@frigear-nu/oauth-server 0.1.2 → 0.1.3

package/dist/runtime/i18n/lang/da.json

@@ -16,6 +16,8 @@
       "new": "Tilføj applikation",
       "forbiddenTitle": "Du har ikke adgang til at administrere OAuth-applikationer",
       "forbiddenDescription": "Bed en administrator om adgang.",
+      "loadFailed": "OAuth-applikationer kunne ikke indlæses",
+      "tryAgain": "Prøv igen",
       "application": "Applikation",
       "access": "Adgang",
       "signedIn": "Logget ind",
@@ -44,7 +46,10 @@
       "enabled": "Applikationen er aktiveret",
       "disabledToast": "Applikationen er deaktiveret",
       "secretReplaced": "Klienthemmeligheden er skiftet",
-      "signedOut": "Alle er logget ud"
+      "signedOut": "Alle er logget ud",
+      "search": "Søg på navn eller klient-ID...",
+      "noMatches": "Ingen applikationer matcher",
+      "clearSearch": "Ryd søgning"
     },
     "form": {
       "createTitle": "Tilføj applikation",

package/dist/runtime/i18n/lang/en.json

@@ -16,6 +16,8 @@
       "new": "Add application",
       "forbiddenTitle": "You are not allowed to manage OAuth applications",
       "forbiddenDescription": "Ask an administrator for access.",
+      "loadFailed": "OAuth applications could not be loaded",
+      "tryAgain": "Try again",
       "application": "Application",
       "access": "Access",
       "signedIn": "Signed in",
@@ -44,7 +46,10 @@
       "enabled": "Application enabled",
       "disabledToast": "Application disabled",
       "secretReplaced": "Client secret replaced",
-      "signedOut": "Everyone signed out"
+      "signedOut": "Everyone signed out",
+      "search": "Search name or client ID...",
+      "noMatches": "No applications match",
+      "clearSearch": "Clear search"
     },
     "form": {
       "createTitle": "Add application",

package/dist/runtime/server/middleware/oauth-cors.js

@@ -1,9 +1,10 @@
+import { oidc } from "../../utils/api.js";
 const METHODS = {
-  "/oauth/token": "POST, OPTIONS",
-  "/oauth/revoke": "POST, OPTIONS",
-  "/oauth/userinfo": "GET, OPTIONS",
-  "/.well-known/openid-configuration": "GET, OPTIONS",
-  "/.well-known/jwks.json": "GET, OPTIONS"
+  [oidc.token]: "POST, OPTIONS",
+  [oidc.revoke]: "POST, OPTIONS",
+  [oidc.userinfo]: "GET, OPTIONS",
+  [oidc.configuration]: "GET, OPTIONS",
+  [oidc.jwks]: "GET, OPTIONS"
 };
 export default defineEventHandler((event) => {
   const methods = METHODS[getRequestURL(event).pathname];

package/dist/runtime/server/routes/api/admin/application-revoke.post.js

@@ -1,7 +1,9 @@
+import { idParams } from "@frigear-nu/module-kit/server";
+import { toAdminApplicationDto } from "../../../utils/oauth-applications.js";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const id = getRouterParam(event, "id") ?? "";
-  if (!await getApplication(id)) throw createError({ statusCode: 404, statusMessage: "Application not found." });
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  const application = await requireApplication(id);
   await revokeApplicationGrants(id);
-  return { revoked: true };
+  return toAdminApplicationDto(application, 0);
 });

package/dist/runtime/server/routes/api/admin/application-secret.post.js

@@ -1,5 +1,7 @@
+import { idParams } from "@frigear-nu/module-kit/server";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const { secret } = await rotateApplicationSecret(getRouterParam(event, "id") ?? "");
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  const { secret } = await rotateApplicationSecret(id);
   return { clientSecret: secret };
 });

package/dist/runtime/server/routes/api/admin/application.delete.js

@@ -1,6 +1,7 @@
+import { idParams, noContent } from "@frigear-nu/module-kit/server";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  await deleteApplication(getRouterParam(event, "id") ?? "");
-  setResponseStatus(event, 204);
-  return null;
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  await deleteApplication(id);
+  return noContent(event);
 });

