@geekity/cms 0.11.0 → 0.13.0

package/dist/indieauth/discovery.d.ts

@@ -0,0 +1,87 @@
+import type { Hono, MiddlewareHandler } from 'hono';
+import type { GeekityEnv } from '../env.ts';
+/** Where the authorization server metadata document is published. */
+export declare const INDIEAUTH_METADATA_PATH = "/_geekity/indieauth/metadata";
+/** RFC 8414's well-known location for the same document. */
+export declare const OAUTH_METADATA_WELL_KNOWN_PATH = "/.well-known/oauth-authorization-server";
+/** Where a client sends the person to approve a sign-in (TASK-158). */
+export declare const AUTHORIZATION_PATH = "/_geekity/indieauth/auth";
+/** Where a client redeems a code for an access token (TASK-160). */
+export declare const TOKEN_PATH = "/_geekity/indieauth/token";
+/** Where a resource server asks what a token is good for (TASK-161). */
+export declare const INTROSPECTION_PATH = "/_geekity/indieauth/introspect";
+/** Where a client hands a token back to end it (TASK-161). */
+export declare const REVOCATION_PATH = "/_geekity/indieauth/revoke";
+/** Where a client asks for the profile a token was approved to see (TASK-161). */
+export declare const USERINFO_PATH = "/_geekity/indieauth/userinfo";
+/**
+ * RFC 9728's well-known location for the protected resource metadata, which
+ * an MCP client reads to learn where to sign in (TASK-161).
+ */
+export declare const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+/**
+ * The scopes a client may ask for: the profile ones (TASK-158) and the
+ * Micropub ones a token is issued for (TASK-160).
+ */
+export declare const SCOPES: readonly ['profile', 'email', 'create', 'update', 'delete', 'media'];
+/** RFC 8414 authorization server metadata, as the IndieAuth spec profiles it. */
+export interface AuthorizationServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    introspection_endpoint: string;
+    revocation_endpoint: string;
+    userinfo_endpoint: string;
+    response_types_supported: readonly string[];
+    grant_types_supported: readonly string[];
+    code_challenge_methods_supported: readonly string[];
+    scopes_supported: readonly string[];
+    authorization_response_iss_parameter_supported: boolean;
+    /**
+     * That a client may use the URL of a JSON client metadata document as its
+     * client_id, which the MCP authorization spec asks for (TASK-158).
+     */
+    client_id_metadata_document_supported: boolean;
+}
+/**
+ * The metadata for a site at `baseUrl`.
+ *
+ * The issuer is the base URL with no trailing slash: RFC 8414 builds the
+ * well-known URL by putting `/.well-known/oauth-authorization-server` between
+ * the issuer's host and its path, so an issuer with no path is the one whose
+ * document lives at exactly that URL, and a client that checks the two agree
+ * finds they do.
+ */
+export declare function authorizationServerMetadata(baseUrl: string): AuthorizationServerMetadata;
+/** RFC 9728 protected resource metadata. */
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: readonly string[];
+    scopes_supported: readonly string[];
+    bearer_methods_supported: readonly string[];
+}
+/**
+ * The protected resource metadata for a site at `baseUrl`: the site is the
+ * resource, and its own authorization server is the one to sign in at. A
+ * token may come in the header or, as Micropub allows, in a form body.
+ */
+export declare function protectedResourceMetadata(baseUrl: string): ProtectedResourceMetadata;
+/** The site's base URL as every absolute URL it hands out is built from. */
+export declare function siteBaseUrl(c: {
+    var: Pick<GeekityEnv['Variables'], 'config'>;
+}): string;
+/**
+ * Mount the authorization server metadata at its own path and at the
+ * well-known one, and the protected resource metadata at its well-known one.
+ */
+export declare function mountIndieAuthDiscovery(app: Hono<GeekityEnv>): void;
+/**
+ * Point every identity URL at the metadata, with a `Link` header and a
+ * `<link>` before `</head>` (TASK-157).
+ *
+ * Added to the response rather than left to the layouts so that every theme
+ * carries it, a custom one that replaces the packaged base layout included. A
+ * 404 for a username nobody has is left alone: it is nobody's identity.
+ */
+export declare const advertiseIndieAuthMetadata: MiddlewareHandler<GeekityEnv>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/indieauth/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/indieauth/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAI5C,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE,4DAA4D;AAC5D,eAAO,MAAM,8BAA8B,4CAA4C,CAAC;AAExF,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAE7D,oEAAoE;AACpE,eAAO,MAAM,UAAU,8BAA8B,CAAC;AAEtD,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AAEnE,8DAA8D;AAC9D,eAAO,MAAM,eAAe,+BAA+B,CAAC;AAE5D,kFAAkF;AAClF,eAAO,MAAM,aAAa,iCAAiC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,gCAAgC,0CAA0C,CAAC;AAExF;;;GAGG;AACH,eAAO,MAAM,MAAM,YAAI,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AAE3F,iFAAiF;AACjF,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,gCAAgC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,8CAA8C,EAAE,OAAO,CAAC;IACxD;;;OAGG;IACH,qCAAqC,EAAE,OAAO,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,2BAA2B,CAexF;AAED,4CAA4C;AAC5C,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,yBAAyB,CAOpF;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,CAAC,EAAE;IAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAA;CAAE,GAAG,MAAM,CAGvF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAOnE;AAeD;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,iBAAiB,CAAC,UAAU,CAiBpE,CAAC"}

