@frigear-nu/oauth-server 0.1.1 → 0.1.3

package/dist/runtime/server/utils/oauth-crypto.js

@@ -26,15 +26,17 @@ export async function computeCodeChallenge(verifier) {
 export async function verifyCodeChallenge(verifier, challenge) {
   return safeEqual(await computeCodeChallenge(verifier), challenge);
 }
-export function readClientCredentials(event, body) {
+export function readClientAuth(event, body) {
   const header = getHeader(event, "authorization");
   if (header?.toLowerCase().startsWith("basic ")) {
     try {
       const decoded = atob(header.slice(6).trim());
       const index = decoded.indexOf(":");
       if (index === -1) return null;
+      const clientId2 = decodeURIComponent(decoded.slice(0, index).replace(/\+/g, " "));
+      if (!clientId2) return null;
       return {
-        clientId: decodeURIComponent(decoded.slice(0, index).replace(/\+/g, " ")),
+        clientId: clientId2,
         clientSecret: decodeURIComponent(decoded.slice(index + 1).replace(/\+/g, " ")),
         basic: true
       };
@@ -43,6 +45,10 @@ export function readClientCredentials(event, body) {
     }
   }
   const clientId = typeof body?.client_id === "string" ? body.client_id : "";
-  const clientSecret = typeof body?.client_secret === "string" ? body.client_secret : "";
-  return clientId && clientSecret ? { clientId, clientSecret, basic: false } : null;
+  if (!clientId) return null;
+  return { clientId, clientSecret: typeof body?.client_secret === "string" ? body.client_secret : "", basic: false };
+}
+export function readClientCredentials(event, body) {
+  const auth = readClientAuth(event, body);
+  return auth?.clientSecret ? auth : null;
 }

package/dist/runtime/server/utils/oauth-keys.js

@@ -1,8 +1,9 @@
 import { exportJWK, importPKCS8, importSPKI } from "jose";
+import { apiError } from "@frigear-nu/module-kit/server";
 export function normalizePemKey(raw) {
   return raw.trim().replace(/^["']|["']$/g, "").replace(/\\n/g, "\n").trim();
 }
-const notConfigured = () => createError({ statusCode: 500, statusMessage: "The OAuth server signing keys are not configured." });
+const notConfigured = () => apiError(500, "not_configured", "The OAuth server signing keys are not configured.");
 let cache;
 async function loadKeys() {
   const config = useOAuthConfig();
@@ -31,7 +32,7 @@ function parsePreviousKeys() {
     const parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
     return Object.fromEntries(Object.entries(parsed).map(([kid, pem]) => [kid, normalizePemKey(String(pem))]));
   } catch {
-    throw createError({ statusCode: 500, statusMessage: "The OAuth server previous public keys are not valid JSON." });
+    throw apiError(500, "not_configured", "The OAuth server previous public keys are not valid JSON.");
   }
 }
 let previousCache;

package/dist/runtime/utils/api.d.ts

@@ -0,0 +1,28 @@
+/** The module API: the consent data and the caller's applications under `/api/oauth-server`, staff routes under `/api/admin/oauth-server`. */
+export declare const oauthServerApi: {
+    /** `GET`: data for the consent screen (the authorization request's parameters as the query). */
+    readonly consent: "/api/oauth-server/consent";
+    readonly me: {
+        /** `GET`: the applications the signed-in user may sign in to. */
+        readonly applications: "/api/oauth-server/me/applications";
+    };
+    readonly admin: {
+        /** `GET` (paginated) and `POST` (create, 201). */
+        readonly applications: "/api/admin/oauth-server/applications";
+        /** `GET`, `PATCH`, `DELETE` (204). */
+        readonly application: (id: string) => string;
+        /** `POST`: replaces the client secret and answers `{ clientSecret }` once. */
+        readonly rotateSecret: (id: string) => string;
+        /** `POST`: signs everyone out of the application; answers the application. */
+        readonly revoke: (id: string) => string;
+    };
+};
+/** The OAuth 2.0 / OpenID Connect endpoints, at their standard paths. */
+export declare const oidc: {
+    readonly configuration: "/.well-known/openid-configuration";
+    readonly jwks: "/.well-known/jwks.json";
+    readonly authorize: "/oauth/authorize";
+    readonly token: "/oauth/token";
+    readonly revoke: "/oauth/revoke";
+    readonly userinfo: "/oauth/userinfo";
+};

