@frigear-nu/oauth-server 0.1.2 → 0.2.0

package/dist/runtime/app/pages/applications.vue

@@ -1,4 +1,5 @@
 <script setup>
+import { useModuleT, useMyApplications } from "#imports";
 defineOptions({ name: "OAuthApplicationsPage" });
 const t = useModuleT("oauthServer");
 const { applications, loading, error, refresh } = await useMyApplications();
@@ -6,17 +7,17 @@ const { applications, loading, error, refresh } = await useMyApplications();
 
 <template>
   <div class="flex flex-col gap-4">
-    <div
+    <!-- The same keys as the account menu item, so the label and the title cannot drift. -->
+    <PageHeading
+      :title="t('menu.applications.label', 'Applications')"
+      :description="t('menu.applications.description', 'Applications you can sign in to.')"
+    />
+
+    <SectionCard
       v-if="loading"
-      class="grid gap-4 md:grid-cols-2"
+      loading
       aria-busy="true"
-    >
-      <SectionCard
-        v-for="index in 2"
-        :key="index"
-        loading
-      />
-    </div>
+    />
     <UEmpty
       v-else-if="error && !applications.length"
       icon="i-lucide-circle-alert"
@@ -24,33 +25,50 @@ const { applications, loading, error, refresh } = await useMyApplications();
       :description="errorMessage(error, '')"
       :actions="[{ label: t('applications.tryAgain', 'Try again'), icon: 'i-lucide-rotate-ccw', color: 'neutral', variant: 'outline', onClick: () => refresh() }]"
     />
-    <UEmpty
-      v-else-if="!applications.length"
-      icon="i-lucide-layout-grid"
-      :title="t('applications.emptyTitle', 'No applications yet')"
-      :description="t('applications.emptyDescription', 'There are no applications you can sign in to yet.')"
-    />
-    <div
+    <SectionCard
       v-else
-      class="grid gap-4 md:grid-cols-2"
+      flush
     >
-      <UPageCard
-        v-for="application in applications"
-        :key="application.id"
-        variant="outline"
-        :title="application.name"
-        :description="application.description ?? application.websiteUrl"
-        :icon="application.icon || 'i-lucide-globe'"
+      <UEmpty
+        v-if="!applications.length"
+        variant="naked"
+        icon="i-lucide-layout-grid"
+        :title="t('applications.emptyTitle', 'No applications yet')"
+        :description="t('applications.emptyDescription', 'There are no applications you can sign in to yet.')"
+      />
+      <ul
+        v-else
+        class="divide-default divide-y"
       >
-        <UButton
-          :to="application.loginUrl"
-          external
-          trailing-icon="i-lucide-arrow-up-right"
-          size="sm"
-          :label="t('applications.open', 'Open')"
-          :aria-label="t('applications.openApplication', 'Open {name}', { name: application.name })"
-        />
-      </UPageCard>
-    </div>
+        <li
+          v-for="application in applications"
+          :key="application.id"
+          class="flex items-center gap-3 px-4 py-3"
+        >
+          <UAvatar
+            :icon="application.icon || 'i-lucide-globe'"
+            size="md"
+          />
+          <div class="min-w-0 flex-1">
+            <p class="text-highlighted truncate text-sm font-medium">
+              {{ application.name }}
+            </p>
+            <p class="text-muted truncate text-sm">
+              {{ application.description ?? application.websiteUrl }}
+            </p>
+          </div>
+          <UButton
+            :to="application.loginUrl"
+            external
+            color="neutral"
+            variant="outline"
+            trailing-icon="i-lucide-arrow-up-right"
+            size="sm"
+            :label="t('applications.open', 'Open')"
+            :aria-label="t('applications.openApplication', 'Open {name}', { name: application.name })"
+          />
+        </li>
+      </ul>
+    </SectionCard>
   </div>
 </template>