package/dist/runtime/server/routes/api/admin/application.get.js

@@ -1,6 +1,9 @@
+import { idParams } from "@frigear-nu/module-kit/server";
+import { toAdminApplicationDto } from "../../../utils/oauth-applications.js";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const application = await getApplication(getRouterParam(event, "id") ?? "");
-  if (!application) throw createError({ statusCode: 404, statusMessage: "Application not found." });
-  return { ...application, callbackUrl: `${application.websiteUrl}${useOAuthConfig().callbackPath}` };
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  const application = await requireApplication(id);
+  const grants = await countActiveGrants([id]);
+  return toAdminApplicationDto(application, grants[id] ?? 0);
 });

package/dist/runtime/server/routes/api/admin/application.patch.js

@@ -1,9 +1,10 @@
-import { applicationPatchSchema } from "../../../utils/oauth-applications.js";
+import { idParams } from "@frigear-nu/module-kit/server";
+import { applicationPatchSchema, toAdminApplicationDto } from "../../../utils/oauth-applications.js";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const id = getRouterParam(event, "id") ?? "";
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
   const patch = await readValidatedBody(event, applicationPatchSchema.parse);
   const application = await updateApplication(id, patch);
   if (patch.isActive === false) await revokeApplicationGrants(id);
-  return application;
+  return toAdminApplicationDto(application);
 });

package/dist/runtime/server/routes/api/admin/applications.get.js

@@ -1,11 +1,23 @@
+import { db, schema } from "@nuxthub/db";
+import { count, or } from "drizzle-orm";
+import { likeContains, orderByQuery, pageQuery, pageRange, paginate } from "@frigear-nu/module-kit/server";
+import { toApplication, toAdminApplicationDto } from "../../../utils/oauth-applications.js";
+const querySchema = pageQuery({ sort: ["createdAt", "name", "priority"] });
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const applications = await listApplications();
-  const grants = await countActiveGrants(applications.map((application) => application.id));
-  return applications.map((application) => ({
-    ...application,
-    activeGrants: grants[application.id] ?? 0,
-    // The redirect URI applications have to register on their side.
-    callbackUrl: `${application.websiteUrl}${useOAuthConfig().callbackPath}`
-  }));
+  const query = await getValidatedQuery(event, querySchema.parse);
+  const table = schema.oauthApplications;
+  const where = query.q ? or(likeContains(table.name, query.q), likeContains(table.id, query.q)) : void 0;
+  const orderBy = orderByQuery({ createdAt: table.createdAt, name: table.name, priority: table.priority }, query, { tiebreaker: table.id });
+  const { limit, offset } = pageRange(query);
+  const [rows, [totals]] = await Promise.all([
+    db.select().from(table).where(where).orderBy(...orderBy).limit(limit).offset(offset),
+    db.select({ total: count() }).from(table).where(where)
+  ]);
+  const grants = await countActiveGrants(rows.map((row) => row.id));
+  return paginate({
+    total: totals?.total ?? 0,
+    query,
+    items: rows.map((row) => toAdminApplicationDto(toApplication(row), grants[row.id] ?? 0))
+  });
 });

package/dist/runtime/server/routes/api/admin/applications.post.js

@@ -1,8 +1,8 @@
-import { applicationInputSchema } from "../../../utils/oauth-applications.js";
+import { created } from "@frigear-nu/module-kit/server";
+import { applicationInputSchema, toAdminApplicationDto } from "../../../utils/oauth-applications.js";
 export default defineEventHandler(async (event) => {
   const { userId } = await requireOAuthAdmin(event);
   const input = await readValidatedBody(event, applicationInputSchema.parse);
   const { application, secret } = await createApplication(input, userId);
-  setResponseStatus(event, 201);
-  return { ...application, clientId: application.id, clientSecret: secret };
+  return created(event, { ...toAdminApplicationDto(application, 0), clientId: application.id, clientSecret: secret });
 });

