@geekity/cms 0.12.0 → 0.13.0

package/dist/indieauth/request.js

@@ -0,0 +1,104 @@
+import { isIP } from 'node:net';
+import { SCOPES } from './discovery.js';
+/** An S256 challenge: 32 bytes of hash in unpadded base64url. */
+const S256_CHALLENGE = /^[A-Za-z0-9_-]{43}$/;
+/** Schemes a redirect may never use, whatever a client's metadata lists. */
+const SCRIPTING_SCHEMES = new Set([
+    'javascript:',
+    'data:',
+    'vbscript:',
+    'file:',
+    'blob:',
+    'about:',
+]);
+/** Read an authorization request off its query string, for a site at `baseUrl`. */
+export function parseAuthorizationRequest(params, baseUrl) {
+    const clientId = clientIdentifier(params.get('client_id') ?? '');
+    if (clientId === undefined) {
+        return { kind: 'unredirectable', message: 'The app did not say which app it is.' };
+    }
+    const redirectUri = redirectAddress(params.get('redirect_uri') ?? '');
+    if (redirectUri === undefined) {
+        return { kind: 'unredirectable', message: 'The app did not say where to send you back.' };
+    }
+    const state = params.get('state') ?? undefined;
+    const refuse = (error, description) => ({
+        kind: 'refused',
+        clientId,
+        redirectUri,
+        state,
+        error,
+        description,
+    });
+    if (params.get('response_type') !== 'code') {
+        return refuse('unsupported_response_type', 'response_type must be code');
+    }
+    if (state === undefined || state === '')
+        return refuse('invalid_request', 'state is required');
+    const codeChallenge = params.get('code_challenge') ?? '';
+    if (!S256_CHALLENGE.test(codeChallenge)) {
+        return refuse('invalid_request', 'code_challenge must be an S256 PKCE challenge');
+    }
+    if (params.get('code_challenge_method') !== 'S256') {
+        return refuse('invalid_request', 'code_challenge_method must be S256');
+    }
+    const resources = params.getAll('resource');
+    if (resources.length > 1)
+        return refuse('invalid_target', 'name at most one resource');
+    const resource = resources[0];
+    if (resource !== undefined && !onSite(resource, baseUrl)) {
+        return refuse('invalid_target', 'resource must be an absolute URL on this site');
+    }
+    const offered = new Set(SCOPES);
+    const scopes = [...new Set((params.get('scope') ?? '').split(' '))].filter((scope) => offered.has(scope));
+    const me = params.get('me') ?? '';
+    return {
+        kind: 'valid',
+        request: {
+            clientId,
+            redirectUri,
+            state,
+            codeChallenge,
+            scopes,
+            ...(me === '' ? {} : { me }),
+            ...(resource === undefined ? {} : { resource }),
+        },
+    };
+}
+/**
+ * A client_id the IndieAuth spec allows, as given, or `undefined`.
+ *
+ * http or https, with no fragment, credentials or dot segments, and a domain
+ * name for a host: an IP address only when it is the loopback one a client
+ * in development runs on.
+ */
+function clientIdentifier(value) {
+    const url = URL.parse(value);
+    if (url === null || (url.protocol !== 'https:' && url.protocol !== 'http:'))
+        return undefined;
+    if (url.username !== '' || url.password !== '' || value.includes('#'))
+        return undefined;
+    const path = value
+        .slice(url.protocol.length + 2)
+        .replace(/^[^/?]*/, '')
+        .split('?')[0] ?? '';
+    if (path.split('/').some((segment) => segment === '.' || segment === '..'))
+        return undefined;
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    if (isIP(host) !== 0 && host !== '127.0.0.1' && host !== '::1')
+        return undefined;
+    return value;
+}
+/** An absolute redirect_uri with no fragment and no scripting scheme, or `undefined`. */
+function redirectAddress(value) {
+    const url = URL.parse(value);
+    if (url === null || value.includes('#') || SCRIPTING_SCHEMES.has(url.protocol))
+        return undefined;
+    return value;
+}
+/** Whether `value` is an absolute URL, with no fragment, on the site's own origin. */
+function onSite(value, baseUrl) {
+    const url = URL.parse(value);
+    return url !== null && !value.includes('#') && url.origin === new URL(baseUrl).origin;
+}
+//# sourceMappingURL=request.js.map

