@frigear-nu/oauth-server 0.1.1 → 0.1.3

package/dist/runtime/app/pages/admin.vue

@@ -1,15 +1,31 @@
 <script setup>
+import { oauthApplicationsApi } from "../composables/useOAuthApplications";
 defineOptions({ name: "OAuthAdminPage" });
 const t = useModuleT("oauthServer");
-const { applications, status, error } = useOAuthApplications();
+const route = useRoute();
+const { page, pageSize, search, sort: sortState, query, filtered, reset } = useTableQuery({
+  sort: { id: "createdAt", desc: true }
+});
+const sort = useTableSort(null, sortState);
+const { sorting } = sort;
+const { applications, total, data, status, error, loading, refreshing, refresh } = await useOAuthApplications(query);
 const actions = useOAuthApplicationActions();
 const forbidden = computed(() => error.value?.statusCode === 401 || error.value?.statusCode === 403);
+const failed = computed(() => !!error.value && !forbidden.value && !data.value);
 const columns = computed(() => [
-  { accessorKey: "name", header: t("admin.application", "Application") },
+  { accessorKey: "name", header: sort.header("name", t("admin.application", "Application")) },
   { id: "access", header: t("admin.access", "Access") },
-  { id: "grants", header: t("admin.signedIn", "Signed in"), meta: numericColumn },
+  { id: "grants", accessorFn: (row) => row.activeGrants ?? 0, header: t("admin.signedIn", "Signed in"), meta: numericColumn },
   { id: "actions", header: "", meta: { class: { th: "w-0", td: "w-0" } } }
 ]);
+async function openFromQuery() {
+  const id = route.query.application;
+  if (typeof id !== "string" || !id) return;
+  const application = applications.value.find((item) => item.id === id) ?? await oauthApplicationsApi.get(id).catch(() => void 0);
+  if (application) void actions.edit(application);
+}
+onMounted(openFromQuery);
+watch(() => route.query.application, openFromQuery);
 </script>
 