package/dist/runtime/utils/api.js

@@ -0,0 +1,27 @@
+const enc = encodeURIComponent;
+export const oauthServerApi = {
+  /** `GET`: data for the consent screen (the authorization request's parameters as the query). */
+  consent: "/api/oauth-server/consent",
+  me: {
+    /** `GET`: the applications the signed-in user may sign in to. */
+    applications: "/api/oauth-server/me/applications"
+  },
+  admin: {
+    /** `GET` (paginated) and `POST` (create, 201). */
+    applications: "/api/admin/oauth-server/applications",
+    /** `GET`, `PATCH`, `DELETE` (204). */
+    application: (id) => `/api/admin/oauth-server/applications/${enc(id)}`,
+    /** `POST`: replaces the client secret and answers `{ clientSecret }` once. */
+    rotateSecret: (id) => `/api/admin/oauth-server/applications/${enc(id)}/secret`,
+    /** `POST`: signs everyone out of the application; answers the application. */
+    revoke: (id) => `/api/admin/oauth-server/applications/${enc(id)}/revoke`
+  }
+};
+export const oidc = {
+  configuration: "/.well-known/openid-configuration",
+  jwks: "/.well-known/jwks.json",
+  authorize: "/oauth/authorize",
+  token: "/oauth/token",
+  revoke: "/oauth/revoke",
+  userinfo: "/oauth/userinfo"
+};

package/dist/runtime/utils/index.d.ts

@@ -1,6 +1,9 @@
 export type * from '../../types';
+export { oauthServerApi, oidc } from './api.js';
 export declare const DEFAULT_SCOPES: readonly ["openid", "profile", "email"];
 export declare const DEFAULT_CALLBACK_PATH = "/auth/frigear";
+/** `confidential` clients hold a secret; `public` clients (native and single-page apps) cannot and rely on PKCE alone. */
+export declare const CLIENT_TYPES: readonly ["confidential", "public"];
 /** Whether a user holding `roles` may use an application restricted to `allowedRoles`. Empty = everyone. */
 export declare function matchesAllowedRoles(allowedRoles: readonly string[] | null | undefined, roles: readonly string[]): boolean;
 /** Splits a space separated scope string and drops duplicates and blanks. */
@@ -9,6 +12,12 @@ export declare function parseScope(scope: string | null | undefined): string[];
 export declare function resolveScope(requested: string | null | undefined, supported: readonly string[]): string[];
 /** HTTPS is required, except for `localhost` / loopback development hosts. */
 export declare function isSecureOrigin(url: URL): boolean;
+/**
+ * A redirect URI that opens a native app: a private-use scheme such as `com.example.app:/callback` (RFC 8252 §7.1) or a
+ * webview origin such as `capacitor://localhost/callback`. No web or dangerous schemes, credentials, fragments or
+ * wildcards. Only meaningful for `public` clients, and always matched exactly.
+ */
+export declare function isNativeRedirectUri(value: string | URL): boolean;
 export declare function normalizeWebsiteUrl(value: string): string;
 /** `https://*.vercel.app` -> a regex matching one host label in place of `*`. Everything else is matched literally. */
 export declare function previewPatternToRegExp(pattern: string, callbackPath: string): RegExp;
@@ -17,8 +26,13 @@ export type RedirectUriRules = {
     previewUrlPattern?: string | null;
     redirectUris?: readonly string[] | null;
     callbackPath?: string;
+    /** Public clients only: also accept the native redirect URIs listed in `redirectUris`. */
+    allowNativeRedirects?: boolean;
 };
-/** Exact match on `websiteUrl + callbackPath`, an explicit extra redirect URI, or the preview pattern. */
+/**
+ * Exact match on `websiteUrl + callbackPath`, an explicit extra redirect URI, or the preview pattern. Native redirect URIs
+ * (see `isNativeRedirectUri`) are only accepted for public clients, and only when listed in `redirectUris`.
+ */
 export declare function validateRedirectUri(redirectUri: string, rules: RedirectUriRules): boolean;
 /** Prefixed random id, e.g. `newId('app')` -> `app_3f9c…`. */
 export declare function newId(prefix: string): string;

package/dist/runtime/utils/index.js

@@ -1,5 +1,25 @@
+export { oauthServerApi, oidc } from "./api.js";
 export const DEFAULT_SCOPES = ["openid", "profile", "email"];
 export const DEFAULT_CALLBACK_PATH = "/auth/frigear";
+export const CLIENT_TYPES = ["confidential", "public"];
+const NON_NATIVE_SCHEMES = /* @__PURE__ */ new Set([
+  "http:",
+  "https:",
+  "ws:",
+  "wss:",
+  "ftp:",
+  "file:",
+  "javascript:",
+  "data:",
+  "blob:",
+  "vbscript:",
+  "about:",
+  "mailto:",
+  "tel:",
+  "sms:",
+  "chrome:",
+  "view-source:"
+]);
 export function matchesAllowedRoles(allowedRoles, roles) {
   if (!allowedRoles || allowedRoles.length === 0) return true;
   return allowedRoles.some((role) => roles.includes(role));
@@ -16,6 +36,17 @@ export function isSecureOrigin(url) {
   if (url.protocol === "https:") return true;
   return url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
 }
+export function isNativeRedirectUri(value) {
+  let url;
+  try {
+    url = typeof value === "string" ? new URL(value) : value;
+  } catch {
+    return false;
+  }
+  if (!/^[a-z][a-z0-9+.-]*:$/.test(url.protocol) || NON_NATIVE_SCHEMES.has(url.protocol)) return false;
+  if (url.username || url.password || url.hash) return false;
+  return !url.href.includes("*");
+}
 export function normalizeWebsiteUrl(value) {
   let url;
   try {
@@ -40,7 +71,8 @@ export function validateRedirectUri(redirectUri, rules) {
   } catch {
     return false;
   }
-  if (url.hash || !isSecureOrigin(url)) return false;
+  if (url.hash) return false;
+  if (!isSecureOrigin(url)) return rules.allowNativeRedirects === true && isNativeRedirectUri(url) && !!rules.redirectUris?.includes(redirectUri);
   if (redirectUri === `${rules.websiteUrl.replace(/\/+$/, "")}${callbackPath}`) return true;
   if (rules.redirectUris?.includes(redirectUri)) return true;
   if (rules.previewUrlPattern) return previewPatternToRegExp(rules.previewUrlPattern, callbackPath).test(redirectUri);