package/dist/indieauth/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/indieauth/request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AA8CxC,iEAAiE;AACjE,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C,4EAA4E;AAC5E,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,aAAa;IACb,OAAO;IACP,WAAW;IACX,OAAO;IACP,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,UAAU,yBAAyB,CACvC,MAAuB,EACvB,OAAe;IAEf,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IAC/C,MAAM,MAAM,GAAG,CAAC,KAAyB,EAAE,WAAmB,EAA8B,EAAE,CAAC,CAAC;QAC9F,IAAI,EAAE,SAAS;QACf,QAAQ;QACR,WAAW;QACX,KAAK;QACL,KAAK;QACL,WAAW;KACZ,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,MAAM,CAAC,2BAA2B,EAAE,4BAA4B,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC/F,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACzD,OAAO,MAAM,CAAC,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,OAAO,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CACxE,CAAC,KAAK,EAAkB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAC9C,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAElC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE;YACP,QAAQ;YACR,WAAW;YACX,KAAK;YACL,aAAa;YACb,MAAM;YACN,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YAC5B,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;SAChD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9F,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,MAAM,IAAI,GACR,KAAK;SACF,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;SAC9B,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7F,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yFAAyF;AACzF,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACjG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,SAAS,MAAM,CAAC,KAAa,EAAE,OAAe;IAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;AACxF,CAAC"}

package/dist/indieauth/token.d.ts

@@ -0,0 +1,19 @@
+import type { Hono } from 'hono';
+import type { GeekityEnv } from '../env.ts';
+/**
+ * The token endpoint (TASK-160): a client redeems its code here for a bearer
+ * token, or trades a refresh token for a new pair.
+ *
+ * A code is checked by the same {@link redeemCode} profile redemption uses, so
+ * a code spent at one endpoint is spent at both. Outside `/admin`, because the
+ * client posting here has no admin session, and not exempt from maintenance
+ * mode, like the authorization endpoint beside it.
+ */
+export declare function mountTokenEndpoint(app: Hono<GeekityEnv>): void;
+/**
+ * The endpoints that answer for a token once it is issued (TASK-161):
+ * introspection, revocation and userinfo. Outside `/admin` and behind the
+ * maintenance gate, like the token endpoint.
+ */
+export declare function mountTokenInfoEndpoints(app: Hono<GeekityEnv>): void;
+//# sourceMappingURL=token.d.ts.map

package/dist/indieauth/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/indieauth/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAC;AAI1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAoB5C;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CA2B9D;AA0BD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CA6CnE"}