package/dist/indieauth/discovery.js

@@ -0,0 +1,127 @@
+import { effectiveBaseUrl, readSiteSettings } from '../admin/settings.js';
+import { parseAuthorPath } from '../web/authors.js';
+import { requestPath } from '../web/routes.js';
+/** Where the authorization server metadata document is published. */
+export const INDIEAUTH_METADATA_PATH = '/_geekity/indieauth/metadata';
+/** RFC 8414's well-known location for the same document. */
+export const OAUTH_METADATA_WELL_KNOWN_PATH = '/.well-known/oauth-authorization-server';
+/** Where a client sends the person to approve a sign-in (TASK-158). */
+export const AUTHORIZATION_PATH = '/_geekity/indieauth/auth';
+/** Where a client redeems a code for an access token (TASK-160). */
+export const TOKEN_PATH = '/_geekity/indieauth/token';
+/** Where a resource server asks what a token is good for (TASK-161). */
+export const INTROSPECTION_PATH = '/_geekity/indieauth/introspect';
+/** Where a client hands a token back to end it (TASK-161). */
+export const REVOCATION_PATH = '/_geekity/indieauth/revoke';
+/** Where a client asks for the profile a token was approved to see (TASK-161). */
+export const USERINFO_PATH = '/_geekity/indieauth/userinfo';
+/**
+ * RFC 9728's well-known location for the protected resource metadata, which
+ * an MCP client reads to learn where to sign in (TASK-161).
+ */
+export const PROTECTED_RESOURCE_METADATA_PATH = '/.well-known/oauth-protected-resource';
+/**
+ * The scopes a client may ask for: the profile ones (TASK-158) and the
+ * Micropub ones a token is issued for (TASK-160).
+ */
+export const SCOPES = ['profile', 'email', 'create', 'update', 'delete', 'media'];
+/**
+ * The metadata for a site at `baseUrl`.
+ *
+ * The issuer is the base URL with no trailing slash: RFC 8414 builds the
+ * well-known URL by putting `/.well-known/oauth-authorization-server` between
+ * the issuer's host and its path, so an issuer with no path is the one whose
+ * document lives at exactly that URL, and a client that checks the two agree
+ * finds they do.
+ */
+export function authorizationServerMetadata(baseUrl) {
+    return {
+        issuer: baseUrl,
+        authorization_endpoint: `${baseUrl}${AUTHORIZATION_PATH}`,
+        token_endpoint: `${baseUrl}${TOKEN_PATH}`,
+        introspection_endpoint: `${baseUrl}${INTROSPECTION_PATH}`,
+        revocation_endpoint: `${baseUrl}${REVOCATION_PATH}`,
+        userinfo_endpoint: `${baseUrl}${USERINFO_PATH}`,
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code', 'refresh_token'],
+        code_challenge_methods_supported: ['S256'],
+        scopes_supported: SCOPES,
+        authorization_response_iss_parameter_supported: true,
+        client_id_metadata_document_supported: true,
+    };
+}
+/**
+ * The protected resource metadata for a site at `baseUrl`: the site is the
+ * resource, and its own authorization server is the one to sign in at. A
+ * token may come in the header or, as Micropub allows, in a form body.
+ */
+export function protectedResourceMetadata(baseUrl) {
+    return {
