@frigear-nu/oauth-server 0.1.2 → 0.2.0

package/dist/runtime/server/utils/oauth-authorize.d.ts

@@ -14,11 +14,15 @@ export declare const authorizeRequestSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type AuthorizeRequest = z.infer<typeof authorizeRequestSchema>;
 /**
- * Parses and validates an authorization request: known, active client, an allowed redirect URI, PKCE
- * (S256 is mandatory) and the scopes. Failures are plain HTTP errors because the redirect URI cannot
- * be trusted to carry them yet.
+ * Parses the authorization request parameters (a query or a body). Failures are a
+ * plain 400 `bad_request` naming the bad parameters, because the redirect URI cannot be trusted to carry them yet.
  */
-export declare function validateAuthorizeRequest(input: unknown): Promise<{
+export declare function parseAuthorizeRequest(input: unknown): AuthorizeRequest;
+/**
+ * Validates a parsed authorization request: known, active client, an allowed redirect URI and the scopes (PKCE with
+ * S256 is enforced by the schema). Failures are plain HTTP errors because the redirect URI cannot be trusted yet.
+ */
+export declare function validateAuthorizeRequest(request: AuthorizeRequest): Promise<{
     request: AuthorizeRequest;
     application: OAuthApplication;
     scope: string[];

package/dist/runtime/server/utils/oauth-authorize.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { badRequest, forbidden } from "@frigear-nu/module-kit/server";
 import { resolveScope, validateRedirectUri } from "../../utils/index.js";
 export const authorizeRequestSchema = z.object({
   client_id: z.string().min(1),
@@ -10,22 +11,23 @@ export const authorizeRequestSchema = z.object({
   scope: z.string().max(1024).optional(),
   nonce: z.string().max(512).optional()
 });
-const fail = (statusCode, statusMessage) => createError({ statusCode, statusMessage });
-export async function validateAuthorizeRequest(input) {
+export function parseAuthorizeRequest(input) {
   const parsed = authorizeRequestSchema.safeParse(input);
-  if (!parsed.success) throw fail(400, `Invalid authorization request: ${parsed.error.issues.map((issue) => `${issue.path.join(".")} ${issue.message}`).join(", ")}`);
-  const request = parsed.data;
+  if (!parsed.success) throw badRequest(`Invalid authorization request: ${parsed.error.issues.map((issue) => `${issue.path.join(".")} ${issue.message}`).join(", ")}`);
+  return parsed.data;
+}
+export async function validateAuthorizeRequest(request) {
   const application = await getApplication(request.client_id);
-  if (!application || !application.isActive) throw fail(400, "Unknown or disabled application.");
+  if (!application || !application.isActive) throw badRequest("Unknown or disabled application.");
   const valid = validateRedirectUri(request.redirect_uri, { ...application, callbackPath: useOAuthConfig().callbackPath, allowNativeRedirects: application.clientType === "public" });
-  if (!valid) throw fail(400, "The redirect_uri is not allowed for this application.");
+  if (!valid) throw badRequest("The redirect_uri is not allowed for this application.");
   const scope = resolveScope(request.scope, getSupportedScopes());
-  if (scope.length === 0) throw fail(400, "None of the requested scopes is supported.");
+  if (scope.length === 0) throw badRequest("None of the requested scopes is supported.");
   return { request, application, scope };
 }
 export async function assertApplicationAccess(event, user, application) {
   const access = await checkApplicationAccess(user, application, event);
-  if (!access.allowed) throw fail(403, access.reason ?? "You do not have access to this application.");
+  if (!access.allowed) throw forbidden(access.reason ?? "You do not have access to this application.");
 }
 export function getSignInPath() {
   const config = useRuntimeConfig();

package/dist/runtime/server/utils/oauth-config.d.ts

@@ -19,3 +19,8 @@ export declare function oauthError(event: H3Event, statusCode: number, error: st
     error_description?: string | undefined;
     error: string;
 };
+/**
+ * The `error_description` for a token or revocation request whose body failed `readValidatedBody` (h3's 400 with the
+ * zod issues in `data`, or unparsable JSON), so the route can still answer the RFC 6749 `invalid_request` body.
+ */
+export declare function invalidRequestDescription(error: unknown): string;