package/dist/runtime/app/pages/authorize.vue

@@ -1,10 +1,12 @@
 <script setup>
+import { oauthServerApi, oidc } from "../../utils/api";
+import { $fetch, navigateTo, ref, useAuthPages, useErrorToast, useFetch, useModuleT, useRoute } from "#imports";
 defineOptions({ name: "OAuthAuthorizePage" });
 const t = useModuleT("oauthServer");
 const route = useRoute();
 const signInPath = useAuthPages().login;
 const showError = useErrorToast();
-const { data: consent, error } = await useFetch("/api/oauth-server/consent", {
+const { data: consent, error } = await useFetch(oauthServerApi.consent, {
   query: route.query,
   key: `oauth-server:consent:${route.fullPath}`
 });
@@ -23,7 +25,7 @@ const pending = ref(null);
 async function decide(approved) {
   pending.value = approved ? "approve" : "deny";
   try {
-    const { redirectUrl } = await $fetch("/oauth/authorize", {
+    const { redirectUrl } = await $fetch(oidc.authorize, {
       method: "POST",
       body: { ...route.query, approved }
     });

package/dist/runtime/i18n/lang/da.json

@@ -16,6 +16,8 @@
       "new": "Tilføj applikation",
       "forbiddenTitle": "Du har ikke adgang til at administrere OAuth-applikationer",
       "forbiddenDescription": "Bed en administrator om adgang.",
+      "loadFailed": "OAuth-applikationer kunne ikke indlæses",
+      "tryAgain": "Prøv igen",
       "application": "Applikation",
       "access": "Adgang",
       "signedIn": "Logget ind",
@@ -44,7 +46,10 @@
       "enabled": "Applikationen er aktiveret",
       "disabledToast": "Applikationen er deaktiveret",
       "secretReplaced": "Klienthemmeligheden er skiftet",
-      "signedOut": "Alle er logget ud"
+      "signedOut": "Alle er logget ud",
+      "search": "Søg på navn eller klient-ID...",
+      "noMatches": "Ingen applikationer matcher",
+      "clearSearch": "Ryd søgning"
     },
     "form": {
       "createTitle": "Tilføj applikation",

package/dist/runtime/i18n/lang/en.json

@@ -16,6 +16,8 @@
       "new": "Add application",
       "forbiddenTitle": "You are not allowed to manage OAuth applications",
       "forbiddenDescription": "Ask an administrator for access.",
+      "loadFailed": "OAuth applications could not be loaded",
+      "tryAgain": "Try again",
       "application": "Application",
       "access": "Access",
       "signedIn": "Signed in",
@@ -44,7 +46,10 @@
       "enabled": "Application enabled",
       "disabledToast": "Application disabled",
       "secretReplaced": "Client secret replaced",
-      "signedOut": "Everyone signed out"
+      "signedOut": "Everyone signed out",
+      "search": "Search name or client ID...",
+      "noMatches": "No applications match",
+      "clearSearch": "Clear search"
     },
     "form": {
       "createTitle": "Add application",

package/dist/runtime/menus.js

@@ -1,4 +1,5 @@
 import { defineMenuItem, defineMenuSource, extendMenuItem } from "@frigear-nu/menu/utils";
+import { useRuntimeConfig } from "#imports";
 export default defineMenuSource(() => {
   const config = useRuntimeConfig().public.oauthServer;
   if (config?.pages?.applications) {

package/dist/runtime/server/middleware/oauth-cors.js

@@ -1,9 +1,10 @@
+import { oidc } from "../../utils/api.js";
 const METHODS = {
-  "/oauth/token": "POST, OPTIONS",
-  "/oauth/revoke": "POST, OPTIONS",
-  "/oauth/userinfo": "GET, OPTIONS",
-  "/.well-known/openid-configuration": "GET, OPTIONS",
-  "/.well-known/jwks.json": "GET, OPTIONS"
+  [oidc.token]: "POST, OPTIONS",
+  [oidc.revoke]: "POST, OPTIONS",
+  [oidc.userinfo]: "GET, OPTIONS",
+  [oidc.configuration]: "GET, OPTIONS",
+  [oidc.jwks]: "GET, OPTIONS"
 };
 export default defineEventHandler((event) => {
   const methods = METHODS[getRequestURL(event).pathname];

package/dist/runtime/server/routes/api/admin/application-revoke.post.js

@@ -1,7 +1,9 @@
+import { idParams } from "@frigear-nu/module-kit/server";
+import { toAdminApplicationDto } from "../../../utils/oauth-applications.js";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const id = getRouterParam(event, "id") ?? "";
-  if (!await getApplication(id)) throw createError({ statusCode: 404, statusMessage: "Application not found." });
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  const application = await requireApplication(id);
   await revokeApplicationGrants(id);
-  return { revoked: true };
+  return toAdminApplicationDto(application, 0);
 });