package/dist/runtime/server/routes/api/consent.get.js

@@ -1,9 +1,10 @@
 import { getQuery } from "h3";
+import { parseAuthorizeRequest } from "../../utils/oauth-authorize.js";
 export default defineEventHandler(async (event) => {
   const userId = await requireSessionUserId(event);
-  const { application, scope } = await validateAuthorizeRequest(getQuery(event));
-  const user = await getOAuthUser(userId);
-  if (!user) throw createError({ statusCode: 401, statusMessage: "Unknown user." });
+  const query = parseAuthorizeRequest(getQuery(event));
+  const { application, scope } = await validateAuthorizeRequest(query);
+  const user = await requireOAuthUser(userId);
   await assertApplicationAccess(event, user, application);
   return {
     application: {

package/dist/runtime/server/routes/oidc/authorize.get.js

@@ -1,15 +1,14 @@
 import { getQuery, getRequestURL, sendRedirect } from "h3";
+import { parseAuthorizeRequest } from "../../utils/oauth-authorize.js";
 export default defineEventHandler(async (event) => {
-  const query = getQuery(event);
+  const query = parseAuthorizeRequest(getQuery(event));
   const { application } = await validateAuthorizeRequest(query);
+  const url = getRequestURL(event);
   const session = await getUserSession(event);
   if (!session.user) {
-    const url2 = getRequestURL(event);
-    return sendRedirect(event, `${getSignInPath()}?redirect=${encodeURIComponent(`${url2.pathname}${url2.search}`)}`, 302);
+    return sendRedirect(event, `${getSignInPath()}?redirect=${encodeURIComponent(`${url.pathname}${url.search}`)}`, 302);
   }
-  const user = await getOAuthUser(Number(session.user.id));
-  if (!user) throw createError({ statusCode: 401, statusMessage: "Unknown user." });
+  const user = await requireOAuthUser(await requireSessionUserId(event));
   await assertApplicationAccess(event, user, application);
-  const url = getRequestURL(event);
   return sendRedirect(event, `${useOAuthConfig().authorizePath}${url.search}`, 302);
 });

package/dist/runtime/server/routes/oidc/authorize.post.js

@@ -11,8 +11,7 @@ export default defineEventHandler(async (event) => {
     redirect.searchParams.set("error", "access_denied");
     return { redirectUrl: redirect.toString() };
   }
-  const user = await getOAuthUser(userId);
-  if (!user) throw createError({ statusCode: 401, statusMessage: "Unknown user." });
+  const user = await requireOAuthUser(userId);
   await assertApplicationAccess(event, user, application);
   const code = await createAuthorizationCode({
     application,

package/dist/runtime/server/routes/oidc/openid-configuration.get.js

@@ -1,13 +1,14 @@
+import { oidc } from "../../../utils/api.js";
 export default defineEventHandler((event) => {
   const issuer = getOAuthIssuer(event);
   setResponseHeader(event, "Cache-Control", "public, max-age=3600");
   return {
     issuer,
-    authorization_endpoint: `${issuer}/oauth/authorize`,
-    token_endpoint: `${issuer}/oauth/token`,
-    userinfo_endpoint: `${issuer}/oauth/userinfo`,
-    revocation_endpoint: `${issuer}/oauth/revoke`,
-    jwks_uri: `${issuer}/.well-known/jwks.json`,
+    authorization_endpoint: `${issuer}${oidc.authorize}`,
+    token_endpoint: `${issuer}${oidc.token}`,
+    userinfo_endpoint: `${issuer}${oidc.userinfo}`,
+    revocation_endpoint: `${issuer}${oidc.revoke}`,
+    jwks_uri: `${issuer}${oidc.jwks}`,
     response_types_supported: ["code"],
     response_modes_supported: ["query"],
     grant_types_supported: ["authorization_code", "refresh_token"],

