).setIssuedAt().setExpirationTime(`${options.ttl}s`).setJti(crypto.randomUUID()).sign(await getSigningKey());
+}
+export async function signAccessToken(input) {
+  const claims = await buildClaims({ ...input, tokenType: "access_token" });
+  return sign(input.event, input.application, input.user.id, {
+    ...claims,
+    scope: input.scope.join(" "),
+    client_id: input.application.id
+  }, { typ: "at+jwt", ttl: useOAuthConfig().accessTokenTtl });
+}
+export async function signIdToken(input) {
+  const claims = await buildClaims({ ...input, tokenType: "id_token" });
+  return sign(input.event, input.application, input.user.id, {
+    ...claims,
+    auth_time: Math.floor(input.authTime.getTime() / 1e3),
+    ...input.nonce ? { nonce: input.nonce } : {}
+  }, { typ: "JWT", ttl: useOAuthConfig().accessTokenTtl });
+}
+export async function verifyAccessToken(event, token) {
+  try {
+    const { payload } = await jwtVerify(token, createLocalJWKSet(await getJwks()), {
+      issuer: getOAuthIssuer(event),
+      algorithms: ["RS256"],
+      typ: "at+jwt"
+    });
+    if (typeof payload.sub !== "string" || typeof payload.client_id !== "string") return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}

package/dist/runtime/utils/index.d.ts

@@ -0,0 +1,24 @@
+export type * from '../../types';
+export declare const DEFAULT_SCOPES: readonly ["openid", "profile", "email"];
+export declare const DEFAULT_CALLBACK_PATH = "/auth/frigear";
+/** Whether a user holding `roles` may use an application restricted to `allowedRoles`. Empty = everyone. */
+export declare function matchesAllowedRoles(allowedRoles: readonly string[] | null | undefined, roles: readonly string[]): boolean;
+/** Splits a space separated scope string and drops duplicates and blanks. */
+export declare function parseScope(scope: string | null | undefined): string[];
+/** The requested scopes that the server supports; falls back to the defaults when none were requested. */
+export declare function resolveScope(requested: string | null | undefined, supported: readonly string[]): string[];
+/** HTTPS is required, except for `localhost` / loopback development hosts. */
+export declare function isSecureOrigin(url: URL): boolean;
+export declare function normalizeWebsiteUrl(value: string): string;
+/** `https://*.vercel.app` -> a regex matching one host label in place of `*`. Everything else is matched literally. */
+export declare function previewPatternToRegExp(pattern: string, callbackPath: string): RegExp;
+export type RedirectUriRules = {
+    websiteUrl: string;
+    previewUrlPattern?: string | null;
+    redirectUris?: readonly string[] | null;
+    callbackPath?: string;
+};
+/** Exact match on `websiteUrl + callbackPath`, an explicit extra redirect URI, or the preview pattern. */
+export declare function validateRedirectUri(redirectUri: string, rules: RedirectUriRules): boolean;
+/** Prefixed random id, e.g. `newId('app')` -> `app_3f9c…`. */
+export declare function newId(prefix: string): string;