@frigear-nu/oauth-server 0.1.1 → 0.1.3

package/dist/runtime/server/routes/api/admin/applications.get.js

@@ -1,11 +1,23 @@
+import { db, schema } from "@nuxthub/db";
+import { count, or } from "drizzle-orm";
+import { likeContains, orderByQuery, pageQuery, pageRange, paginate } from "@frigear-nu/module-kit/server";
+import { toApplication, toAdminApplicationDto } from "../../../utils/oauth-applications.js";
+const querySchema = pageQuery({ sort: ["createdAt", "name", "priority"] });
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const applications = await listApplications();
-  const grants = await countActiveGrants(applications.map((application) => application.id));
-  return applications.map((application) => ({
-    ...application,
-    activeGrants: grants[application.id] ?? 0,
-    // The redirect URI applications have to register on their side.
-    callbackUrl: `${application.websiteUrl}${useOAuthConfig().callbackPath}`
-  }));
+  const query = await getValidatedQuery(event, querySchema.parse);
+  const table = schema.oauthApplications;
+  const where = query.q ? or(likeContains(table.name, query.q), likeContains(table.id, query.q)) : void 0;
+  const orderBy = orderByQuery({ createdAt: table.createdAt, name: table.name, priority: table.priority }, query, { tiebreaker: table.id });
+  const { limit, offset } = pageRange(query);
+  const [rows, [totals]] = await Promise.all([
+    db.select().from(table).where(where).orderBy(...orderBy).limit(limit).offset(offset),
+    db.select({ total: count() }).from(table).where(where)
+  ]);
+  const grants = await countActiveGrants(rows.map((row) => row.id));
+  return paginate({
+    total: totals?.total ?? 0,
+    query,
+    items: rows.map((row) => toAdminApplicationDto(toApplication(row), grants[row.id] ?? 0))
+  });
 });

package/dist/runtime/server/routes/api/admin/applications.post.js

@@ -1,8 +1,8 @@
-import { applicationInputSchema } from "../../../utils/oauth-applications.js";
+import { created } from "@frigear-nu/module-kit/server";
+import { applicationInputSchema, toAdminApplicationDto } from "../../../utils/oauth-applications.js";
 export default defineEventHandler(async (event) => {
   const { userId } = await requireOAuthAdmin(event);
   const input = await readValidatedBody(event, applicationInputSchema.parse);
   const { application, secret } = await createApplication(input, userId);
-  setResponseStatus(event, 201);
-  return { ...application, clientId: application.id, clientSecret: secret };
+  return created(event, { ...toAdminApplicationDto(application, 0), clientId: application.id, clientSecret: secret });
 });

package/dist/runtime/server/routes/api/consent.get.js

@@ -1,9 +1,10 @@
 import { getQuery } from "h3";
+import { parseAuthorizeRequest } from "../../utils/oauth-authorize.js";
 export default defineEventHandler(async (event) => {
   const userId = await requireSessionUserId(event);
-  const { application, scope } = await validateAuthorizeRequest(getQuery(event));
-  const user = await getOAuthUser(userId);
-  if (!user) throw createError({ statusCode: 401, statusMessage: "Unknown user." });
+  const query = parseAuthorizeRequest(getQuery(event));
+  const { application, scope } = await validateAuthorizeRequest(query);
+  const user = await requireOAuthUser(userId);
   await assertApplicationAccess(event, user, application);
   return {
     application: {

package/dist/runtime/server/routes/api/me-applications.get.js

@@ -1,4 +1,2 @@
-export default defineEventHandler(async (event) => {
-  const userId = await requireSessionUserId(event);
-  return listUserApplications(userId, event);
-});
+import myApplications from "../../bootstrap/my-applications.js";
+export default defineEventHandler(myApplications);