package/dist/indieauth/token.js

@@ -0,0 +1,110 @@
+import { findUserById } from '../admin/accounts.js';
+import { requireBearer } from './bearer.js';
+import { INTROSPECTION_PATH, REVOCATION_PATH, TOKEN_PATH, USERINFO_PATH, siteBaseUrl, } from './discovery.js';
+import { profileResponse, redeemCode, redemptionForm } from './redeem.js';
+import { ACCESS_TOKEN_LIFETIME_MS, findAccessToken, issueTokens, refreshTokens, revokeToken, } from './tokens.js';
+/**
+ * The token endpoint (TASK-160): a client redeems its code here for a bearer
+ * token, or trades a refresh token for a new pair.
+ *
+ * A code is checked by the same {@link redeemCode} profile redemption uses, so
+ * a code spent at one endpoint is spent at both. Outside `/admin`, because the
+ * client posting here has no admin session, and not exempt from maintenance
+ * mode, like the authorization endpoint beside it.
+ */
+export function mountTokenEndpoint(app) {
+    app.post(TOKEN_PATH, async (c) => {
+        c.header('cache-control', 'no-store');
+        const form = redemptionForm(await c.req.parseBody());
+        const now = c.var.config.now();
+        if (form['grant_type'] === 'refresh_token') {
+            const refreshed = await refreshTokens(c.var.config.dataDir, form, now);
+            if (!refreshed.ok)
+                return refuse(c, refreshed.error, refreshed.description);
+            const user = findUserById(c.var.config.dataDir, refreshed.issued.token.userId);
+            if (user === undefined)
+                return refuse(c, 'invalid_grant', GONE);
+            return answer(c, refreshed.issued, user);
+        }
+        const redeemed = redeemCode(c.var.indieauth.codes, form);
+        if (!redeemed.ok)
+            return refuse(c, redeemed.error, redeemed.description);
+        const { grant } = redeemed;
+        if (grant.scopes.length === 0) {
+            return refuse(c, 'invalid_grant', 'The code was approved with no scope, so earns no token.');
+        }
+        if (!sameResource(form, grant.resource)) {
+            return refuse(c, 'invalid_target', 'resource must be the one the person approved.');
+        }
+        const user = findUserById(c.var.config.dataDir, grant.userId);
+        if (user === undefined)
+            return refuse(c, 'invalid_grant', GONE);
+        return answer(c, await issueTokens(c.var.config.dataDir, grant, now), user);
+    });
+}
+const GONE = 'The person who approved this is gone.';
+/** Whether the request names no resource, or the one the code was approved for (RFC 8707). */
+function sameResource(form, approved) {
+    const named = form['resource'];
+    return named === undefined || named === approved;
+}
+function answer(c, issued, user) {
+    const { token } = issued;
+    return c.json({
+        access_token: issued.accessToken,
+        token_type: 'Bearer',
+        scope: token.scopes.join(' '),
+        expires_in: ACCESS_TOKEN_LIFETIME_MS / 1000,
+        refresh_token: issued.refreshToken,
+        ...profileResponse(token, user, siteBaseUrl(c)),
+    });
+}
+function refuse(c, error, description) {
+    return c.json({ error, error_description: description }, 400);
+}
+/**
+ * The endpoints that answer for a token once it is issued (TASK-161):
+ * introspection, revocation and userinfo. Outside `/admin` and behind the
+ * maintenance gate, like the token endpoint.
+ */
+export function mountTokenInfoEndpoints(app) {
+    // RFC 7662. The IndieAuth spec asks that introspection need authorization
+    // of its own: here, another live token, and it answers only for tokens held
+    // by the same person, so one person's token can never tell anything about
+    // another's.
+    app.post(INTROSPECTION_PATH, requireBearer({ audience: 'authorization-server' }), async (c) => {
+        c.header('cache-control', 'no-store');
+        const presented = (await c.req.parseBody())['token'];
+        if (typeof presented !== 'string' || presented === '') {
+            return refuse(c, 'invalid_request', 'token is required.');
+        }
+        const token = findAccessToken(c.var.config.dataDir, presented, c.var.config.now());
+        if (token === undefined || token.userId !== c.var.bearer.user.id) {
+            return c.json({ active: false });
+        }
+        return c.json({
+            active: true,
+            me: token.me,
+            client_id: token.clientId,
+            scope: token.scopes.join(' '),
+            exp: Math.floor(Date.parse(token.expiresAt) / 1000),
+        });
+    });
+    // RFC 7009: holding the token is the authorization, and the answer is 200
+    // whether or not it was one, so a client learns nothing by guessing.
+    app.post(REVOCATION_PATH, async (c) => {
+        c.header('cache-control', 'no-store');
+        const presented = (await c.req.parseBody())['token'];
+        if (typeof presented !== 'string' || presented === '') {
+            return refuse(c, 'invalid_request', 'token is required.');
+        }
+        await revokeToken(c.var.config.dataDir, presented, c.var.config.now());
+        return c.body(null, 200);
+    });
+    app.get(USERINFO_PATH, requireBearer({ audience: 'authorization-server', scope: 'profile' }), (c) => {
+        c.header('cache-control', 'no-store');
+        const { token, user } = c.var.bearer;
+        return c.json(profileResponse(token, user, siteBaseUrl(c)).profile ?? {});
+    });
+}
+//# sourceMappingURL=token.js.map