package/dist/runtime/server/routes/oidc/revoke.post.js

@@ -1,13 +1,25 @@
-import { readBody } from "h3";
+import { z } from "zod";
+const param = z.string().max(4096).optional();
+const bodySchema = z.object({
+  token: param,
+  token_type_hint: param,
+  client_id: param,
+  client_secret: param
+});
 export default defineEventHandler(async (event) => {
-  const body = await readBody(event).catch(() => void 0);
+  let body;
+  try {
+    body = await readValidatedBody(event, bodySchema.parse);
+  } catch (error) {
+    return oauthError(event, 400, "invalid_request", invalidRequestDescription(error));
+  }
   const client = await authenticateClient(event, body);
   if (!("row" in client)) {
     if (client.basic) setResponseHeader(event, "WWW-Authenticate", "Basic");
     return oauthError(event, 401, "invalid_client", "Client authentication failed.");
   }
   const row = client.row;
-  if (typeof body?.token === "string") await revokeRefreshToken(body.token, row.id);
+  if (body.token) await revokeRefreshToken(body.token, row.id);
   setResponseStatus(event, 200);
   return {};
 });

package/dist/runtime/server/routes/oidc/token.post.js

@@ -1,8 +1,23 @@
-import { readBody } from "h3";
+import { z } from "zod";
+const param = z.string().max(4096).optional();
+const bodySchema = z.object({
+  grant_type: param,
+  code: param,
+  redirect_uri: param,
+  code_verifier: param,
+  refresh_token: param,
+  client_id: param,
+  client_secret: param
+});
 export default defineEventHandler(async (event) => {
   setResponseHeader(event, "Cache-Control", "no-store");
   setResponseHeader(event, "Pragma", "no-cache");
-  const body = await readBody(event).catch(() => void 0);
+  let body;
+  try {
+    body = await readValidatedBody(event, bodySchema.parse);
+  } catch (error) {
+    return oauthError(event, 400, "invalid_request", invalidRequestDescription(error));
+  }
   const client = await authenticateClient(event, body);
   if (!("row" in client)) {
     if (client.basic) setResponseHeader(event, "WWW-Authenticate", "Basic");
@@ -10,12 +25,12 @@ export default defineEventHandler(async (event) => {
   }
   const row = client.row;
   const application = toApplication(row);
-  const grantType = body?.grant_type;
+  const grantType = body.grant_type;
   let grant;
   let refreshToken;
   if (grantType === "authorization_code") {
     const { code, redirect_uri: redirectUri, code_verifier: codeVerifier } = body;
-    if (typeof code !== "string" || typeof redirectUri !== "string" || typeof codeVerifier !== "string") {
+    if (!code || !redirectUri || !codeVerifier) {
       return oauthError(event, 400, "invalid_request", "code, redirect_uri and code_verifier are required.");
     }
     const result = await exchangeAuthorizationCode({ code, application, redirectUri, codeVerifier });
@@ -23,7 +38,7 @@ export default defineEventHandler(async (event) => {
     grant = result.grant;
     refreshToken = (await createRefreshToken({ applicationId: application.id, ...grant })).token;
   } else if (grantType === "refresh_token") {
-    if (typeof body?.refresh_token !== "string") return oauthError(event, 400, "invalid_request", "refresh_token is required.");
+    if (!body.refresh_token) return oauthError(event, 400, "invalid_request", "refresh_token is required.");
     const result = await rotateRefreshToken({ token: body.refresh_token, application });
     if ("error" in result) return oauthError(event, 400, "invalid_grant", result.error);
     grant = result.grant;

package/dist/runtime/server/utils/oauth-access.d.ts

@@ -3,6 +3,8 @@ import type { OAuthApplication, OAuthUser, TokenType } from '../../../types.js';
 export declare function requireOAuthAdmin(event: H3Event): Promise<{
     userId: number;
 }>;
+/** The signed-in user as stored, or 401 `unauthorized` when the account no longer exists. */
+export declare function requireOAuthUser(userId: number): Promise<OAuthUser>;
 /** The user's roles as reported by the `oauth:user:roles` hook listeners (none without a listener). */
 export declare function resolveUserRoles(userId: number, event?: H3Event): Promise<string[]>;
 /** The stored user without the password hash; includes columns the host added to `users`. */