 <template>
@@ -36,69 +52,111 @@ const columns = computed(() => [
       :title="t('admin.forbiddenTitle', 'You are not allowed to manage OAuth applications')"
       :description="t('admin.forbiddenDescription', 'Ask an administrator for access.')"
     />
-    <TableCard
-      v-else
-      :loading="status === 'pending' && !applications.length"
-      :refreshing="status === 'pending' && !!applications.length"
-    >
-      <UTable
-        :data="applications"
-        :columns="columns"
-        :ui="tableUi()"
-        @select="(_event, row2) => actions.edit(row2.original)"
+    <UEmpty
+      v-else-if="failed"
+      icon="i-lucide-circle-alert"
+      :title="t('admin.loadFailed', 'OAuth applications could not be loaded')"
+      :description="errorMessage(error, '')"
+      :actions="[{ label: t('admin.tryAgain', 'Try again'), icon: 'i-lucide-rotate-ccw', color: 'neutral', variant: 'outline', onClick: () => refresh() }]"
+    />
+    <template v-else>
+      <PageToolbar>
+        <UInput
+          v-model="search"
+          class="w-full max-w-sm"
+          icon="i-lucide-search"
+          :loading="status === 'pending'"
+          :placeholder="t('admin.search', 'Search name or client ID...')"
+        />
+      </PageToolbar>
+
+      <TableCard
+        :loading="loading"
+        :refreshing="refreshing"
       >
-        <template #name-cell="{ row }">
-          <TableIdentity
-            :title="row.original.name"
-            :description="row.original.websiteUrl"
-            :avatar="{ icon: row.original.icon || 'i-lucide-globe' }"
-          >
-            <template #badges>
+        <UTable
+          v-model:sorting="sorting"
+          :data="applications"
+          :columns="columns"
+          :sorting-options="{ manualSorting: true }"
+          :ui="tableUi()"
+          @select="(_event, row2) => actions.edit(row2.original)"
+        >
+          <template #name-cell="{ row }">
+            <TableIdentity
+              :title="row.original.name"
+              :description="row.original.websiteUrl"
+              :avatar="{ icon: row.original.icon || 'i-lucide-globe' }"
+            >
+              <template #badges>
+                <UBadge
+                  v-if="row.original.clientType === 'public'"
+                  color="info"
+                  variant="subtle"
+                  size="sm"
+                  :label="t('admin.public', 'Public')"
+                />
+                <UBadge
+                  v-if="!row.original.isActive"
+                  color="neutral"
+                  variant="subtle"
+                  size="sm"
+                  :label="t('admin.disabled', 'Disabled')"
+                />
+              </template>
+            </TableIdentity>
+          </template>
+          <template #access-cell="{ row }">
+            <div class="flex flex-wrap gap-1">
+              <UBadge
+                v-for="role in row.original.allowedRoles"
+                :key="role"
+                variant="subtle"
+                :label="role"
+              />
               <UBadge
-                v-if="!row.original.isActive"
+                v-if="!row.original.allowedRoles.length"
                 color="neutral"
                 variant="subtle"
-                size="sm"
-                :label="t('admin.disabled', 'Disabled')"
+                :label="t('admin.everyone', 'Every signed-in user')"
               />
-            </template>
-          </TableIdentity>
-        </template>
-        <template #access-cell="{ row }">
-          <div class="flex flex-wrap gap-1">
-            <UBadge
-              v-for="role in row.original.allowedRoles"
-              :key="role"
-              variant="subtle"
-              :label="role"
+            </div>
+          </template>
+          <template #grants-cell="{ row }">
+            {{ row.original.activeGrants ?? 0 }}
+          </template>
+          <template #actions-cell="{ row }">
+            <RowMenu
+              :items="actions.menu(row.original)"
+              :subject="row.original.name"
             />
-            <UBadge
-              v-if="!row.original.allowedRoles.length"
-              color="neutral"
-              variant="subtle"
-              :label="t('admin.everyone', 'Every signed-in user')"
+          </template>
+          <template #empty>
+            <UEmpty
+              v-if="filtered"
+              variant="naked"
+              icon="i-lucide-search"
+              :title="t('admin.noMatches', 'No applications match')"
+              :actions="[{ label: t('admin.clearSearch', 'Clear search'), color: 'neutral', variant: 'outline', onClick: reset }]"
             />
-          </div>
-        </template>
-        <template #grants-cell="{ row }">
-          {{ row.original.activeGrants ?? 0 }}
-        </template>
-        <template #actions-cell="{ row }">
-          <RowMenu
-            :items="actions.menu(row.original)"
-            :subject="row.original.name"
-          />
-        </template>
-        <template #empty>
-          <UEmpty
-            variant="naked"
-            icon="i-lucide-app-window"
-            :title="t('admin.emptyTitle', 'No applications yet')"
-            :description="t('admin.emptyDescription', 'Add an application to let users sign in to it with their account.')"
-            :actions="[{ label: t('admin.new', 'Add application'), icon: 'i-lucide-plus', onClick: () => actions.create() }]"
+            <UEmpty
+              v-else
+              variant="naked"
+              icon="i-lucide-app-window"
+              :title="t('admin.emptyTitle', 'No applications yet')"
+              :description="t('admin.emptyDescription', 'Add an application to let users sign in to it with their account.')"
+              :actions="[{ label: t('admin.new', 'Add application'), icon: 'i-lucide-plus', onClick: () => actions.create() }]"
+            />
+          </template>
+        </UTable>
+        <template #footer>
+          <TablePagination
+            v-model:page="page"
+            v-model:page-size="pageSize"
+            :total="total"
           />
         </template>
-      </UTable>
-    </TableCard>
+      </TableCard>
+    </template>
   </div>
 </template>

package/dist/runtime/app/pages/applications.vue

@@ -1,38 +1,73 @@
 <script setup>
 defineOptions({ name: "OAuthApplicationsPage" });
 const t = useModuleT("oauthServer");
-const { applications, status } = useMyApplications();
+const { applications, loading, error, refresh } = await useMyApplications();
 </script>
 