package/dist/runtime/server/routes/oidc/authorize.get.js

@@ -1,15 +1,14 @@
 import { getQuery, getRequestURL, sendRedirect } from "h3";
+import { parseAuthorizeRequest } from "../../utils/oauth-authorize.js";
 export default defineEventHandler(async (event) => {
-  const query = getQuery(event);
+  const query = parseAuthorizeRequest(getQuery(event));
   const { application } = await validateAuthorizeRequest(query);
+  const url = getRequestURL(event);
   const session = await getUserSession(event);
   if (!session.user) {
-    const url2 = getRequestURL(event);
-    return sendRedirect(event, `${getSignInPath()}?redirect=${encodeURIComponent(`${url2.pathname}${url2.search}`)}`, 302);
+    return sendRedirect(event, `${getSignInPath()}?redirect=${encodeURIComponent(`${url.pathname}${url.search}`)}`, 302);
   }
-  const user = await getOAuthUser(Number(session.user.id));
-  if (!user) throw createError({ statusCode: 401, statusMessage: "Unknown user." });
+  const user = await requireOAuthUser(await requireSessionUserId(event));
   await assertApplicationAccess(event, user, application);
-  const url = getRequestURL(event);
   return sendRedirect(event, `${useOAuthConfig().authorizePath}${url.search}`, 302);
 });

package/dist/runtime/server/routes/oidc/authorize.post.js

@@ -11,8 +11,7 @@ export default defineEventHandler(async (event) => {
     redirect.searchParams.set("error", "access_denied");
     return { redirectUrl: redirect.toString() };
   }
-  const user = await getOAuthUser(userId);
-  if (!user) throw createError({ statusCode: 401, statusMessage: "Unknown user." });
+  const user = await requireOAuthUser(userId);
   await assertApplicationAccess(event, user, application);
   const code = await createAuthorizationCode({
     application,

package/dist/runtime/server/routes/oidc/openid-configuration.get.js

@@ -1,20 +1,22 @@
+import { oidc } from "../../../utils/api.js";
 export default defineEventHandler((event) => {
   const issuer = getOAuthIssuer(event);
   setResponseHeader(event, "Cache-Control", "public, max-age=3600");
   return {
     issuer,
-    authorization_endpoint: `${issuer}/oauth/authorize`,
-    token_endpoint: `${issuer}/oauth/token`,
-    userinfo_endpoint: `${issuer}/oauth/userinfo`,
-    revocation_endpoint: `${issuer}/oauth/revoke`,
-    jwks_uri: `${issuer}/.well-known/jwks.json`,
+    authorization_endpoint: `${issuer}${oidc.authorize}`,
+    token_endpoint: `${issuer}${oidc.token}`,
+    userinfo_endpoint: `${issuer}${oidc.userinfo}`,
+    revocation_endpoint: `${issuer}${oidc.revoke}`,
+    jwks_uri: `${issuer}${oidc.jwks}`,
     response_types_supported: ["code"],
     response_modes_supported: ["query"],
     grant_types_supported: ["authorization_code", "refresh_token"],
     subject_types_supported: ["public"],
     id_token_signing_alg_values_supported: ["RS256"],
     scopes_supported: getSupportedScopes(),
-    token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
+    // `none`: public clients (native apps, SPAs) identify with `client_id` and PKCE only.
+    token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post", "none"],
     code_challenge_methods_supported: ["S256"],
     claims_supported: ["sub", "iss", "aud", "exp", "iat", "auth_time", "nonce", "name", "picture", "email"]
   };

package/dist/runtime/server/routes/oidc/revoke.post.js

@@ -1,13 +1,25 @@
-import { readBody } from "h3";
+import { z } from "zod";
+const param = z.string().max(4096).optional();
+const bodySchema = z.object({
+  token: param,
+  token_type_hint: param,
+  client_id: param,
+  client_secret: param
+});
 export default defineEventHandler(async (event) => {
-  const body = await readBody(event).catch(() => void 0);
-  const credentials = readClientCredentials(event, body);
-  const row = credentials ? await getApplicationRow(credentials.clientId) : null;
-  if (!credentials || !row || !await verifyApplicationSecret(row, credentials.clientSecret)) {
-    if (credentials?.basic) setResponseHeader(event, "WWW-Authenticate", "Basic");
+  let body;
+  try {
+    body = await readValidatedBody(event, bodySchema.parse);
+  } catch (error) {
+    return oauthError(event, 400, "invalid_request", invalidRequestDescription(error));
+  }
+  const client = await authenticateClient(event, body);
+  if (!("row" in client)) {
+    if (client.basic) setResponseHeader(event, "WWW-Authenticate", "Basic");
     return oauthError(event, 401, "invalid_client", "Client authentication failed.");
   }
-  if (typeof body?.token === "string") await revokeRefreshToken(body.token, row.id);
+  const row = client.row;
+  if (body.token) await revokeRefreshToken(body.token, row.id);
   setResponseStatus(event, 200);
   return {};
 });