package/dist/runtime/server/utils/oauth-access.js

@@ -1,10 +1,16 @@
+import { apiError, forbidden } from "@frigear-nu/module-kit/server";
 import { matchesAllowedRoles } from "../../utils/index.js";
 const adminGate = definePolicyGate("oauth:authorize");
 export async function requireOAuthAdmin(event) {
   const userId = await requireSessionUserId(event);
-  await adminGate.assert(event, userId, "You are not allowed to manage OAuth applications.");
+  if (!await adminGate.isAllowed(event, userId)) throw forbidden("You are not allowed to manage OAuth applications.");
   return { userId };
 }
+export async function requireOAuthUser(userId) {
+  const user = await getOAuthUser(userId);
+  if (!user) throw apiError(401, "unauthorized", "Unknown user.");
+  return user;
+}
 export async function resolveUserRoles(userId, event) {
   const ctx = { event, userId, roles: [] };
   await useNitroApp().hooks.callHook("oauth:user:roles", ctx);

package/dist/runtime/server/utils/oauth-applications.d.ts

@@ -1,7 +1,7 @@
 import { schema } from '@nuxthub/db';
 import { z } from 'zod';
 import type { H3Event } from 'h3';
-import type { ApplicationInput, OAuthApplication, UserApplicationDto } from '../../../types.js';
+import type { AdminApplicationDto, ApplicationInput, OAuthApplication, UserApplicationDto } from '../../../types.js';
 type ApplicationRow = typeof schema.oauthApplications.$inferSelect;
 /** Validation shared by the admin API and `createApplication` / `updateApplication`. */
 export declare const applicationInputSchema: z.ZodObject<{
@@ -39,10 +39,15 @@ export declare const applicationPatchSchema: z.ZodObject<{
     isActive: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
 }, z.core.$strip>;
 export declare function toApplication(row: ApplicationRow): OAuthApplication;
+/** The redirect URI an application has to accept on its side: its website plus the configured callback path. */
+export declare function applicationCallbackUrl(application: Pick<OAuthApplication, 'websiteUrl'>): string;
+/** The admin view of an application (never the secret hash), with the active sign-ins when counted. */
+export declare function toAdminApplicationDto(application: OAuthApplication, activeGrants?: number): AdminApplicationDto;
+/** One application for a staff route, or 404 `not_found`. */
+export declare function requireApplication(id: string): Promise<OAuthApplication>;
 /** The row including `secretHash`; only for credential checks. Use `getApplication` everywhere else. */
 export declare function getApplicationRow(id: string): Promise<ApplicationRow | null>;
 export declare function getApplication(id: string): Promise<OAuthApplication | null>;
-export declare function listApplications(): Promise<OAuthApplication[]>;
 /**
  * Creates an application. The returned `secret` is the only time the plain secret is available; it is `null` for
  * `public` clients, which have none.