 <template>
   <div class="flex flex-col gap-4">
+    <!-- The same keys as the account menu item, so the label and the title cannot drift. -->
+    <PageHeading
+      :title="t('menu.applications.label', 'Applications')"
+      :description="t('menu.applications.description', 'Applications you can sign in to.')"
+    />
+
+    <SectionCard
+      v-if="loading"
+      loading
+      aria-busy="true"
+    />
     <UEmpty
-      v-if="status !== 'pending' && !applications.length"
-      icon="i-lucide-layout-grid"
-      :title="t('applications.emptyTitle', 'No applications yet')"
-      :description="t('applications.emptyDescription', 'There are no applications you can sign in to yet.')"
+      v-else-if="error && !applications.length"
+      icon="i-lucide-circle-alert"
+      :title="t('applications.loadFailed', 'Your applications could not be loaded')"
+      :description="errorMessage(error, '')"
+      :actions="[{ label: t('applications.tryAgain', 'Try again'), icon: 'i-lucide-rotate-ccw', color: 'neutral', variant: 'outline', onClick: () => refresh() }]"
     />
-    <div
+    <SectionCard
       v-else
-      class="grid gap-4 md:grid-cols-2"
+      flush
     >
-      <UPageCard
-        v-for="application in applications"
-        :key="application.id"
-        variant="outline"
-        :title="application.name"
-        :description="application.description ?? application.websiteUrl"
-        :icon="application.icon || 'i-lucide-globe'"
+      <UEmpty
+        v-if="!applications.length"
+        variant="naked"
+        icon="i-lucide-layout-grid"
+        :title="t('applications.emptyTitle', 'No applications yet')"
+        :description="t('applications.emptyDescription', 'There are no applications you can sign in to yet.')"
+      />
+      <ul
+        v-else
+        class="divide-default divide-y"
       >
-        <UButton
-          :to="application.loginUrl"
-          external
-          trailing-icon="i-lucide-arrow-up-right"
-          size="sm"
-          :label="t('applications.open', 'Open')"
-          :aria-label="t('applications.openApplication', 'Open {name}', { name: application.name })"
-        />
-      </UPageCard>
-    </div>
+        <li
+          v-for="application in applications"
+          :key="application.id"
+          class="flex items-center gap-3 px-4 py-3"
+        >
+          <UAvatar
+            :icon="application.icon || 'i-lucide-globe'"
+            size="md"
+          />
+          <div class="min-w-0 flex-1">
+            <p class="text-highlighted truncate text-sm font-medium">
+              {{ application.name }}
+            </p>
+            <p class="text-muted truncate text-sm">
+              {{ application.description ?? application.websiteUrl }}
+            </p>
+          </div>
+          <UButton
+            :to="application.loginUrl"
+            external
+            color="neutral"
+            variant="outline"
+            trailing-icon="i-lucide-arrow-up-right"
+            size="sm"
+            :label="t('applications.open', 'Open')"
+            :aria-label="t('applications.openApplication', 'Open {name}', { name: application.name })"
+          />
+        </li>
+      </ul>
+    </SectionCard>
   </div>
 </template>

package/dist/runtime/app/pages/authorize.vue

@@ -1,10 +1,11 @@
 <script setup>
+import { oauthServerApi, oidc } from "../../utils/api";
 defineOptions({ name: "OAuthAuthorizePage" });
 const t = useModuleT("oauthServer");
 const route = useRoute();
 const signInPath = useAuthPages().login;
 const showError = useErrorToast();
-const { data: consent, error } = await useFetch("/api/oauth-server/consent", {
+const { data: consent, error } = await useFetch(oauthServerApi.consent, {
   query: route.query,
   key: `oauth-server:consent:${route.fullPath}`
 });
@@ -23,7 +24,7 @@ const pending = ref(null);
 async function decide(approved) {
   pending.value = approved ? "approve" : "deny";
   try {
-    const { redirectUrl } = await $fetch("/oauth/authorize", {
+    const { redirectUrl } = await $fetch(oidc.authorize, {
       method: "POST",
       body: { ...route.query, approved }
     });