package/dist/runtime/server/routes/oidc/token.post.js

@@ -1,21 +1,36 @@
-import { readBody } from "h3";
+import { z } from "zod";
+const param = z.string().max(4096).optional();
+const bodySchema = z.object({
+  grant_type: param,
+  code: param,
+  redirect_uri: param,
+  code_verifier: param,
+  refresh_token: param,
+  client_id: param,
+  client_secret: param
+});
 export default defineEventHandler(async (event) => {
   setResponseHeader(event, "Cache-Control", "no-store");
   setResponseHeader(event, "Pragma", "no-cache");
-  const body = await readBody(event).catch(() => void 0);
-  const credentials = readClientCredentials(event, body);
-  const row = credentials ? await getApplicationRow(credentials.clientId) : null;
-  if (!credentials || !row || !await verifyApplicationSecret(row, credentials.clientSecret)) {
-    if (credentials?.basic) setResponseHeader(event, "WWW-Authenticate", "Basic");
+  let body;
+  try {
+    body = await readValidatedBody(event, bodySchema.parse);
+  } catch (error) {
+    return oauthError(event, 400, "invalid_request", invalidRequestDescription(error));
+  }
+  const client = await authenticateClient(event, body);
+  if (!("row" in client)) {
+    if (client.basic) setResponseHeader(event, "WWW-Authenticate", "Basic");
     return oauthError(event, 401, "invalid_client", "Client authentication failed.");
   }
+  const row = client.row;
   const application = toApplication(row);
-  const grantType = body?.grant_type;
+  const grantType = body.grant_type;
   let grant;
   let refreshToken;
   if (grantType === "authorization_code") {
     const { code, redirect_uri: redirectUri, code_verifier: codeVerifier } = body;
-    if (typeof code !== "string" || typeof redirectUri !== "string" || typeof codeVerifier !== "string") {
+    if (!code || !redirectUri || !codeVerifier) {
       return oauthError(event, 400, "invalid_request", "code, redirect_uri and code_verifier are required.");
     }
     const result = await exchangeAuthorizationCode({ code, application, redirectUri, codeVerifier });
@@ -23,7 +38,7 @@ export default defineEventHandler(async (event) => {
     grant = result.grant;
     refreshToken = (await createRefreshToken({ applicationId: application.id, ...grant })).token;
   } else if (grantType === "refresh_token") {
-    if (typeof body?.refresh_token !== "string") return oauthError(event, 400, "invalid_request", "refresh_token is required.");
+    if (!body.refresh_token) return oauthError(event, 400, "invalid_request", "refresh_token is required.");
     const result = await rotateRefreshToken({ token: body.refresh_token, application });
     if ("error" in result) return oauthError(event, 400, "invalid_grant", result.error);
     grant = result.grant;

package/dist/runtime/server/utils/oauth-access.d.ts

@@ -3,6 +3,8 @@ import type { OAuthApplication, OAuthUser, TokenType } from '../../../types.js';
 export declare function requireOAuthAdmin(event: H3Event): Promise<{
     userId: number;
 }>;
+/** The signed-in user as stored, or 401 `unauthorized` when the account no longer exists. */
+export declare function requireOAuthUser(userId: number): Promise<OAuthUser>;
 /** The user's roles as reported by the `oauth:user:roles` hook listeners (none without a listener). */
 export declare function resolveUserRoles(userId: number, event?: H3Event): Promise<string[]>;
 /** The stored user without the password hash; includes columns the host added to `users`. */