package/dist/runtime/server/utils/oauth-applications.js

@@ -1,8 +1,9 @@
 import { and, desc, eq, inArray } from "drizzle-orm";
 import { db, schema } from "@nuxthub/db";
 import { z } from "zod";
+import { badRequest, isoDate, notFound } from "@frigear-nu/module-kit/server";
 import { CLIENT_TYPES, isNativeRedirectUri, isSecureOrigin, matchesAllowedRoles, newId, normalizeWebsiteUrl } from "../../utils/index.js";
-const fail = (statusCode, statusMessage) => createError({ statusCode, statusMessage });
+const applicationNotFound = () => notFound("Application not found.");
 const httpsUrl = z.string().trim().max(2048).refine((value) => {
   try {
     return isSecureOrigin(new URL(value));
@@ -38,13 +39,43 @@ export function toApplication(row) {
   const { secretHash: _secretHash, ...application } = row;
   return application;
 }
+export function applicationCallbackUrl(application) {
+  return `${application.websiteUrl}${useOAuthConfig().callbackPath}`;
+}
+export function toAdminApplicationDto(application, activeGrants) {
+  return {
+    id: application.id,
+    clientType: application.clientType,
+    name: application.name,
+    description: application.description,
+    icon: application.icon,
+    priority: application.priority,
+    websiteUrl: application.websiteUrl,
+    loginUrl: application.loginUrl,
+    previewUrlPattern: application.previewUrlPattern,
+    redirectUris: application.redirectUris,
+    allowedRoles: application.allowedRoles,
+    tags: application.tags,
+    ownerId: application.ownerId,
+    isActive: application.isActive,
+    createdAt: isoDate(application.createdAt),
+    updatedAt: isoDate(application.updatedAt),
+    ...activeGrants === void 0 ? {} : { activeGrants },
+    callbackUrl: applicationCallbackUrl(application)
+  };
+}
+export async function requireApplication(id) {
+  const application = await getApplication(id);
+  if (!application) throw applicationNotFound();
+  return application;
+}
 function normalizeInput(input) {
   const next = { ...input };
   if (next.websiteUrl !== void 0) {
     try {
       next.websiteUrl = normalizeWebsiteUrl(next.websiteUrl);
     } catch (error) {
-      throw fail(400, error.message);
+      throw badRequest(error.message);
     }
   }
   if (next.redirectUris) next.redirectUris = [...new Set(next.redirectUris)];
@@ -54,7 +85,7 @@ function normalizeInput(input) {
 }
 function assertRedirectUris(uris, clientType) {
   if (clientType === "public" || !uris) return;
-  if (uris.some((uri) => !isSecureOrigin(new URL(uri)))) throw fail(400, "Only public clients may use custom-scheme redirect URIs.");
+  if (uris.some((uri) => !isSecureOrigin(new URL(uri)))) throw badRequest("Only public clients may use custom-scheme redirect URIs.");
 }
 export async function getApplicationRow(id) {
   const [row] = await db.select().from(schema.oauthApplications).where(eq(schema.oauthApplications.id, id)).limit(1);
@@ -64,10 +95,6 @@ export async function getApplication(id) {
   const row = await getApplicationRow(id);
   return row ? toApplication(row) : null;
 }
-export async function listApplications() {
-  const rows = await db.select().from(schema.oauthApplications).orderBy(desc(schema.oauthApplications.priority), schema.oauthApplications.name);
-  return rows.map(toApplication);
-}
 export async function createApplication(input, ownerId) {
   const data = normalizeInput(applicationInputSchema.parse(input));
   const clientType = data.clientType ?? "confidential";
@@ -86,8 +113,8 @@ export async function createApplication(input, ownerId) {
 export async function updateApplication(id, patch) {
   const { clientType, ...data } = normalizeInput(applicationPatchSchema.parse(patch));
   const existing = await getApplicationRow(id);
-  if (!existing) throw fail(404, "Application not found.");
-  if (clientType && clientType !== existing.clientType) throw fail(400, "The client type cannot be changed.");
+  if (!existing) throw applicationNotFound();
+  if (clientType && clientType !== existing.clientType) throw badRequest("The client type cannot be changed.");
   assertRedirectUris(data.redirectUris, existing.clientType);
   if (!Object.keys(data).length) return toApplication(existing);
   const [row] = await db.update(schema.oauthApplications).set(data).where(eq(schema.oauthApplications.id, id)).returning();
@@ -97,14 +124,14 @@ export async function deleteApplication(id) {
   await db.delete(schema.oauthRefreshTokens).where(eq(schema.oauthRefreshTokens.applicationId, id));
   await db.delete(schema.oauthAuthorizationCodes).where(eq(schema.oauthAuthorizationCodes.applicationId, id));
   const deleted = await db.delete(schema.oauthApplications).where(eq(schema.oauthApplications.id, id)).returning({ id: schema.oauthApplications.id });
-  if (!deleted.length) throw fail(404, "Application not found.");
+  if (!deleted.length) throw applicationNotFound();
 }
 export async function rotateApplicationSecret(id) {
   const existing = await getApplicationRow(id);
-  if (existing?.clientType === "public") throw fail(400, "Public clients have no client secret.");
+  if (existing?.clientType === "public") throw badRequest("Public clients have no client secret.");
   const secret = generateSecret();
   const updated = await db.update(schema.oauthApplications).set({ secretHash: await sha256Hex(secret) }).where(eq(schema.oauthApplications.id, id)).returning({ id: schema.oauthApplications.id });
-  if (!updated.length) throw fail(404, "Application not found.");
+  if (!updated.length) throw applicationNotFound();
   await revokeApplicationGrants(id);
   return { secret };
 }