+        resource: baseUrl,
+        authorization_servers: [authorizationServerMetadata(baseUrl).issuer],
+        scopes_supported: SCOPES,
+        bearer_methods_supported: ['header', 'body'],
+    };
+}
+/** The site's base URL as every absolute URL it hands out is built from. */
+export function siteBaseUrl(c) {
+    const { config } = c.var;
+    return effectiveBaseUrl(config, readSiteSettings(config.contentDir));
+}
+/**
+ * Mount the authorization server metadata at its own path and at the
+ * well-known one, and the protected resource metadata at its well-known one.
+ */
+export function mountIndieAuthDiscovery(app) {
+    for (const pathname of [INDIEAUTH_METADATA_PATH, OAUTH_METADATA_WELL_KNOWN_PATH]) {
+        app.get(pathname, (c) => c.json(authorizationServerMetadata(siteBaseUrl(c))));
+    }
+    app.get(PROTECTED_RESOURCE_METADATA_PATH, (c) => c.json(protectedResourceMetadata(siteBaseUrl(c))));
+}
+/**
+ * Whether a path is an identity URL a person may type into a sign-in form:
+ * the root, and every author archive's first page (decision-23).
+ *
+ * The root is advertised on a multi-author site too, where it names nobody: a
+ * person who types it still reaches this server, signs in as whoever they log
+ * in as, and the client is handed that user's author URL, which shares the
+ * host and advertises the same server.
+ */
+function isIdentityPath(pathname) {
+    return pathname === '/' || parseAuthorPath(pathname)?.pageNumber === 0;
+}
+/**
+ * Point every identity URL at the metadata, with a `Link` header and a
+ * `<link>` before `</head>` (TASK-157).
+ *
+ * Added to the response rather than left to the layouts so that every theme
+ * carries it, a custom one that replaces the packaged base layout included. A
+ * 404 for a username nobody has is left alone: it is nobody's identity.
+ */
+export const advertiseIndieAuthMetadata = async (c, next) => {
+    await next();
+    if (!isIdentityPath(requestPath(c)))
+        return;
+    const { status } = c.res;
+    if (status !== 304 && (status < 200 || status >= 300))
+        return;
+    const href = `${siteBaseUrl(c)}${INDIEAUTH_METADATA_PATH}`;
+    c.res.headers.append('link', `<${href}>; rel="indieauth-metadata"`);
+    if (status === 304 || !(c.res.headers.get('content-type') ?? '').startsWith('text/html'))
+        return;
+    const headers = new Headers(c.res.headers);
+    headers.delete('content-length');
+    const body = withHeadLink(await c.res.text(), `<link rel="indieauth-metadata" href="${href}">`);
+    // Cleared first, because assigning over a response copies its headers onto
+    // the new one.
+    c.res = undefined;
+    c.res = new Response(body, { status, headers });
+};
+/** `html` with `link` just before its `</head>`, or unchanged when it has none. */
+function withHeadLink(html, link) {
+    const head = /<\/head\s*>/i.exec(html);
+    if (head === null)
+        return html;
+    return `${html.slice(0, head.index)}${link}${html.slice(head.index)}`;
+}
+//# sourceMappingURL=discovery.js.map