package/dist/runtime/server/utils/oauth-access.js

@@ -1,10 +1,16 @@
+import { apiError, forbidden } from "@frigear-nu/module-kit/server";
 import { matchesAllowedRoles } from "../../utils/index.js";
 const adminGate = definePolicyGate("oauth:authorize");
 export async function requireOAuthAdmin(event) {
   const userId = await requireSessionUserId(event);
-  await adminGate.assert(event, userId, "You are not allowed to manage OAuth applications.");
+  if (!await adminGate.isAllowed(event, userId)) throw forbidden("You are not allowed to manage OAuth applications.");
   return { userId };
 }
+export async function requireOAuthUser(userId) {
+  const user = await getOAuthUser(userId);
+  if (!user) throw apiError(401, "unauthorized", "Unknown user.");
+  return user;
+}
 export async function resolveUserRoles(userId, event) {
   const ctx = { event, userId, roles: [] };
   await useNitroApp().hooks.callHook("oauth:user:roles", ctx);

package/dist/runtime/server/utils/oauth-applications.d.ts

@@ -1,10 +1,14 @@
 import { schema } from '@nuxthub/db';
 import { z } from 'zod';
 import type { H3Event } from 'h3';
-import type { ApplicationInput, OAuthApplication, UserApplicationDto } from '../../../types.js';
+import type { AdminApplicationDto, ApplicationInput, OAuthApplication, UserApplicationDto } from '../../../types.js';
 type ApplicationRow = typeof schema.oauthApplications.$inferSelect;
 /** Validation shared by the admin API and `createApplication` / `updateApplication`. */
 export declare const applicationInputSchema: z.ZodObject<{
+    clientType: z.ZodOptional<z.ZodEnum<{
+        confidential: "confidential";
+        public: "public";
+    }>>;
     name: z.ZodString;
     websiteUrl: z.ZodString;
     description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -18,6 +22,10 @@ export declare const applicationInputSchema: z.ZodObject<{
     isActive: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export declare const applicationPatchSchema: z.ZodObject<{
+    clientType: z.ZodOptional<z.ZodOptional<z.ZodEnum<{
+        confidential: "confidential";
+        public: "public";
+    }>>>;
     name: z.ZodOptional<z.ZodString>;
     websiteUrl: z.ZodOptional<z.ZodString>;
     description: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
@@ -31,14 +39,22 @@ export declare const applicationPatchSchema: z.ZodObject<{
     isActive: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
 }, z.core.$strip>;
 export declare function toApplication(row: ApplicationRow): OAuthApplication;
+/** The redirect URI an application has to accept on its side: its website plus the configured callback path. */
+export declare function applicationCallbackUrl(application: Pick<OAuthApplication, 'websiteUrl'>): string;
+/** The admin view of an application (never the secret hash), with the active sign-ins when counted. */
+export declare function toAdminApplicationDto(application: OAuthApplication, activeGrants?: number): AdminApplicationDto;
+/** One application for a staff route, or 404 `not_found`. */
+export declare function requireApplication(id: string): Promise<OAuthApplication>;
 /** The row including `secretHash`; only for credential checks. Use `getApplication` everywhere else. */
 export declare function getApplicationRow(id: string): Promise<ApplicationRow | null>;
 export declare function getApplication(id: string): Promise<OAuthApplication | null>;
-export declare function listApplications(): Promise<OAuthApplication[]>;
-/** Creates an application. The returned `secret` is the only time the plain secret is available. */
+/**
+ * Creates an application. The returned `secret` is the only time the plain secret is available; it is `null` for
+ * `public` clients, which have none.
+ */
 export declare function createApplication(input: ApplicationInput, ownerId?: number | null): Promise<{
     application: OAuthApplication;
-    secret: string;
+    secret: string | null;
 }>;
 export declare function updateApplication(id: string, patch: Partial<ApplicationInput>): Promise<OAuthApplication>;
 /** Deletes the application with its authorization codes and refresh tokens. */
@@ -48,6 +64,16 @@ export declare function rotateApplicationSecret(id: string): Promise<{
     secret: string;
 }>;
 export declare function verifyApplicationSecret(row: ApplicationRow, secret: string): Promise<boolean>;
+/**
+ * Authenticates the client of a token or revocation request. Confidential clients must present their secret. Public
+ * clients are identified by `client_id` alone (their security is PKCE plus refresh token rotation); a secret sent to one
+ * is refused, as it can only mean the app was configured with the wrong kind of client.
+ */
+export declare function authenticateClient(event: H3Event, body: Record<string, unknown> | undefined): Promise<{
+    row: ApplicationRow;
+} | {
+    basic: boolean;
+}>;
 /** Revokes every refresh token of an application (e.g. after a secret leak). */
 export declare function revokeApplicationGrants(applicationId: string): Promise<void>;
 /**