package/dist/runtime/server/utils/oauth-config.js

@@ -24,3 +24,8 @@ export function oauthError(event, statusCode, error, description) {
   setResponseHeader(event, "Cache-Control", "no-store");
   return { error, ...description ? { error_description: description } : {} };
 }
+export function invalidRequestDescription(error) {
+  const issues = error?.data?.issues;
+  if (!Array.isArray(issues) || !issues.length) return "The request body is malformed.";
+  return `Invalid request: ${issues.map((issue) => [issue.path?.map(String).join("."), issue.message].filter(Boolean).join(" ")).join(", ")}`;
+}

package/dist/runtime/server/utils/oauth-keys.js

@@ -1,8 +1,9 @@
 import { exportJWK, importPKCS8, importSPKI } from "jose";
+import { apiError } from "@frigear-nu/module-kit/server";
 export function normalizePemKey(raw) {
   return raw.trim().replace(/^["']|["']$/g, "").replace(/\\n/g, "\n").trim();
 }
-const notConfigured = () => createError({ statusCode: 500, statusMessage: "The OAuth server signing keys are not configured." });
+const notConfigured = () => apiError(500, "not_configured", "The OAuth server signing keys are not configured.");
 let cache;
 async function loadKeys() {
   const config = useOAuthConfig();
@@ -31,7 +32,7 @@ function parsePreviousKeys() {
     const parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
     return Object.fromEntries(Object.entries(parsed).map(([kid, pem]) => [kid, normalizePemKey(String(pem))]));
   } catch {
-    throw createError({ statusCode: 500, statusMessage: "The OAuth server previous public keys are not valid JSON." });
+    throw apiError(500, "not_configured", "The OAuth server previous public keys are not valid JSON.");
   }
 }
 let previousCache;

package/dist/runtime/utils/api.d.ts

@@ -0,0 +1,28 @@
+/** The module API: the consent data and the caller's applications under `/api/oauth-server`, staff routes under `/api/admin/oauth-server`. */
+export declare const oauthServerApi: {
+    /** `GET`: data for the consent screen (the authorization request's parameters as the query). */
+    readonly consent: "/api/oauth-server/consent";
+    readonly me: {
+        /** `GET`: the applications the signed-in user may sign in to. */
+        readonly applications: "/api/oauth-server/me/applications";
+    };
+    readonly admin: {
+        /** `GET` (paginated) and `POST` (create, 201). */
+        readonly applications: "/api/admin/oauth-server/applications";
+        /** `GET`, `PATCH`, `DELETE` (204). */
+        readonly application: (id: string) => string;
+        /** `POST`: replaces the client secret and answers `{ clientSecret }` once. */
+        readonly rotateSecret: (id: string) => string;
+        /** `POST`: signs everyone out of the application; answers the application. */
+        readonly revoke: (id: string) => string;
+    };
+};
+/** The OAuth 2.0 / OpenID Connect endpoints, at their standard paths. */
+export declare const oidc: {
+    readonly configuration: "/.well-known/openid-configuration";
+    readonly jwks: "/.well-known/jwks.json";
+    readonly authorize: "/oauth/authorize";
+    readonly token: "/oauth/token";
+    readonly revoke: "/oauth/revoke";
+    readonly userinfo: "/oauth/userinfo";
+};

package/dist/runtime/utils/api.js

@@ -0,0 +1,27 @@
+const enc = encodeURIComponent;
+export const oauthServerApi = {
+  /** `GET`: data for the consent screen (the authorization request's parameters as the query). */
+  consent: "/api/oauth-server/consent",
+  me: {
+    /** `GET`: the applications the signed-in user may sign in to. */
+    applications: "/api/oauth-server/me/applications"
+  },
+  admin: {
+    /** `GET` (paginated) and `POST` (create, 201). */
+    applications: "/api/admin/oauth-server/applications",
+    /** `GET`, `PATCH`, `DELETE` (204). */
+    application: (id) => `/api/admin/oauth-server/applications/${enc(id)}`,
+    /** `POST`: replaces the client secret and answers `{ clientSecret }` once. */
+    rotateSecret: (id) => `/api/admin/oauth-server/applications/${enc(id)}/secret`,
+    /** `POST`: signs everyone out of the application; answers the application. */
+    revoke: (id) => `/api/admin/oauth-server/applications/${enc(id)}/revoke`
+  }
+};
+export const oidc = {
+  configuration: "/.well-known/openid-configuration",
+  jwks: "/.well-known/jwks.json",
+  authorize: "/oauth/authorize",
+  token: "/oauth/token",
+  revoke: "/oauth/revoke",
+  userinfo: "/oauth/userinfo"
+};