package/dist/indieauth/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/indieauth/discovery.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE1E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,qEAAqE;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAEtE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,8BAA8B,GAAG,yCAAyC,CAAC;AAExF,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAE7D,oEAAoE;AACpE,MAAM,CAAC,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAEtD,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAEnE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAE5D,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG,8BAA8B,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAExF;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AAsB3F;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,OAAO;QACL,MAAM,EAAE,OAAO;QACf,sBAAsB,EAAE,GAAG,OAAO,GAAG,kBAAkB,EAAE;QACzD,cAAc,EAAE,GAAG,OAAO,GAAG,UAAU,EAAE;QACzC,sBAAsB,EAAE,GAAG,OAAO,GAAG,kBAAkB,EAAE;QACzD,mBAAmB,EAAE,GAAG,OAAO,GAAG,eAAe,EAAE;QACnD,iBAAiB,EAAE,GAAG,OAAO,GAAG,aAAa,EAAE;QAC/C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,gBAAgB,EAAE,MAAM;QACxB,8CAA8C,EAAE,IAAI;QACpD,qCAAqC,EAAE,IAAI;KAC5C,CAAC;AACJ,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,qBAAqB,EAAE,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QACpE,gBAAgB,EAAE,MAAM;QACxB,wBAAwB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,CAAmD;IAC7E,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IACzB,OAAO,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAqB;IAC3D,KAAK,MAAM,QAAQ,IAAI,CAAC,uBAAuB,EAAE,8BAA8B,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,gCAAgC,EAAE,CAAC,CAAC,EAAE,EAAE,CAC9C,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,UAAU,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACzF,MAAM,IAAI,EAAE,CAAC;IACb,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IACzB,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;QAAE,OAAO;IAE9D,MAAM,IAAI,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,uBAAuB,EAAE,CAAC;IAC3D,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,6BAA6B,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO;IAEjG,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,wCAAwC,IAAI,IAAI,CAAC,CAAC;IAChG,2EAA2E;IAC3E,eAAe;IACf,CAAC,CAAC,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC,CAAC,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,mFAAmF;AACnF,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACxE,CAAC"}

package/dist/indieauth/grants.d.ts

@@ -0,0 +1,57 @@
+import type { Clock } from '../content/store.ts';
+import type { AuthorizationRequest, Scope } from './request.ts';
+/**
+ * What an authorization code stands for: who approved what, for which client,
+ * and the PKCE challenge the client must answer to redeem it (TASK-159,
+ * TASK-160).
+ */
+export interface AuthorizationCode {
+    readonly clientId: string;
+    /** What the client called itself, for the connected apps screen. */
+    readonly clientName?: string;
+    readonly redirectUri: string;
+    readonly codeChallenge: string;
+    readonly userId: number;
+    /** The canonical me URL the client is handed back. */
+    readonly me: string;
+    /** The scopes the person left ticked. */
+    readonly scopes: readonly Scope[];
+    /** The RFC 8707 resource the token is to be issued for. */
+    readonly resource?: string;
+}
+/** A request on the consent screen, waiting for the person to decide. */
+export interface PendingConsent {
+    readonly request: AuthorizationRequest;
+    /** Who was shown the screen. Nobody else may answer it. */
+    readonly userId: number;
+    /** The me URL the screen named. */
+    readonly me: string;
+    /** What the client called itself on the screen, when it said. */
+    readonly clientName?: string;
+}
+/** Values kept for a while under an unguessable key, each taken at most once. */
+export interface ExpiringStore<T> {
+    /** Keep `value` and answer the key it is kept under. */
+    put(value: T): string;
+    /** The value under `key`, removed as it is read, or `undefined` once it has expired. */
+    take(key: string): T | undefined;
+}
+/** How long a code may wait to be redeemed. The IndieAuth spec says at most ten minutes. */
+export declare const CODE_LIFETIME_MS: number;
+/** How long a consent screen may sit before its answer is refused. */
+export declare const CONSENT_LIFETIME_MS: number;
+/**
+ * The authorization server's short-lived state: codes and the consent screens
+ * they come from.
+ *
+ * Held in memory rather than in `data/`. Decision-9 asks files for state a
+ * restart must not lose, and these live for minutes: a restart costs whoever
+ * was mid-sign-in one more try, which is less than writing every sign-in to
+ * disk and sweeping it after.
+ */
+export interface IndieAuthState {
+    readonly codes: ExpiringStore<AuthorizationCode>;
+    readonly consents: ExpiringStore<PendingConsent>;
+}
+export declare function createIndieAuthState(now: Clock): IndieAuthState;
+//# sourceMappingURL=grants.d.ts.map

package/dist/indieauth/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/indieauth/grants.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAEhE;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,wDAAwD;IACxD,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC;IACtB,wFAAwF;IACxF,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CAClC;AAED,4FAA4F;AAC5F,eAAO,MAAM,gBAAgB,QAAgB,CAAC;AAE9C,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,QAAiB,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CAClD;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,KAAK,GAAG,cAAc,CAK/D"}