package/dist/runtime/server/utils/oauth-applications.js

@@ -1,8 +1,9 @@
 import { and, desc, eq, inArray } from "drizzle-orm";
 import { db, schema } from "@nuxthub/db";
 import { z } from "zod";
-import { isSecureOrigin, matchesAllowedRoles, newId, normalizeWebsiteUrl } from "../../utils/index.js";
-const fail = (statusCode, statusMessage) => createError({ statusCode, statusMessage });
+import { badRequest, isoDate, notFound } from "@frigear-nu/module-kit/server";
+import { CLIENT_TYPES, isNativeRedirectUri, isSecureOrigin, matchesAllowedRoles, newId, normalizeWebsiteUrl } from "../../utils/index.js";
+const applicationNotFound = () => notFound("Application not found.");
 const httpsUrl = z.string().trim().max(2048).refine((value) => {
   try {
     return isSecureOrigin(new URL(value));
@@ -10,8 +11,17 @@ const httpsUrl = z.string().trim().max(2048).refine((value) => {
     return false;
   }
 }, "Must be a https URL (http is only allowed for localhost).");
+const redirectUri = z.string().trim().max(2048).refine((value) => {
+  try {
+    const url = new URL(value);
+    return !url.hash && (isSecureOrigin(url) || isNativeRedirectUri(url));
+  } catch {
+    return false;
+  }
+}, "Must be a https URL (http is only allowed for localhost) or, for public clients, a custom-scheme URI.");
 const names = z.array(z.string().trim().min(1).max(64)).max(50);
 export const applicationInputSchema = z.object({
+  clientType: z.enum(CLIENT_TYPES).optional(),
   name: z.string().trim().min(1).max(120),
   websiteUrl: z.string().trim().max(2048),
   description: z.string().trim().max(1e3).nullish(),
@@ -19,7 +29,7 @@ export const applicationInputSchema = z.object({
   priority: z.number().int().min(-1e3).max(1e3).optional(),
   loginUrl: httpsUrl.nullish(),
   previewUrlPattern: z.string().trim().max(2048).startsWith("https://").nullish(),
-  redirectUris: z.array(httpsUrl).max(20).optional(),
+  redirectUris: z.array(redirectUri).max(20).optional(),
   allowedRoles: names.optional(),
   tags: names.optional(),
   isActive: z.boolean().optional()
@@ -29,19 +39,54 @@ export function toApplication(row) {
   const { secretHash: _secretHash, ...application } = row;
   return application;
 }
+export function applicationCallbackUrl(application) {
+  return `${application.websiteUrl}${useOAuthConfig().callbackPath}`;
+}
+export function toAdminApplicationDto(application, activeGrants) {
+  return {
+    id: application.id,
+    clientType: application.clientType,
+    name: application.name,
+    description: application.description,
+    icon: application.icon,
+    priority: application.priority,
+    websiteUrl: application.websiteUrl,
+    loginUrl: application.loginUrl,
+    previewUrlPattern: application.previewUrlPattern,
+    redirectUris: application.redirectUris,
+    allowedRoles: application.allowedRoles,
+    tags: application.tags,
+    ownerId: application.ownerId,
+    isActive: application.isActive,
+    createdAt: isoDate(application.createdAt),
+    updatedAt: isoDate(application.updatedAt),
+    ...activeGrants === void 0 ? {} : { activeGrants },
+    callbackUrl: applicationCallbackUrl(application)
+  };
+}
+export async function requireApplication(id) {
+  const application = await getApplication(id);
+  if (!application) throw applicationNotFound();
+  return application;
+}
 function normalizeInput(input) {
   const next = { ...input };
   if (next.websiteUrl !== void 0) {
     try {
       next.websiteUrl = normalizeWebsiteUrl(next.websiteUrl);
     } catch (error) {
-      throw fail(400, error.message);
+      throw badRequest(error.message);
     }
   }
+  if (next.redirectUris) next.redirectUris = [...new Set(next.redirectUris)];
   if (next.allowedRoles) next.allowedRoles = [...new Set(next.allowedRoles)].sort();
   if (next.tags) next.tags = [...new Set(next.tags)];
   return next;
 }
+function assertRedirectUris(uris, clientType) {
+  if (clientType === "public" || !uris) return;
+  if (uris.some((uri) => !isSecureOrigin(new URL(uri)))) throw badRequest("Only public clients may use custom-scheme redirect URIs.");
+}
 export async function getApplicationRow(id) {
   const [row] = await db.select().from(schema.oauthApplications).where(eq(schema.oauthApplications.id, id)).limit(1);