package/dist/runtime/utils/index.d.ts

@@ -1,4 +1,5 @@
 export type * from '../../types';
+export { oauthServerApi, oidc } from './api.js';
 export declare const DEFAULT_SCOPES: readonly ["openid", "profile", "email"];
 export declare const DEFAULT_CALLBACK_PATH = "/auth/frigear";
 /** `confidential` clients hold a secret; `public` clients (native and single-page apps) cannot and rely on PKCE alone. */

package/dist/runtime/utils/index.js

@@ -1,3 +1,4 @@
+export { oauthServerApi, oidc } from "./api.js";
 export const DEFAULT_SCOPES = ["openid", "profile", "email"];
 export const DEFAULT_CALLBACK_PATH = "/auth/frigear";
 export const CLIENT_TYPES = ["confidential", "public"];

package/dist/types.d.mts

@@ -1,3 +1,3 @@
 export { default } from './module.mjs'
 
-export { type AdminApplicationDto, type ApplicationAccessContext, type ApplicationInput, type AuthorizeContext, type ClaimsContext, type ClientType, type ConsentDto, type CreatedApplicationDto, type ModuleOptions, type OAuthApplication, type OAuthServerRuntimeConfig, type OAuthUser, type PublicModuleOptions, type TokenIssuedContext, type TokenRevokedContext, type TokenType, type UserApplicationDto, type UserRolesContext } from './module.mjs'
+export { type AdminApplicationDto, type AdminApplicationsPage, type ApplicationAccessContext, type ApplicationInput, type AuthorizeContext, type ClaimsContext, type ClientType, type ConsentDto, type CreatedApplicationDto, type ModuleOptions, type OAuthApplication, type OAuthServerRuntimeConfig, type OAuthUser, type PublicModuleOptions, type TokenIssuedContext, type TokenRevokedContext, type TokenType, type UserApplicationDto, type UserRolesContext } from './module.mjs'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frigear-nu/oauth-server",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "OAuth 2.0 / OpenID Connect server for the frigear ecosystem: register applications that users with certain roles may sign in to.",
   "url": "https://docs.frigear.dev/modules/oauth-server",
   "author": {
@@ -28,6 +28,11 @@
       "types": "./dist/runtime/utils/index.d.ts",
       "import": "./dist/runtime/utils/index.js",
       "default": "./dist/runtime/utils/index.js"
+    },
+    "./api": {
+      "types": "./dist/runtime/utils/api.d.ts",
+      "import": "./dist/runtime/utils/api.js",
+      "default": "./dist/runtime/utils/api.js"
     }
   },
   "files": [
@@ -37,12 +42,12 @@
     "playground"
   ],
   "dependencies": {
-    "@frigear-nu/admin": "0.1.2",
-    "@frigear-nu/module-kit": "1.1.2",
-    "@frigear-nu/ui": "0.1.2",
-    "@frigear-nu/auth": "0.1.3",
-    "@frigear-nu/mcp": "0.1.2",
-    "@frigear-nu/users": "1.1.3",
+    "@frigear-nu/admin": "0.2.0",
+    "@frigear-nu/module-kit": "1.2.0",
+    "@frigear-nu/ui": "0.2.0",
+    "@frigear-nu/auth": "0.2.0",
+    "@frigear-nu/mcp": "0.2.0",
+    "@frigear-nu/users": "1.2.0",
     "@libsql/client": "^0.18.0",
     "@nuxt/kit": "^4.6.1",
     "drizzle-kit": "^0.31.11",
@@ -52,7 +57,7 @@
     "zod": "^4.6.5"
   },
   "peerDependencies": {
-    "@frigear-nu/menu": "0.1.2",
+    "@frigear-nu/menu": "0.2.0",
     "@nuxt/ui": "^4.12.0",
     "@nuxthub/core": "^0.10.8"
   },
@@ -65,7 +70,7 @@
     }
   },
   "devDependencies": {
-    "@frigear-nu/menu": "0.1.2",
+    "@frigear-nu/menu": "0.2.0",
     "@nuxt/devtools": "^3.4.2",
     "@nuxt/eslint-config": "^1.17.0",
     "@nuxt/module-builder": "^1.0.3",