package/dist/runtime/server/routes/api/admin/application-secret.post.js

@@ -1,5 +1,7 @@
+import { idParams } from "@frigear-nu/module-kit/server";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const { secret } = await rotateApplicationSecret(getRouterParam(event, "id") ?? "");
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  const { secret } = await rotateApplicationSecret(id);
   return { clientSecret: secret };
 });

package/dist/runtime/server/routes/api/admin/application.delete.js

@@ -1,6 +1,7 @@
+import { idParams, noContent } from "@frigear-nu/module-kit/server";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  await deleteApplication(getRouterParam(event, "id") ?? "");
-  setResponseStatus(event, 204);
-  return null;
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  await deleteApplication(id);
+  return noContent(event);
 });

package/dist/runtime/server/routes/api/admin/application.get.js

@@ -1,6 +1,9 @@
+import { idParams } from "@frigear-nu/module-kit/server";
+import { toAdminApplicationDto } from "../../../utils/oauth-applications.js";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const application = await getApplication(getRouterParam(event, "id") ?? "");
-  if (!application) throw createError({ statusCode: 404, statusMessage: "Application not found." });
-  return { ...application, callbackUrl: `${application.websiteUrl}${useOAuthConfig().callbackPath}` };
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  const application = await requireApplication(id);
+  const grants = await countActiveGrants([id]);
+  return toAdminApplicationDto(application, grants[id] ?? 0);
 });

package/dist/runtime/server/routes/api/admin/application.patch.js

@@ -1,9 +1,10 @@
-import { applicationPatchSchema } from "../../../utils/oauth-applications.js";
+import { idParams } from "@frigear-nu/module-kit/server";
+import { applicationPatchSchema, toAdminApplicationDto } from "../../../utils/oauth-applications.js";
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const id = getRouterParam(event, "id") ?? "";
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
   const patch = await readValidatedBody(event, applicationPatchSchema.parse);
   const application = await updateApplication(id, patch);
   if (patch.isActive === false) await revokeApplicationGrants(id);
-  return application;
+  return toAdminApplicationDto(application);
 });

package/dist/runtime/server/routes/api/admin/applications.get.js

@@ -1,11 +1,23 @@
+import { db, schema } from "@nuxthub/db";
+import { count, or } from "drizzle-orm";
+import { likeContains, orderByQuery, pageQuery, pageRange, paginate } from "@frigear-nu/module-kit/server";
+import { toApplication, toAdminApplicationDto } from "../../../utils/oauth-applications.js";
+const querySchema = pageQuery({ sort: ["createdAt", "name", "priority"] });
 export default defineEventHandler(async (event) => {
   await requireOAuthAdmin(event);
-  const applications = await listApplications();
-  const grants = await countActiveGrants(applications.map((application) => application.id));
-  return applications.map((application) => ({
-    ...application,
-    activeGrants: grants[application.id] ?? 0,
-    // The redirect URI applications have to register on their side.
-    callbackUrl: `${application.websiteUrl}${useOAuthConfig().callbackPath}`
-  }));
+  const query = await getValidatedQuery(event, querySchema.parse);
+  const table = schema.oauthApplications;
+  const where = query.q ? or(likeContains(table.name, query.q), likeContains(table.id, query.q)) : void 0;
+  const orderBy = orderByQuery({ createdAt: table.createdAt, name: table.name, priority: table.priority }, query, { tiebreaker: table.id });
+  const { limit, offset } = pageRange(query);
+  const [rows, [totals]] = await Promise.all([
+    db.select().from(table).where(where).orderBy(...orderBy).limit(limit).offset(offset),
+    db.select({ total: count() }).from(table).where(where)
+  ]);
+  const grants = await countActiveGrants(rows.map((row) => row.id));
+  return paginate({
+    total: totals?.total ?? 0,
+    query,
+    items: rows.map((row) => toAdminApplicationDto(toApplication(row), grants[row.id] ?? 0))
+  });
 });