package/dist/runtime/i18n/lang/da.json

@@ -16,9 +16,12 @@
       "new": "Tilføj applikation",
       "forbiddenTitle": "Du har ikke adgang til at administrere OAuth-applikationer",
       "forbiddenDescription": "Bed en administrator om adgang.",
+      "loadFailed": "OAuth-applikationer kunne ikke indlæses",
+      "tryAgain": "Prøv igen",
       "application": "Applikation",
       "access": "Adgang",
       "signedIn": "Logget ind",
+      "public": "Offentlig",
       "disabled": "Deaktiveret",
       "callback": "Callback",
       "everyone": "Alle indloggede brugere",
@@ -43,7 +46,10 @@
       "enabled": "Applikationen er aktiveret",
       "disabledToast": "Applikationen er deaktiveret",
       "secretReplaced": "Klienthemmeligheden er skiftet",
-      "signedOut": "Alle er logget ud"
+      "signedOut": "Alle er logget ud",
+      "search": "Søg på navn eller klient-ID...",
+      "noMatches": "Ingen applikationer matcher",
+      "clearSearch": "Ryd søgning"
     },
     "form": {
       "createTitle": "Tilføj applikation",
@@ -66,7 +72,14 @@
       "tags": "Tags",
       "description": "Beskrivelse",
       "icon": "Ikon",
-      "priority": "Prioritet"
+      "priority": "Prioritet",
+      "clientType": "Klienttype",
+      "clientTypeConfidential": "Fortrolig (serverside, har en klienthemmelighed)",
+      "clientTypePublic": "Offentlig (native app eller single-page-app, ingen hemmelighed)",
+      "clientTypeHint": "Kan ikke ændres senere. Offentlige klienter logger kun ind med PKCE og får derfor aldrig en hemmelighed.",
+      "redirectUris": "Redirect-URI'er",
+      "redirectUrisHint": "Ekstra præcise redirect-URI'er. Offentlige klienter må bruge URI'er med eget skema, fx com.example.app:/callback.",
+      "redirectUriInvalid": "Angiv en https-URL eller, for offentlige klienter, en URI med eget skema."
     },
     "credentials": {
       "title": "Legitimationsoplysninger for {name}",
@@ -75,13 +88,17 @@
       "clientSecret": "Klienthemmelighed",
       "copy": "Kopiér",
       "copiedClientId": "Klient-id kopieret",
-      "copiedClientSecret": "Klienthemmelighed kopieret"
+      "copiedClientSecret": "Klienthemmelighed kopieret",
+      "publicDescription": "Dette er en offentlig klient: den har ingen klienthemmelighed og logger kun ind med PKCE.",
+      "noSecret": "Ingen (offentlig klient)"
     },
     "applications": {
       "open": "Åbn",
       "openApplication": "Åbn {name}",
       "emptyTitle": "Ingen applikationer endnu",
-      "emptyDescription": "Der er endnu ingen applikationer, du kan logge ind på."
+      "emptyDescription": "Der er endnu ingen applikationer, du kan logge ind på.",
+      "loadFailed": "Dine applikationer kunne ikke indlæses",
+      "tryAgain": "Prøv igen"
     },
     "authorize": {
       "title": "Log ind på {name}",

package/dist/runtime/i18n/lang/en.json

@@ -16,9 +16,12 @@
       "new": "Add application",
       "forbiddenTitle": "You are not allowed to manage OAuth applications",
       "forbiddenDescription": "Ask an administrator for access.",
+      "loadFailed": "OAuth applications could not be loaded",
+      "tryAgain": "Try again",
       "application": "Application",
       "access": "Access",
       "signedIn": "Signed in",
+      "public": "Public",
       "disabled": "Disabled",
       "callback": "Callback",
       "everyone": "Every signed-in user",
@@ -43,7 +46,10 @@
       "enabled": "Application enabled",
       "disabledToast": "Application disabled",
       "secretReplaced": "Client secret replaced",
-      "signedOut": "Everyone signed out"
+      "signedOut": "Everyone signed out",
+      "search": "Search name or client ID...",
+      "noMatches": "No applications match",
+      "clearSearch": "Clear search"
     },
     "form": {
       "createTitle": "Add application",
@@ -66,7 +72,14 @@
       "tags": "Tags",
       "description": "Description",
       "icon": "Icon",
-      "priority": "Priority"
+      "priority": "Priority",
+      "clientType": "Client type",
+      "clientTypeConfidential": "Confidential (server-side, has a client secret)",
+      "clientTypePublic": "Public (native or single-page app, no secret)",
+      "clientTypeHint": "Cannot be changed later. Public clients sign in with PKCE only, so they never get a secret.",
+      "redirectUris": "Redirect URIs",
+      "redirectUrisHint": "Extra exact redirect URIs. Public clients may use custom-scheme URIs such as com.example.app:/callback.",
+      "redirectUriInvalid": "Enter a https URL or, for public clients, a custom-scheme URI."
     },
     "credentials": {
       "title": "Credentials for {name}",
@@ -75,13 +88,17 @@
       "clientSecret": "Client secret",
       "copy": "Copy",
       "copiedClientId": "Client ID copied",
-      "copiedClientSecret": "Client secret copied"
+      "copiedClientSecret": "Client secret copied",
+      "publicDescription": "This is a public client: it has no client secret and signs in with PKCE only.",
+      "noSecret": "None (public client)"
     },
     "applications": {
       "open": "Open",
       "openApplication": "Open {name}",
       "emptyTitle": "No applications yet",
-      "emptyDescription": "There are no applications you can sign in to yet."
+      "emptyDescription": "There are no applications you can sign in to yet.",
+      "loadFailed": "Your applications could not be loaded",
+      "tryAgain": "Try again"
     },
     "authorize": {
       "title": "Sign in to {name}",