   return row ?? null;
@@ -50,43 +95,58 @@ export async function getApplication(id) {
   const row = await getApplicationRow(id);
   return row ? toApplication(row) : null;
 }
-export async function listApplications() {
-  const rows = await db.select().from(schema.oauthApplications).orderBy(desc(schema.oauthApplications.priority), schema.oauthApplications.name);
-  return rows.map(toApplication);
-}
 export async function createApplication(input, ownerId) {
   const data = normalizeInput(applicationInputSchema.parse(input));
-  const secret = generateSecret();
+  const clientType = data.clientType ?? "confidential";
+  assertRedirectUris(data.redirectUris, clientType);
+  const secret = clientType === "public" ? null : generateSecret();
   const [row] = await db.insert(schema.oauthApplications).values({
     id: newId("app"),
-    secretHash: await sha256Hex(secret),
     ownerId: ownerId ?? null,
-    ...data
+    ...data,
+    clientType,
+    // A public client has no secret to hash; see `secretHash` in the schema.
+    secretHash: await sha256Hex(secret ?? generateSecret())
   }).returning();
   return { application: toApplication(row), secret };
 }
 export async function updateApplication(id, patch) {
-  const data = normalizeInput(applicationPatchSchema.parse(patch));
-  const [row] = Object.keys(data).length ? await db.update(schema.oauthApplications).set(data).where(eq(schema.oauthApplications.id, id)).returning() : [await getApplicationRow(id)];
-  if (!row) throw fail(404, "Application not found.");
-  return toApplication(row);
+  const { clientType, ...data } = normalizeInput(applicationPatchSchema.parse(patch));
+  const existing = await getApplicationRow(id);
+  if (!existing) throw applicationNotFound();
+  if (clientType && clientType !== existing.clientType) throw badRequest("The client type cannot be changed.");
+  assertRedirectUris(data.redirectUris, existing.clientType);
+  if (!Object.keys(data).length) return toApplication(existing);
+  const [row] = await db.update(schema.oauthApplications).set(data).where(eq(schema.oauthApplications.id, id)).returning();
+  return toApplication(row ?? existing);
 }
 export async function deleteApplication(id) {
   await db.delete(schema.oauthRefreshTokens).where(eq(schema.oauthRefreshTokens.applicationId, id));
   await db.delete(schema.oauthAuthorizationCodes).where(eq(schema.oauthAuthorizationCodes.applicationId, id));
   const deleted = await db.delete(schema.oauthApplications).where(eq(schema.oauthApplications.id, id)).returning({ id: schema.oauthApplications.id });
-  if (!deleted.length) throw fail(404, "Application not found.");
+  if (!deleted.length) throw applicationNotFound();
 }
 export async function rotateApplicationSecret(id) {
+  const existing = await getApplicationRow(id);
+  if (existing?.clientType === "public") throw badRequest("Public clients have no client secret.");
   const secret = generateSecret();
   const updated = await db.update(schema.oauthApplications).set({ secretHash: await sha256Hex(secret) }).where(eq(schema.oauthApplications.id, id)).returning({ id: schema.oauthApplications.id });
-  if (!updated.length) throw fail(404, "Application not found.");
+  if (!updated.length) throw applicationNotFound();
   await revokeApplicationGrants(id);
   return { secret };
 }
 export async function verifyApplicationSecret(row, secret) {
   return safeEqual(await sha256Hex(secret), row.secretHash);
 }
+export async function authenticateClient(event, body) {
+  const auth = readClientAuth(event, body);
+  const row = auth ? await getApplicationRow(auth.clientId) : null;
+  const basic = auth?.basic ?? false;
+  if (!auth || !row) return { basic };
+  if (row.clientType === "public") return auth.clientSecret ? { basic } : { row };
+  if (!auth.clientSecret || !await verifyApplicationSecret(row, auth.clientSecret)) return { basic };
+  return { row };
+}
 export async function revokeApplicationGrants(applicationId) {
   await db.update(schema.oauthRefreshTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(eq(schema.oauthRefreshTokens.applicationId, applicationId));
   await useNitroApp().hooks.callHook("oauth:token:revoked", { applicationId, userId: null, reason: "revoked" });