package/dist/runtime/server/routes/api/admin/applications.post.js

@@ -1,8 +1,8 @@
-import { applicationInputSchema } from "../../../utils/oauth-applications.js";
+import { created } from "@frigear-nu/module-kit/server";
+import { applicationInputSchema, toAdminApplicationDto } from "../../../utils/oauth-applications.js";
 export default defineEventHandler(async (event) => {
   const { userId } = await requireOAuthAdmin(event);
   const input = await readValidatedBody(event, applicationInputSchema.parse);
   const { application, secret } = await createApplication(input, userId);
-  setResponseStatus(event, 201);
-  return { ...application, clientId: application.id, clientSecret: secret };
+  return created(event, { ...toAdminApplicationDto(application, 0), clientId: application.id, clientSecret: secret });
 });

package/dist/runtime/server/routes/api/consent.get.js

@@ -1,9 +1,10 @@
 import { getQuery } from "h3";
+import { parseAuthorizeRequest } from "../../utils/oauth-authorize.js";
 export default defineEventHandler(async (event) => {
   const userId = await requireSessionUserId(event);
-  const { application, scope } = await validateAuthorizeRequest(getQuery(event));
-  const user = await getOAuthUser(userId);
-  if (!user) throw createError({ statusCode: 401, statusMessage: "Unknown user." });
+  const query = parseAuthorizeRequest(getQuery(event));
+  const { application, scope } = await validateAuthorizeRequest(query);
+  const user = await requireOAuthUser(userId);
   await assertApplicationAccess(event, user, application);
   return {
     application: {

package/dist/runtime/server/routes/oidc/authorize.get.js

@@ -1,15 +1,14 @@
 import { getQuery, getRequestURL, sendRedirect } from "h3";
+import { parseAuthorizeRequest } from "../../utils/oauth-authorize.js";
 export default defineEventHandler(async (event) => {
-  const query = getQuery(event);
+  const query = parseAuthorizeRequest(getQuery(event));
   const { application } = await validateAuthorizeRequest(query);
+  const url = getRequestURL(event);
   const session = await getUserSession(event);
   if (!session.user) {
-    const url2 = getRequestURL(event);
-    return sendRedirect(event, `${getSignInPath()}?redirect=${encodeURIComponent(`${url2.pathname}${url2.search}`)}`, 302);
+    return sendRedirect(event, `${getSignInPath()}?redirect=${encodeURIComponent(`${url.pathname}${url.search}`)}`, 302);
   }
-  const user = await getOAuthUser(Number(session.user.id));
-  if (!user) throw createError({ statusCode: 401, statusMessage: "Unknown user." });
+  const user = await requireOAuthUser(await requireSessionUserId(event));
   await assertApplicationAccess(event, user, application);
-  const url = getRequestURL(event);
   return sendRedirect(event, `${useOAuthConfig().authorizePath}${url.search}`, 302);
 });

package/dist/runtime/server/routes/oidc/authorize.post.js

@@ -11,8 +11,7 @@ export default defineEventHandler(async (event) => {
     redirect.searchParams.set("error", "access_denied");
     return { redirectUrl: redirect.toString() };
   }
-  const user = await getOAuthUser(userId);
-  if (!user) throw createError({ statusCode: 401, statusMessage: "Unknown user." });
+  const user = await requireOAuthUser(userId);
   await assertApplicationAccess(event, user, application);
   const code = await createAuthorizationCode({
     application,

package/dist/runtime/server/routes/oidc/openid-configuration.get.js

@@ -1,13 +1,14 @@
+import { oidc } from "../../../utils/api.js";
 export default defineEventHandler((event) => {
   const issuer = getOAuthIssuer(event);
   setResponseHeader(event, "Cache-Control", "public, max-age=3600");
   return {
     issuer,
-    authorization_endpoint: `${issuer}/oauth/authorize`,
-    token_endpoint: `${issuer}/oauth/token`,
-    userinfo_endpoint: `${issuer}/oauth/userinfo`,
-    revocation_endpoint: `${issuer}/oauth/revoke`,
-    jwks_uri: `${issuer}/.well-known/jwks.json`,
+    authorization_endpoint: `${issuer}${oidc.authorize}`,
+    token_endpoint: `${issuer}${oidc.token}`,
+    userinfo_endpoint: `${issuer}${oidc.userinfo}`,
+    revocation_endpoint: `${issuer}${oidc.revoke}`,
+    jwks_uri: `${issuer}${oidc.jwks}`,
     response_types_supported: ["code"],
     response_modes_supported: ["query"],
     grant_types_supported: ["authorization_code", "refresh_token"],