package/dist/runtime/server/utils/oauth-authorize.d.ts

@@ -14,11 +14,15 @@ export declare const authorizeRequestSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type AuthorizeRequest = z.infer<typeof authorizeRequestSchema>;
 /**
- * Parses and validates an authorization request: known, active client, an allowed redirect URI, PKCE
- * (S256 is mandatory) and the scopes. Failures are plain HTTP errors because the redirect URI cannot
- * be trusted to carry them yet.
+ * Parses the authorization request parameters (a query or a body). Failures are a
+ * plain 400 `bad_request` naming the bad parameters, because the redirect URI cannot be trusted to carry them yet.
  */
-export declare function validateAuthorizeRequest(input: unknown): Promise<{
+export declare function parseAuthorizeRequest(input: unknown): AuthorizeRequest;
+/**
+ * Validates a parsed authorization request: known, active client, an allowed redirect URI and the scopes (PKCE with
+ * S256 is enforced by the schema). Failures are plain HTTP errors because the redirect URI cannot be trusted yet.
+ */
+export declare function validateAuthorizeRequest(request: AuthorizeRequest): Promise<{
     request: AuthorizeRequest;
     application: OAuthApplication;
     scope: string[];

package/dist/runtime/server/utils/oauth-authorize.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { badRequest, forbidden } from "@frigear-nu/module-kit/server";
 import { resolveScope, validateRedirectUri } from "../../utils/index.js";
 export const authorizeRequestSchema = z.object({
   client_id: z.string().min(1),
@@ -10,22 +11,23 @@ export const authorizeRequestSchema = z.object({
   scope: z.string().max(1024).optional(),
   nonce: z.string().max(512).optional()
 });
-const fail = (statusCode, statusMessage) => createError({ statusCode, statusMessage });
-export async function validateAuthorizeRequest(input) {
+export function parseAuthorizeRequest(input) {
   const parsed = authorizeRequestSchema.safeParse(input);
-  if (!parsed.success) throw fail(400, `Invalid authorization request: ${parsed.error.issues.map((issue) => `${issue.path.join(".")} ${issue.message}`).join(", ")}`);
-  const request = parsed.data;
+  if (!parsed.success) throw badRequest(`Invalid authorization request: ${parsed.error.issues.map((issue) => `${issue.path.join(".")} ${issue.message}`).join(", ")}`);
+  return parsed.data;
+}
+export async function validateAuthorizeRequest(request) {
   const application = await getApplication(request.client_id);
-  if (!application || !application.isActive) throw fail(400, "Unknown or disabled application.");
+  if (!application || !application.isActive) throw badRequest("Unknown or disabled application.");
   const valid = validateRedirectUri(request.redirect_uri, { ...application, callbackPath: useOAuthConfig().callbackPath, allowNativeRedirects: application.clientType === "public" });
-  if (!valid) throw fail(400, "The redirect_uri is not allowed for this application.");
+  if (!valid) throw badRequest("The redirect_uri is not allowed for this application.");
   const scope = resolveScope(request.scope, getSupportedScopes());
-  if (scope.length === 0) throw fail(400, "None of the requested scopes is supported.");
+  if (scope.length === 0) throw badRequest("None of the requested scopes is supported.");
   return { request, application, scope };
 }
 export async function assertApplicationAccess(event, user, application) {
   const access = await checkApplicationAccess(user, application, event);
-  if (!access.allowed) throw fail(403, access.reason ?? "You do not have access to this application.");
+  if (!access.allowed) throw forbidden(access.reason ?? "You do not have access to this application.");
 }
 export function getSignInPath() {
   const config = useRuntimeConfig();