package/dist/runtime/server/bootstrap/my-applications.d.ts

@@ -0,0 +1,7 @@
+import type { H3Event } from 'h3';
+import type { UserApplicationDto } from '../../../types.js';
+/**
+ * The applications the signed-in user may sign in to: the body of `GET /api/oauth-server/me/applications` and the
+ * account bootstrap's `oauth-server:mine` (the key `useMyApplications()` reads), so both always return the same thing.
+ */
+export default function myApplications(event: H3Event): Promise<UserApplicationDto[]>;

package/dist/runtime/server/bootstrap/my-applications.js

@@ -0,0 +1,4 @@
+export default async function myApplications(event) {
+  const userId = await requireSessionUserId(event);
+  return listUserApplications(userId, event);
+}

package/dist/runtime/server/db/schema.postgresql.d.ts

@@ -20,6 +20,23 @@ export declare const oauthApplications: import("drizzle-orm/pg-core").PgTableWit
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        clientType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "clientType";
+            tableName: "oauth_applications";
+            dataType: "string";
+            columnType: "PgText";
+            data: "confidential" | "public";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["confidential", "public"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         secretHash: import("drizzle-orm/pg-core").PgColumn<{
             name: "secretHash";
             tableName: "oauth_applications";

package/dist/runtime/server/db/schema.postgresql.js

@@ -2,7 +2,13 @@ import { pgTable, text, integer, boolean, jsonb, timestamp, index } from "drizzl
 export const oauthApplications = pgTable("oauth_applications", {
   /** `app_` + random id; it is the OAuth `client_id`. */
   id: text().primaryKey(),
-  /** SHA-256 hex of the client secret. The secret itself is only shown once. */
+  /** `confidential` clients authenticate with a secret; `public` ones (native apps, SPAs) rely on PKCE alone. */
+  clientType: text({ enum: ["confidential", "public"] }).notNull().default("confidential"),
+  /**
+   * SHA-256 hex of the client secret. The secret itself is only shown once. Public clients have none: they get the hash
+   * of a random value nobody ever sees, so the column stays `NOT NULL` (relaxing it would make SQLite rebuild this table,
+   * which can cascade-delete the refresh tokens that reference it) and `clientType` decides whether it is ever checked.
+   */
   secretHash: text().notNull(),
   name: text().notNull(),
   description: text(),

package/dist/runtime/server/db/schema.sqlite.d.ts

@@ -22,6 +22,25 @@ export declare const oauthApplications: import("drizzle-orm/sqlite-core").SQLite
         }, {}, {
             length: undefined;
         }>;
+        clientType: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "clientType";
+            tableName: "oauth_applications";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: "confidential" | "public";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["confidential", "public"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
         secretHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "secretHash";
             tableName: "oauth_applications";

package/dist/runtime/server/db/schema.sqlite.js

@@ -2,7 +2,13 @@ import { sqliteTable, text, integer, index } from "drizzle-orm/sqlite-core";
 export const oauthApplications = sqliteTable("oauth_applications", {
   /** `app_` + random id; it is the OAuth `client_id`. */
   id: text().primaryKey(),
-  /** SHA-256 hex of the client secret. The secret itself is only shown once. */
+  /** `confidential` clients authenticate with a secret; `public` ones (native apps, SPAs) rely on PKCE alone. */
+  clientType: text({ enum: ["confidential", "public"] }).notNull().default("confidential"),
+  /**
+   * SHA-256 hex of the client secret. The secret itself is only shown once. Public clients have none: they get the hash
+   * of a random value nobody ever sees, so the column stays `NOT NULL` (relaxing it would make SQLite rebuild this table,
+   * which can cascade-delete the refresh tokens that reference it) and `clientType` decides whether it is ever checked.
+   */
   secretHash: text().notNull(),
   name: text().notNull(),
   description: text(),

package/dist/runtime/server/middleware/oauth-cors.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/middleware/oauth-cors.js