package/dist/runtime/server/routes/oidc/revoke.post.js

@@ -1,13 +1,25 @@
-import { readBody } from "h3";
+import { z } from "zod";
+const param = z.string().max(4096).optional();
+const bodySchema = z.object({
+  token: param,
+  token_type_hint: param,
+  client_id: param,
+  client_secret: param
+});
 export default defineEventHandler(async (event) => {
-  const body = await readBody(event).catch(() => void 0);
+  let body;
+  try {
+    body = await readValidatedBody(event, bodySchema.parse);
+  } catch (error) {
+    return oauthError(event, 400, "invalid_request", invalidRequestDescription(error));
+  }
   const client = await authenticateClient(event, body);
   if (!("row" in client)) {
     if (client.basic) setResponseHeader(event, "WWW-Authenticate", "Basic");
     return oauthError(event, 401, "invalid_client", "Client authentication failed.");
   }
   const row = client.row;
-  if (typeof body?.token === "string") await revokeRefreshToken(body.token, row.id);
+  if (body.token) await revokeRefreshToken(body.token, row.id);
   setResponseStatus(event, 200);
   return {};
 });

package/dist/runtime/server/routes/oidc/token.post.js

@@ -1,8 +1,23 @@
-import { readBody } from "h3";
+import { z } from "zod";
+const param = z.string().max(4096).optional();
+const bodySchema = z.object({
+  grant_type: param,
+  code: param,
+  redirect_uri: param,
+  code_verifier: param,
+  refresh_token: param,
+  client_id: param,
+  client_secret: param
+});
 export default defineEventHandler(async (event) => {
   setResponseHeader(event, "Cache-Control", "no-store");
   setResponseHeader(event, "Pragma", "no-cache");
-  const body = await readBody(event).catch(() => void 0);
+  let body;
+  try {
+    body = await readValidatedBody(event, bodySchema.parse);
+  } catch (error) {
+    return oauthError(event, 400, "invalid_request", invalidRequestDescription(error));
+  }
   const client = await authenticateClient(event, body);
   if (!("row" in client)) {
     if (client.basic) setResponseHeader(event, "WWW-Authenticate", "Basic");
@@ -10,12 +25,12 @@ export default defineEventHandler(async (event) => {
   }
   const row = client.row;
   const application = toApplication(row);
-  const grantType = body?.grant_type;
+  const grantType = body.grant_type;
   let grant;
   let refreshToken;
   if (grantType === "authorization_code") {
     const { code, redirect_uri: redirectUri, code_verifier: codeVerifier } = body;
-    if (typeof code !== "string" || typeof redirectUri !== "string" || typeof codeVerifier !== "string") {
+    if (!code || !redirectUri || !codeVerifier) {
       return oauthError(event, 400, "invalid_request", "code, redirect_uri and code_verifier are required.");
     }
     const result = await exchangeAuthorizationCode({ code, application, redirectUri, codeVerifier });
@@ -23,7 +38,7 @@ export default defineEventHandler(async (event) => {
     grant = result.grant;
     refreshToken = (await createRefreshToken({ applicationId: application.id, ...grant })).token;
   } else if (grantType === "refresh_token") {
-    if (typeof body?.refresh_token !== "string") return oauthError(event, 400, "invalid_request", "refresh_token is required.");
+    if (!body.refresh_token) return oauthError(event, 400, "invalid_request", "refresh_token is required.");
     const result = await rotateRefreshToken({ token: body.refresh_token, application });
     if ("error" in result) return oauthError(event, 400, "invalid_grant", result.error);
     grant = result.grant;

package/dist/runtime/server/utils/oauth-access.d.ts

@@ -3,6 +3,8 @@ import type { OAuthApplication, OAuthUser, TokenType } from '../../../types.js';
 export declare function requireOAuthAdmin(event: H3Event): Promise<{
     userId: number;
 }>;
+/** The signed-in user as stored, or 401 `unauthorized` when the account no longer exists. */
+export declare function requireOAuthUser(userId: number): Promise<OAuthUser>;
 /** The user's roles as reported by the `oauth:user:roles` hook listeners (none without a listener). */
 export declare function resolveUserRoles(userId: number, event?: H3Event): Promise<string[]>;
 /** The stored user without the password hash; includes columns the host added to `users`. */