package/dist/runtime/server/utils/oauth-authorize.d.ts

@@ -14,11 +14,15 @@ export declare const authorizeRequestSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type AuthorizeRequest = z.infer<typeof authorizeRequestSchema>;
 /**
- * Parses and validates an authorization request: known, active client, an allowed redirect URI, PKCE
- * (S256 is mandatory) and the scopes. Failures are plain HTTP errors because the redirect URI cannot
- * be trusted to carry them yet.
+ * Parses the authorization request parameters (a query or a body). Failures are a
+ * plain 400 `bad_request` naming the bad parameters, because the redirect URI cannot be trusted to carry them yet.
  */
-export declare function validateAuthorizeRequest(input: unknown): Promise<{
+export declare function parseAuthorizeRequest(input: unknown): AuthorizeRequest;
+/**
+ * Validates a parsed authorization request: known, active client, an allowed redirect URI and the scopes (PKCE with
+ * S256 is enforced by the schema). Failures are plain HTTP errors because the redirect URI cannot be trusted yet.
+ */
+export declare function validateAuthorizeRequest(request: AuthorizeRequest): Promise<{
     request: AuthorizeRequest;
     application: OAuthApplication;
     scope: string[];

package/dist/runtime/server/utils/oauth-authorize.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { badRequest, forbidden } from "@frigear-nu/module-kit/server";
 import { resolveScope, validateRedirectUri } from "../../utils/index.js";
 export const authorizeRequestSchema = z.object({
   client_id: z.string().min(1),
@@ -10,22 +11,23 @@ export const authorizeRequestSchema = z.object({
   scope: z.string().max(1024).optional(),
   nonce: z.string().max(512).optional()
 });
-const fail = (statusCode, statusMessage) => createError({ statusCode, statusMessage });
-export async function validateAuthorizeRequest(input) {
+export function parseAuthorizeRequest(input) {
   const parsed = authorizeRequestSchema.safeParse(input);
-  if (!parsed.success) throw fail(400, `Invalid authorization request: ${parsed.error.issues.map((issue) => `${issue.path.join(".")} ${issue.message}`).join(", ")}`);
-  const request = parsed.data;
+  if (!parsed.success) throw badRequest(`Invalid authorization request: ${parsed.error.issues.map((issue) => `${issue.path.join(".")} ${issue.message}`).join(", ")}`);
+  return parsed.data;
+}
+export async function validateAuthorizeRequest(request) {
   const application = await getApplication(request.client_id);
-  if (!application || !application.isActive) throw fail(400, "Unknown or disabled application.");
-  const valid = validateRedirectUri(request.redirect_uri, { ...application, callbackPath: useOAuthConfig().callbackPath });
-  if (!valid) throw fail(400, "The redirect_uri is not allowed for this application.");
+  if (!application || !application.isActive) throw badRequest("Unknown or disabled application.");
+  const valid = validateRedirectUri(request.redirect_uri, { ...application, callbackPath: useOAuthConfig().callbackPath, allowNativeRedirects: application.clientType === "public" });
+  if (!valid) throw badRequest("The redirect_uri is not allowed for this application.");
   const scope = resolveScope(request.scope, getSupportedScopes());
-  if (scope.length === 0) throw fail(400, "None of the requested scopes is supported.");
+  if (scope.length === 0) throw badRequest("None of the requested scopes is supported.");
   return { request, application, scope };
 }
 export async function assertApplicationAccess(event, user, application) {
   const access = await checkApplicationAccess(user, application, event);
-  if (!access.allowed) throw fail(403, access.reason ?? "You do not have access to this application.");
+  if (!access.allowed) throw forbidden(access.reason ?? "You do not have access to this application.");
 }
 export function getSignInPath() {
   const config = useRuntimeConfig();