package/dist/indieauth/grants.js

@@ -0,0 +1,35 @@
+import { randomBytes } from 'node:crypto';
+/** How long a code may wait to be redeemed. The IndieAuth spec says at most ten minutes. */
+export const CODE_LIFETIME_MS = 5 * 60 * 1000;
+/** How long a consent screen may sit before its answer is refused. */
+export const CONSENT_LIFETIME_MS = 30 * 60 * 1000;
+export function createIndieAuthState(now) {
+    return {
+        codes: expiringStore(CODE_LIFETIME_MS, now),
+        consents: expiringStore(CONSENT_LIFETIME_MS, now),
+    };
+}
+function expiringStore(lifetimeMs, now) {
+    const entries = new Map();
+    return {
+        put(value) {
+            const at = now().getTime();
+            // Swept on every put, so nothing outlives its lifetime by more than the
+            // gap to the next sign-in.
+            for (const [key, entry] of entries)
+                if (entry.expiresAt <= at)
+                    entries.delete(key);
+            const key = randomBytes(32).toString('base64url');
+            entries.set(key, { value, expiresAt: at + lifetimeMs });
+            return key;
+        },
+        take(key) {
+            const entry = entries.get(key);
+            entries.delete(key);
+            if (entry === undefined || entry.expiresAt <= now().getTime())
+                return undefined;
+            return entry.value;
+        },
+    };
+}
+//# sourceMappingURL=grants.js.map

package/dist/indieauth/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/indieauth/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4C1C,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAgBlD,MAAM,UAAU,oBAAoB,CAAC,GAAU;IAC7C,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,gBAAgB,EAAE,GAAG,CAAC;QAC3C,QAAQ,EAAE,aAAa,CAAC,mBAAmB,EAAE,GAAG,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAI,UAAkB,EAAE,GAAU;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAC;IAEnE,OAAO;QACL,GAAG,CAAC,KAAK;YACP,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YAC3B,wEAAwE;YACxE,2BAA2B;YAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO;gBAAE,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE;oBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnF,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;YACxD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,CAAC,GAAG;YACN,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE;gBAAE,OAAO,SAAS,CAAC;YAChF,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/indieauth/identity.d.ts

@@ -0,0 +1,36 @@
+import type { User } from '../admin/accounts.ts';
+import type { SiteSettings } from '../admin/settings.ts';
+/** What resolving a me URL needs to know about the site. */
+export interface IdentitySite {
+    /** The site's base URL, which every identity URL is under. */
+    baseUrl: string;
+    users: readonly User[];
+    settings: Pick<SiteSettings, 'author' | 'soloAuthor'>;
+}
+/**
+ * The one user a me URL names, or `undefined` when it names nobody
+ * (decision-23).
+ *
+ * `/author/{username}/` names that user. The root names the user the author
+ * setting names, and only on a solo author site (TASK-180); on a multi-author
+ * site it is nobody's. Anything else names nobody, a query or a fragment
+ * included.
+ *
+ * A URL that differs from the site's only in http or https, a `www.` prefix
+ * on either side, the case of its scheme and host, or a missing trailing slash
+ * is the same URL: those are the spellings a person types and a client's
+ * redirects pass through, and the me handed back is always the canonical one.
+ */
+export declare function userForMe(me: string, site: IdentitySite): User | undefined;
+/**
+ * The me a sign-in hands back for `user`, who has just approved it
+ * (decision-23).
+ *
+ * The URL the person typed when it names them, spelled canonically: the root
+ * for the solo author who typed it, their author URL otherwise. A typed URL
+ * that names somebody else, or nobody, is ignored, and the answer is the
+ * signed-in user's own author URL: a person can only ever sign in as
+ * themselves.
+ */
+export declare function meForSignIn(typed: string | undefined, user: User, site: IdentitySite): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/indieauth/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/indieauth/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,4DAA4D;AAC5D,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IACvB,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,YAAY,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,CAE1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,GAAG,MAAM,CAK7F"}