package/dist/runtime/server/utils/oauth-access.js

@@ -1,10 +1,16 @@
+import { apiError, forbidden } from "@frigear-nu/module-kit/server";
 import { matchesAllowedRoles } from "../../utils/index.js";
 const adminGate = definePolicyGate("oauth:authorize");
 export async function requireOAuthAdmin(event) {
   const userId = await requireSessionUserId(event);
-  await adminGate.assert(event, userId, "You are not allowed to manage OAuth applications.");
+  if (!await adminGate.isAllowed(event, userId)) throw forbidden("You are not allowed to manage OAuth applications.");
   return { userId };
 }
+export async function requireOAuthUser(userId) {
+  const user = await getOAuthUser(userId);
+  if (!user) throw apiError(401, "unauthorized", "Unknown user.");
+  return user;
+}
 export async function resolveUserRoles(userId, event) {
   const ctx = { event, userId, roles: [] };
   await useNitroApp().hooks.callHook("oauth:user:roles", ctx);

package/dist/runtime/server/utils/oauth-applications.d.ts

@@ -1,7 +1,7 @@
 import { schema } from '@nuxthub/db';
 import { z } from 'zod';
 import type { H3Event } from 'h3';
-import type { ApplicationInput, OAuthApplication, UserApplicationDto } from '../../../types.js';
+import type { AdminApplicationDto, ApplicationInput, OAuthApplication, UserApplicationDto } from '../../../types.js';
 type ApplicationRow = typeof schema.oauthApplications.$inferSelect;
 /** Validation shared by the admin API and `createApplication` / `updateApplication`. */
 export declare const applicationInputSchema: z.ZodObject<{
@@ -39,10 +39,15 @@ export declare const applicationPatchSchema: z.ZodObject<{
     isActive: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
 }, z.core.$strip>;
 export declare function toApplication(row: ApplicationRow): OAuthApplication;
+/** The redirect URI an application has to accept on its side: its website plus the configured callback path. */
+export declare function applicationCallbackUrl(application: Pick<OAuthApplication, 'websiteUrl'>): string;
+/** The admin view of an application (never the secret hash), with the active sign-ins when counted. */
+export declare function toAdminApplicationDto(application: OAuthApplication, activeGrants?: number): AdminApplicationDto;
+/** One application for a staff route, or 404 `not_found`. */
+export declare function requireApplication(id: string): Promise<OAuthApplication>;
 /** The row including `secretHash`; only for credential checks. Use `getApplication` everywhere else. */
 export declare function getApplicationRow(id: string): Promise<ApplicationRow | null>;
 export declare function getApplication(id: string): Promise<OAuthApplication | null>;
-export declare function listApplications(): Promise<OAuthApplication[]>;
 /**
  * Creates an application. The returned `secret` is the only time the plain secret is available; it is `null` for
  * `public` clients, which have none.