@@ -0,0 +1,25 @@
+import { oidc } from "../../utils/api.js";
+const METHODS = {
+  [oidc.token]: "POST, OPTIONS",
+  [oidc.revoke]: "POST, OPTIONS",
+  [oidc.userinfo]: "GET, OPTIONS",
+  [oidc.configuration]: "GET, OPTIONS",
+  [oidc.jwks]: "GET, OPTIONS"
+};
+export default defineEventHandler((event) => {
+  const methods = METHODS[getRequestURL(event).pathname];
+  if (!methods) return;
+  appendResponseHeader(event, "Vary", "Origin");
+  const origin = getRequestHeader(event, "origin");
+  if (!origin || !getOAuthCorsOrigins().includes(origin)) return;
+  setResponseHeaders(event, {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": methods,
+    "Access-Control-Allow-Headers": "authorization, content-type",
+    "Access-Control-Max-Age": "600"
+  });
+  if (event.method === "OPTIONS") {
+    setResponseStatus(event, 204);
+    return "";
+  }
+});

package/dist/runtime/server/routes/api/admin/application-revoke.post.js

@@ -1,7 +1,9 @@
+import { idParams } from "@frigear-nu/module-kit/server";
+import { toAdminApplicationDto } from "../../../utils/oauth-applications.js";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const id = getRouterParam(event, "id") ?? "";
-  if (!await getApplication(id)) throw createError({ statusCode: 404, statusMessage: "Application not found." });
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  const application = await requireApplication(id);
   await revokeApplicationGrants(id);
-  return { revoked: true };
+  return toAdminApplicationDto(application, 0);
 });

package/dist/runtime/server/routes/api/admin/application-secret.post.js

@@ -1,5 +1,7 @@
+import { idParams } from "@frigear-nu/module-kit/server";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const { secret } = await rotateApplicationSecret(getRouterParam(event, "id") ?? "");
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  const { secret } = await rotateApplicationSecret(id);
   return { clientSecret: secret };
 });

package/dist/runtime/server/routes/api/admin/application.delete.js

@@ -1,6 +1,7 @@
+import { idParams, noContent } from "@frigear-nu/module-kit/server";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  await deleteApplication(getRouterParam(event, "id") ?? "");
-  setResponseStatus(event, 204);
-  return null;
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  await deleteApplication(id);
+  return noContent(event);
 });

package/dist/runtime/server/routes/api/admin/application.get.js

@@ -1,6 +1,9 @@
+import { idParams } from "@frigear-nu/module-kit/server";
+import { toAdminApplicationDto } from "../../../utils/oauth-applications.js";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const application = await getApplication(getRouterParam(event, "id") ?? "");
-  if (!application) throw createError({ statusCode: 404, statusMessage: "Application not found." });
-  return { ...application, callbackUrl: `${application.websiteUrl}${useOAuthConfig().callbackPath}` };
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  const application = await requireApplication(id);
+  const grants = await countActiveGrants([id]);
+  return toAdminApplicationDto(application, grants[id] ?? 0);
 });

package/dist/runtime/server/routes/api/admin/application.patch.js

@@ -1,9 +1,10 @@
-import { applicationPatchSchema } from "../../../utils/oauth-applications.js";
+import { idParams } from "@frigear-nu/module-kit/server";
+import { applicationPatchSchema, toAdminApplicationDto } from "../../../utils/oauth-applications.js";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const id = getRouterParam(event, "id") ?? "";
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
   const patch = await readValidatedBody(event, applicationPatchSchema.parse);
   const application = await updateApplication(id, patch);
   if (patch.isActive === false) await revokeApplicationGrants(id);
-  return application;
+  return toAdminApplicationDto(application);
 });