package/dist/indieauth/identity.js

@@ -0,0 +1,78 @@
+import { authorHref, parseAuthorPath, userForAuthor } from '../web/authors.js';
+/**
+ * The one user a me URL names, or `undefined` when it names nobody
+ * (decision-23).
+ *
+ * `/author/{username}/` names that user. The root names the user the author
+ * setting names, and only on a solo author site (TASK-180); on a multi-author
+ * site it is nobody's. Anything else names nobody, a query or a fragment
+ * included.
+ *
+ * A URL that differs from the site's only in http or https, a `www.` prefix
+ * on either side, the case of its scheme and host, or a missing trailing slash
+ * is the same URL: those are the spellings a person types and a client's
+ * redirects pass through, and the me handed back is always the canonical one.
+ */
+export function userForMe(me, site) {
+    return identityNamed(me, site)?.user;
+}
+/**
+ * The me a sign-in hands back for `user`, who has just approved it
+ * (decision-23).
+ *
+ * The URL the person typed when it names them, spelled canonically: the root
+ * for the solo author who typed it, their author URL otherwise. A typed URL
+ * that names somebody else, or nobody, is ignored, and the answer is the
+ * signed-in user's own author URL: a person can only ever sign in as
+ * themselves.
+ */
+export function meForSignIn(typed, user, site) {
+    const named = typed === undefined ? undefined : identityNamed(typed, site);
+    const base = site.baseUrl.replace(/\/$/, '');
+    if (named?.user.id === user.id && named.root)
+        return `${base}/`;
+    return `${base}${authorHref(user.username)}`;
+}
+/** The user a me URL names, and whether it named them by the site root. */
+function identityNamed(me, site) {
+    const typed = URL.parse(me);
+    const base = URL.parse(site.baseUrl);
+    if (typed === null || base === null)
+        return undefined;
+    if (typed.protocol !== 'https:' && typed.protocol !== 'http:')
+        return undefined;
+    if (typed.username !== '' || typed.password !== '')
+        return undefined;
+    if (typed.search !== '' || typed.hash !== '' || me.includes('#') || me.includes('?')) {
+        return undefined;
+    }
+    if (withoutWww(typed.hostname) !== withoutWww(base.hostname))
+        return undefined;
+    if (typed.port !== base.port)
+        return undefined;
+    const root = withSlash(base.pathname);
+    const pathname = withSlash(typed.pathname);
+    if (!pathname.startsWith(root))
+        return undefined;
+    const local = `/${pathname.slice(root.length)}`;
+    // The author setting may hold a display name, which the homepage's bio reads
+    // the same way; an author path holds a username, matched exactly.
+    if (local === '/') {
+        const author = site.settings.soloAuthor
+            ? userForAuthor(site.users, site.settings.author)
+            : undefined;
+        return author === undefined ? undefined : { user: author, root: true };
+    }
+    const author = parseAuthorPath(local);
+    if (author?.pageNumber !== 0)
+        return undefined;
+    const user = site.users.find((candidate) => candidate.username === author.username);
+    return user === undefined ? undefined : { user, root: false };
+}
+function withoutWww(hostname) {
+    return hostname.startsWith('www.') ? hostname.slice(4) : hostname;
+}
+function withSlash(pathname) {
+    return pathname.endsWith('/') ? pathname : `${pathname}/`;
+}
+//# sourceMappingURL=identity.js.map

package/dist/indieauth/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/indieauth/identity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAU/E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,SAAS,CAAC,EAAU,EAAE,IAAkB;IACtD,OAAO,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,KAAyB,EAAE,IAAU,EAAE,IAAkB;IACnF,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,KAAK,EAAE,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,GAAG,IAAI,GAAG,CAAC;IAChE,OAAO,GAAG,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,SAAS,aAAa,CAAC,EAAU,EAAE,IAAkB;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAChF,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAEhD,6EAA6E;IAC7E,kEAAkE;IAClE,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU;YACrC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACjD,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,EAAE,UAAU,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC;AAC5D,CAAC"}