package/dist/runtime/server/utils/oauth-applications.js

@@ -1,8 +1,9 @@
 import { and, desc, eq, inArray } from "drizzle-orm";
 import { db, schema } from "@nuxthub/db";
 import { z } from "zod";
+import { badRequest, isoDate, notFound } from "@frigear-nu/module-kit/server";
 import { CLIENT_TYPES, isNativeRedirectUri, isSecureOrigin, matchesAllowedRoles, newId, normalizeWebsiteUrl } from "../../utils/index.js";
-const fail = (statusCode, statusMessage) => createError({ statusCode, statusMessage });
+const applicationNotFound = () => notFound("Application not found.");
 const httpsUrl = z.string().trim().max(2048).refine((value) => {
   try {
     return isSecureOrigin(new URL(value));
@@ -38,13 +39,43 @@ export function toApplication(row) {
   const { secretHash: _secretHash, ...application } = row;
   return application;
 }
+export function applicationCallbackUrl(application) {
+  return `${application.websiteUrl}${useOAuthConfig().callbackPath}`;
+}
+export function toAdminApplicationDto(application, activeGrants) {
+  return {
+    id: application.id,
+    clientType: application.clientType,
+    name: application.name,
+    description: application.description,
+    icon: application.icon,
+    priority: application.priority,
+    websiteUrl: application.websiteUrl,
+    loginUrl: application.loginUrl,
+    previewUrlPattern: application.previewUrlPattern,
+    redirectUris: application.redirectUris,
+    allowedRoles: application.allowedRoles,
+    tags: application.tags,
+    ownerId: application.ownerId,
+    isActive: application.isActive,
+    createdAt: isoDate(application.createdAt),
+    updatedAt: isoDate(application.updatedAt),
+    ...activeGrants === void 0 ? {} : { activeGrants },
+    callbackUrl: applicationCallbackUrl(application)
+  };
+}
+export async function requireApplication(id) {
+  const application = await getApplication(id);
+  if (!application) throw applicationNotFound();
+  return application;
+}
 function normalizeInput(input) {
   const next = { ...input };
   if (next.websiteUrl !== void 0) {
     try {
       next.websiteUrl = normalizeWebsiteUrl(next.websiteUrl);
     } catch (error) {
-      throw fail(400, error.message);
+      throw badRequest(error.message);
     }
   }
   if (next.redirectUris) next.redirectUris = [...new Set(next.redirectUris)];
@@ -54,7 +85,7 @@ function normalizeInput(input) {
 }
 function assertRedirectUris(uris, clientType) {
   if (clientType === "public" || !uris) return;
-  if (uris.some((uri) => !isSecureOrigin(new URL(uri)))) throw fail(400, "Only public clients may use custom-scheme redirect URIs.");
+  if (uris.some((uri) => !isSecureOrigin(new URL(uri)))) throw badRequest("Only public clients may use custom-scheme redirect URIs.");
 }
 export async function getApplicationRow(id) {
   const [row] = await db.select().from(schema.oauthApplications).where(eq(schema.oauthApplications.id, id)).limit(1);
@@ -64,10 +95,6 @@ export async function getApplication(id) {
   const row = await getApplicationRow(id);
   return row ? toApplication(row) : null;
 }
-export async function listApplications() {
-  const rows = await db.select().from(schema.oauthApplications).orderBy(desc(schema.oauthApplications.priority), schema.oauthApplications.name);
-  return rows.map(toApplication);
-}
 export async function createApplication(input, ownerId) {
   const data = normalizeInput(applicationInputSchema.parse(input));
   const clientType = data.clientType ?? "confidential";
@@ -86,8 +113,8 @@ export async function createApplication(input, ownerId) {
 export async function updateApplication(id, patch) {
   const { clientType, ...data } = normalizeInput(applicationPatchSchema.parse(patch));
   const existing = await getApplicationRow(id);
-  if (!existing) throw fail(404, "Application not found.");
-  if (clientType && clientType !== existing.clientType) throw fail(400, "The client type cannot be changed.");
+  if (!existing) throw applicationNotFound();
+  if (clientType && clientType !== existing.clientType) throw badRequest("The client type cannot be changed.");
   assertRedirectUris(data.redirectUris, existing.clientType);
   if (!Object.keys(data).length) return toApplication(existing);
   const [row] = await db.update(schema.oauthApplications).set(data).where(eq(schema.oauthApplications.id, id)).returning();
@@ -97,14 +124,14 @@ export async function deleteApplication(id) {
   await db.delete(schema.oauthRefreshTokens).where(eq(schema.oauthRefreshTokens.applicationId, id));
   await db.delete(schema.oauthAuthorizationCodes).where(eq(schema.oauthAuthorizationCodes.applicationId, id));
   const deleted = await db.delete(schema.oauthApplications).where(eq(schema.oauthApplications.id, id)).returning({ id: schema.oauthApplications.id });
-  if (!deleted.length) throw fail(404, "Application not found.");
+  if (!deleted.length) throw applicationNotFound();
 }
 export async function rotateApplicationSecret(id) {
   const existing = await getApplicationRow(id);
-  if (existing?.clientType === "public") throw fail(400, "Public clients have no client secret.");
+  if (existing?.clientType === "public") throw badRequest("Public clients have no client secret.");
   const secret = generateSecret();
   const updated = await db.update(schema.oauthApplications).set({ secretHash: await sha256Hex(secret) }).where(eq(schema.oauthApplications.id, id)).returning({ id: schema.oauthApplications.id });
-  if (!updated.length) throw fail(404, "Application not found.");
+  if (!updated.length) throw applicationNotFound();
   await revokeApplicationGrants(id);
   return { secret };
 }