package/dist/runtime/server/utils/oauth-config.d.ts

@@ -19,3 +19,8 @@ export declare function oauthError(event: H3Event, statusCode: number, error: st
     error_description?: string | undefined;
     error: string;
 };
+/**
+ * The `error_description` for a token or revocation request whose body failed `readValidatedBody` (h3's 400 with the
+ * zod issues in `data`, or unparsable JSON), so the route can still answer the RFC 6749 `invalid_request` body.
+ */
+export declare function invalidRequestDescription(error: unknown): string;

package/dist/runtime/server/utils/oauth-config.js

@@ -24,3 +24,8 @@ export function oauthError(event, statusCode, error, description) {
   setResponseHeader(event, "Cache-Control", "no-store");
   return { error, ...description ? { error_description: description } : {} };
 }
+export function invalidRequestDescription(error) {
+  const issues = error?.data?.issues;
+  if (!Array.isArray(issues) || !issues.length) return "The request body is malformed.";
+  return `Invalid request: ${issues.map((issue) => [issue.path?.map(String).join("."), issue.message].filter(Boolean).join(" ")).join(", ")}`;
+}

package/dist/runtime/server/utils/oauth-keys.js

@@ -1,8 +1,9 @@
 import { exportJWK, importPKCS8, importSPKI } from "jose";
+import { apiError } from "@frigear-nu/module-kit/server";
 export function normalizePemKey(raw) {
   return raw.trim().replace(/^["']|["']$/g, "").replace(/\\n/g, "\n").trim();
 }
-const notConfigured = () => createError({ statusCode: 500, statusMessage: "The OAuth server signing keys are not configured." });
+const notConfigured = () => apiError(500, "not_configured", "The OAuth server signing keys are not configured.");
 let cache;
 async function loadKeys() {
   const config = useOAuthConfig();
@@ -31,7 +32,7 @@ function parsePreviousKeys() {
     const parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
     return Object.fromEntries(Object.entries(parsed).map(([kid, pem]) => [kid, normalizePemKey(String(pem))]));
   } catch {
-    throw createError({ statusCode: 500, statusMessage: "The OAuth server previous public keys are not valid JSON." });
+    throw apiError(500, "not_configured", "The OAuth server previous public keys are not valid JSON.");
   }
 }
 let previousCache;

package/dist/runtime/utils/api.d.ts

@@ -0,0 +1,28 @@
+/** The module API: the consent data and the caller's applications under `/api/oauth-server`, staff routes under `/api/admin/oauth-server`. */
+export declare const oauthServerApi: {
+    /** `GET`: data for the consent screen (the authorization request's parameters as the query). */
+    readonly consent: "/api/oauth-server/consent";
+    readonly me: {
+        /** `GET`: the applications the signed-in user may sign in to. */
+        readonly applications: "/api/oauth-server/me/applications";
+    };
+    readonly admin: {
+        /** `GET` (paginated) and `POST` (create, 201). */
+        readonly applications: "/api/admin/oauth-server/applications";
+        /** `GET`, `PATCH`, `DELETE` (204). */
+        readonly application: (id: string) => string;
+        /** `POST`: replaces the client secret and answers `{ clientSecret }` once. */
+        readonly rotateSecret: (id: string) => string;
+        /** `POST`: signs everyone out of the application; answers the application. */
+        readonly revoke: (id: string) => string;
+    };
+};
+/** The OAuth 2.0 / OpenID Connect endpoints, at their standard paths. */
+export declare const oidc: {
+    readonly configuration: "/.well-known/openid-configuration";
+    readonly jwks: "/.well-known/jwks.json";
+    readonly authorize: "/oauth/authorize";
+    readonly token: "/oauth/token";
+    readonly revoke: "/oauth/revoke";
+    readonly userinfo: "/oauth/userinfo";
+};