package/dist/indieauth/redeem.d.ts

@@ -0,0 +1,47 @@
+import type { User } from '../admin/accounts.ts';
+import type { AuthorizationCode, ExpiringStore } from './grants.ts';
+/** The OAuth errors a redemption can end in. */
+export type RedemptionError = 'invalid_request' | 'invalid_grant' | 'unsupported_grant_type';
+export type Redemption = {
+    readonly ok: true;
+    readonly grant: AuthorizationCode;
+} | {
+    readonly ok: false;
+    readonly error: RedemptionError;
+    readonly description: string;
+};
+/** The form fields a client posts to redeem a code, as they arrived. */
+export type RedemptionForm = Readonly<Record<string, string | undefined>>;
+/** A parsed form body as a {@link RedemptionForm}, a file upload read as absent. */
+export declare function redemptionForm(body: Readonly<Record<string, unknown>>): RedemptionForm;
+/**
+ * Take the code a client posts and check it against what it was issued for
+ * (TASK-159). The token endpoint (TASK-160) redeems codes through this too,
+ * so the two cannot disagree about what makes a code good.
+ *
+ * The code is taken before it is checked, so a try with the wrong verifier,
+ * client or redirect spends it: a code somebody is guessing the verifier for
+ * is a code that has leaked. `grant_type` may be left out, as clients written
+ * to the IndieAuth spec before 2020 do.
+ */
+export declare function redeemCode(codes: ExpiringStore<AuthorizationCode>, form: RedemptionForm): Redemption;
+/** The IndieAuth profile URL response: who signed in, and what they let the client see. */
+export interface ProfileResponse {
+    readonly me: string;
+    readonly profile?: {
+        readonly name?: string;
+        readonly url?: string;
+        readonly photo?: string;
+        readonly email?: string;
+    };
+}
+/**
+ * What profile redemption hands back for `grant`, signed in as `user`. The
+ * token endpoint answers it beside the token, for a code or a refresh.
+ *
+ * The name, url and photo come with the profile scope and the email with the
+ * email scope; the IndieAuth spec keeps all four under `profile`. The url is
+ * the me, the page that already carries this person's h-card.
+ */
+export declare function profileResponse(grant: Pick<AuthorizationCode, 'me' | 'scopes'>, user: User, baseUrl: string): ProfileResponse;
+//# sourceMappingURL=redeem.d.ts.map

package/dist/indieauth/redeem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redeem.d.ts","sourceRoot":"","sources":["../../src/indieauth/redeem.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEpE,gDAAgD;AAChD,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,eAAe,GAAG,wBAAwB,CAAC;AAE7F,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F,wEAAwE;AACxE,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAE1E,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,cAAc,CAOtF;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,aAAa,CAAC,iBAAiB,CAAC,EACvC,IAAI,EAAE,cAAc,GACnB,UAAU,CA2BZ;AAMD,2FAA2F;AAC3F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,GAAG,QAAQ,CAAC,EAC/C,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,GACd,eAAe,CAcjB"}

package/dist/indieauth/redeem.js

@@ -0,0 +1,69 @@
+import { createHash } from 'node:crypto';
+import { avatarUrl } from '../federation/actor.js';
+/** A parsed form body as a {@link RedemptionForm}, a file upload read as absent. */
+export function redemptionForm(body) {
+    return Object.fromEntries(Object.entries(body).map(([name, value]) => [
+        name,
+        typeof value === 'string' ? value : undefined,
+    ]));
+}
+/**
+ * Take the code a client posts and check it against what it was issued for
+ * (TASK-159). The token endpoint (TASK-160) redeems codes through this too,
+ * so the two cannot disagree about what makes a code good.
+ *
+ * The code is taken before it is checked, so a try with the wrong verifier,
+ * client or redirect spends it: a code somebody is guessing the verifier for
+ * is a code that has leaked. `grant_type` may be left out, as clients written
+ * to the IndieAuth spec before 2020 do.
+ */
+export function redeemCode(codes, form) {
+    const grantType = form['grant_type'];
+    if (grantType !== undefined && grantType !== 'authorization_code') {
+        return refuse('unsupported_grant_type', 'Only authorization_code is supported.');
+    }
+    const code = form['code'];
+    const clientId = form['client_id'];
+    const redirectUri = form['redirect_uri'];
+    const verifier = form['code_verifier'];
+    if (!code || !clientId || !redirectUri || !verifier) {
+        return refuse('invalid_request', 'code, client_id, redirect_uri and code_verifier are all required.');
+    }
+    const grant = codes.take(code);
+    if (grant === undefined) {
+        return refuse('invalid_grant', 'The code is unknown, expired or already used.');
+    }
+    if (grant.clientId !== clientId || grant.redirectUri !== redirectUri) {
+        return refuse('invalid_grant', 'The code was issued to another client or redirect_uri.');
+    }
+    if (createHash('sha256').update(verifier).digest('base64url') !== grant.codeChallenge) {
+        return refuse('invalid_grant', 'The code_verifier does not match the code_challenge.');
+    }
+    return { ok: true, grant };
+}
+function refuse(error, description) {
+    return { ok: false, error, description };
+}
+/**
+ * What profile redemption hands back for `grant`, signed in as `user`. The
+ * token endpoint answers it beside the token, for a code or a refresh.
+ *
+ * The name, url and photo come with the profile scope and the email with the
+ * email scope; the IndieAuth spec keeps all four under `profile`. The url is
+ * the me, the page that already carries this person's h-card.
+ */
+export function profileResponse(grant, user, baseUrl) {
+    const photo = user.profile?.avatar === undefined ? undefined : avatarUrl(user.profile.avatar, baseUrl);
+    const profile = {
+        ...(grant.scopes.includes('profile')
+            ? {
+                name: user.profile?.displayName ?? user.username,
+                url: grant.me,
+                ...(photo === undefined ? {} : { photo }),
+            }
+            : {}),
+        ...(grant.scopes.includes('email') && user.email !== undefined ? { email: user.email } : {}),
+    };
+    return Object.keys(profile).length === 0 ? { me: grant.me } : { me: grant.me, profile };
+}
+//# sourceMappingURL=redeem.js.map