package/dist/runtime/server/utils/oauth-config.d.ts

@@ -1,5 +1,7 @@
 import type { H3Event } from 'h3';
 export declare function useOAuthConfig(): any;
+/** Origins allowed to call the token, revocation, userinfo and discovery endpoints from a browser. Never `*`. */
+export declare function getOAuthCorsOrigins(): string[];
 /** The configured issuer, or the origin the request came in on (honouring `x-forwarded-*`). */
 export declare function getOAuthIssuer(event: H3Event): string;
 /**
@@ -17,3 +19,8 @@ export declare function oauthError(event: H3Event, statusCode: number, error: st
     error_description?: string | undefined;
     error: string;
 };
+/**
+ * The `error_description` for a token or revocation request whose body failed `readValidatedBody` (h3's 400 with the
+ * zod issues in `data`, or unparsable JSON), so the route can still answer the RFC 6749 `invalid_request` body.
+ */
+export declare function invalidRequestDescription(error: unknown): string;

package/dist/runtime/server/utils/oauth-config.js

@@ -2,6 +2,11 @@ import { scopes as apiScopes } from "#auth/scopes";
 export function useOAuthConfig() {
   return useRuntimeConfig().oauthServer;
 }
+export function getOAuthCorsOrigins() {
+  const configured = useOAuthConfig().corsOrigins;
+  const list = Array.isArray(configured) ? configured : String(configured ?? "").split(",");
+  return list.map((origin) => origin.trim()).filter((origin) => origin && origin !== "*");
+}
 export function getOAuthIssuer(event) {
   const configured = useOAuthConfig().issuer;
   const issuer = configured || getRequestURL(event, { xForwardedHost: true, xForwardedProto: true }).origin;
@@ -19,3 +24,8 @@ export function oauthError(event, statusCode, error, description) {
   setResponseHeader(event, "Cache-Control", "no-store");
   return { error, ...description ? { error_description: description } : {} };
 }
+export function invalidRequestDescription(error) {
+  const issues = error?.data?.issues;
+  if (!Array.isArray(issues) || !issues.length) return "The request body is malformed.";
+  return `Invalid request: ${issues.map((issue) => [issue.path?.map(String).join("."), issue.message].filter(Boolean).join(" ")).join(", ")}`;
+}

package/dist/runtime/server/utils/oauth-crypto.d.ts

@@ -8,9 +8,16 @@ export declare function safeEqual(a: string, b: string): boolean;
 export declare function computeCodeChallenge(verifier: string): Promise<string>;
 export declare function verifyCodeChallenge(verifier: string, challenge: string): Promise<boolean>;
 /**
- * Client credentials from the `Authorization: Basic` header (id and secret are form-urlencoded and
- * split on the *first* colon, RFC 6749 §2.3.1) or from the request body.
+ * Client authentication data from the `Authorization: Basic` header (id and secret are form-urlencoded and split on
+ * the *first* colon, RFC 6749 §2.3.1) or from the request body. The secret is empty when none was sent, which is what
+ * public clients do. Whether that is acceptable depends on the application (see `authenticateClient`).
  */
+export declare function readClientAuth(event: H3Event, body: Record<string, unknown> | undefined): {
+    clientId: string;
+    clientSecret: string;
+    basic: boolean;
+} | null;
+/** Client credentials that include a secret, or `null`. Confidential clients only; see `readClientAuth`. */
 export declare function readClientCredentials(event: H3Event, body: Record<string, unknown> | undefined): {
     clientId: string;
     clientSecret: string;