package/dist/types.d.mts

@@ -1,3 +1,3 @@
 export { default } from './module.mjs'
 
-export { type AdminApplicationDto, type ApplicationAccessContext, type ApplicationInput, type AuthorizeContext, type ClaimsContext, type ConsentDto, type CreatedApplicationDto, type ModuleOptions, type OAuthApplication, type OAuthServerRuntimeConfig, type OAuthUser, type PublicModuleOptions, type TokenIssuedContext, type TokenRevokedContext, type TokenType, type UserApplicationDto, type UserRolesContext } from './module.mjs'
+export { type AdminApplicationDto, type AdminApplicationsPage, type ApplicationAccessContext, type ApplicationInput, type AuthorizeContext, type ClaimsContext, type ClientType, type ConsentDto, type CreatedApplicationDto, type ModuleOptions, type OAuthApplication, type OAuthServerRuntimeConfig, type OAuthUser, type PublicModuleOptions, type TokenIssuedContext, type TokenRevokedContext, type TokenType, type UserApplicationDto, type UserRolesContext } from './module.mjs'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frigear-nu/oauth-server",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "OAuth 2.0 / OpenID Connect server for the frigear ecosystem: register applications that users with certain roles may sign in to.",
   "url": "https://docs.frigear.dev/modules/oauth-server",
   "author": {
@@ -28,6 +28,11 @@
       "types": "./dist/runtime/utils/index.d.ts",
       "import": "./dist/runtime/utils/index.js",
       "default": "./dist/runtime/utils/index.js"
+    },
+    "./api": {
+      "types": "./dist/runtime/utils/api.d.ts",
+      "import": "./dist/runtime/utils/api.js",
+      "default": "./dist/runtime/utils/api.js"
     }
   },
   "files": [
@@ -37,12 +42,12 @@
     "playground"
   ],
   "dependencies": {
-    "@frigear-nu/admin": "0.1.1",
-    "@frigear-nu/module-kit": "1.1.1",
-    "@frigear-nu/ui": "0.1.1",
-    "@frigear-nu/auth": "0.1.2",
-    "@frigear-nu/mcp": "0.1.1",
-    "@frigear-nu/users": "1.1.2",
+    "@frigear-nu/admin": "0.1.3",
+    "@frigear-nu/module-kit": "1.1.3",
+    "@frigear-nu/ui": "0.1.3",
+    "@frigear-nu/auth": "0.1.4",
+    "@frigear-nu/mcp": "0.1.3",
+    "@frigear-nu/users": "1.1.4",
     "@libsql/client": "^0.18.0",
     "@nuxt/kit": "^4.6.1",
     "drizzle-kit": "^0.31.11",
@@ -52,8 +57,8 @@
     "zod": "^4.6.5"
   },
   "peerDependencies": {
-    "@frigear-nu/menu": "0.1.1",
-    "@nuxt/ui": "^4.11.2",
+    "@frigear-nu/menu": "0.1.3",
+    "@nuxt/ui": "^4.12.0",
     "@nuxthub/core": "^0.10.8"
   },
   "peerDependenciesMeta": {
@@ -65,13 +70,13 @@
     }
   },
   "devDependencies": {
-    "@frigear-nu/menu": "0.1.1",
+    "@frigear-nu/menu": "0.1.3",
     "@nuxt/devtools": "^3.4.2",
     "@nuxt/eslint-config": "^1.17.0",
     "@nuxt/module-builder": "^1.0.3",
     "@nuxt/schema": "^4.6.1",
     "@nuxt/test-utils": "^4.3.2",
-    "@nuxt/ui": "^4.11.2",
+    "@nuxt/ui": "^4.12.0",
     "@nuxthub/core": "^0.10.8",
     "@types/node": "^26.6.5",
     "changelogen": "^0.6.2",