package/dist/indieauth/redeem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redeem.js","sourceRoot":"","sources":["../../src/indieauth/redeem.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAanD,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,IAAuC;IACpE,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI;QACJ,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAC9C,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CACxB,KAAuC,EACvC,IAAoB;IAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QAClE,OAAO,MAAM,CAAC,wBAAwB,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpD,OAAO,MAAM,CACX,iBAAiB,EACjB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACrE,OAAO,MAAM,CAAC,eAAe,EAAE,wDAAwD,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACtF,OAAO,MAAM,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,MAAM,CAAC,KAAsB,EAAE,WAAmB;IACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAC3C,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,KAA+C,EAC/C,IAAU,EACV,OAAe;IAEf,MAAM,KAAK,GACT,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAClC,CAAC,CAAC;gBACE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC,QAAQ;gBAChD,GAAG,EAAE,KAAK,CAAC,EAAE;gBACb,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aAC1C;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7F,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;AAC1F,CAAC"}

package/dist/indieauth/request.d.ts

@@ -0,0 +1,47 @@
+import { SCOPES } from './discovery.ts';
+/** A scope this site can grant. */
+export type Scope = (typeof SCOPES)[number];
+/** A sign-in a client asked for, every field checked. */
+export interface AuthorizationRequest {
+    /** The client's URL, which is its identifier. */
+    readonly clientId: string;
+    /** Where the person is sent back with the answer. */
+    readonly redirectUri: string;
+    /** Handed back untouched, so the client can match the answer to its request. */
+    readonly state: string;
+    /** The S256 PKCE challenge the code will be bound to. */
+    readonly codeChallenge: string;
+    /** The scopes asked for that this site offers, in the order asked. */
+    readonly scopes: readonly Scope[];
+    /** The URL the person typed into the client, when the client passed it on. */
+    readonly me?: string;
+    /** The RFC 8707 resource the token is wanted for, when the client named one. */
+    readonly resource?: string;
+}
+/** The OAuth error codes a refused request is reported with. */
+export type AuthorizationError = 'invalid_request' | 'unsupported_response_type' | 'invalid_target';
+/**
+ * What a request to the authorization endpoint came to.
+ *
+ * `unredirectable` is a fault in `client_id` or `redirect_uri`: there is no
+ * address known to be the client's, so the person is shown a page. `refused`
+ * is any other fault, reported at `redirect_uri` once the client's metadata
+ * shows that address is the client's.
+ */
+export type ParsedAuthorizationRequest = {
+    readonly kind: 'valid';
+    readonly request: AuthorizationRequest;
+} | {
+    readonly kind: 'refused';
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly state: string | undefined;
+    readonly error: AuthorizationError;
+    readonly description: string;
+} | {
+    readonly kind: 'unredirectable';
+    readonly message: string;
+};
+/** Read an authorization request off its query string, for a site at `baseUrl`. */
+export declare function parseAuthorizationRequest(params: URLSearchParams, baseUrl: string): ParsedAuthorizationRequest;
+//# sourceMappingURL=request.d.ts.map

package/dist/indieauth/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/indieauth/request.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,mCAAmC;AACnC,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5C,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,gEAAgE;AAChE,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,2BAA2B,GAAG,gBAAgB,CAAC;AAEpG;;;;;;;GAOG;AACH,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GAClE;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAelE,mFAAmF;AACnF,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,MAAM,GACd,0BAA0B,CAyD5B"}