package/dist/indieauth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/indieauth/token.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,aAAa,EACb,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE1E,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,WAAW,EACX,aAAa,EACb,WAAW,GACZ,MAAM,aAAa,CAAC;AAGrB;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAqB;IACtD,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAE/B,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,eAAe,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACvE,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;YAC5E,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/E,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;YAChE,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,CAAC,EAAE,eAAe,EAAE,yDAAyD,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,CAAC,EAAE,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,CAAC,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,IAAI,GAAG,uCAAuC,CAAC;AAErD,8FAA8F;AAC9F,SAAS,YAAY,CAAC,IAAoB,EAAE,QAA4B;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,SAAS,MAAM,CAAC,CAAsB,EAAE,MAAoB,EAAE,IAAU;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,UAAU,EAAE,wBAAwB,GAAG,IAAI;QAC3C,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAuB,CAAa,EAAE,KAAa,EAAE,WAAmB;IACrF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAqB;IAC3D,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,aAAa;IACb,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5F,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACtD,OAAO,MAAM,CAAC,CAAC,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACnF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,IAAI;YACZ,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;SACpD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,qEAAqE;IACrE,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACtD,OAAO,MAAM,CAAC,CAAC,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,aAAa,EACb,aAAa,CAAC,EAAE,QAAQ,EAAE,sBAAsB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EACrE,CAAC,CAAC,EAAE,EAAE;QACJ,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/indieauth/tokens.d.ts

@@ -0,0 +1,131 @@
+import type { AuthorizationCode } from './grants.ts';
+import type { RedemptionForm } from './redeem.ts';
+import type { Scope } from './request.ts';
+/**
+ * The access tokens the token endpoint has issued: `data/indieauth-tokens.json`
+ * (TASK-160, decision-24).
+ *
+ * A token is irreducible state under decision-9: a client holding one cannot
+ * be handed it again, so losing it signs the person out of every app. So it
+ * lives in a file in `data/`, written 0600 like `users.json`, and holds a
+ * SHA-256 hash of each token rather than the token. A token is 32 random
+ * bytes, so the hash needs no salt: nobody can guess their way back to one.
+ *
+ * One record per connection, that is per approval of a client: a refresh
+ * replaces both hashes in place, so the record keeps the id and the time the
+ * person approved it while the tokens change under it.
+ */
+/** The file, relative to `dataDir`. */
+export declare const TOKENS_FILE = "indieauth-tokens.json";
+/** The permissions the file is written with: nobody but the site's own user. */
+export declare const TOKENS_FILE_MODE = 384;
+/** How long an access token works for. */
+export declare const ACCESS_TOKEN_LIFETIME_MS: number;
+/** How long a refresh token works for, counted from its own issue: each refresh starts it again. */
+export declare const REFRESH_TOKEN_LIFETIME_MS: number;
+/**
+ * How stale a connection's last use may be. A token's use is written only
+ * when the stored one is older than this, so a client calling the API all
+ * day rewrites the file once an hour rather than once a request (TASK-162,
+ * decision-24).
+ */
+export declare const LAST_USE_RESOLUTION_MS: number;
+/** One connection as the file keeps it. */
+export interface StoredToken {
+    /** Stable for the life of the connection, so a screen can name it. */
+    readonly id: string;
+    readonly userId: number;
+    /** The canonical me URL the client was handed. */
+    readonly me: string;
+    readonly clientId: string;
+    /** What the client called itself on the consent screen, when it said. */
+    readonly clientName?: string;
+    readonly scopes: readonly Scope[];
+    /** The RFC 8707 resource the token is good at, or absent when the client named none. */
+    readonly resource?: string;
+    /** When the person approved the connection, as an ISO 8601 instant. */
+    readonly issuedAt: string;
+    /** When a resource server last accepted its token, to {@link LAST_USE_RESOLUTION_MS}. */
+    readonly lastUsedAt?: string;
+    readonly accessTokenHash: string;
+    /** When the current access token stops working. */
+    readonly expiresAt: string;
+    readonly refreshTokenHash: string;
+    /** When the current refresh token stops working. */
+    readonly refreshExpiresAt: string;
+}
+/** Tokens just issued: the only time the tokens themselves exist anywhere. */
+export interface IssuedTokens {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly token: StoredToken;
+}
+/**
+ * Who is asking a token to be checked: a resource server, by the resource
+ * identifier clients name it with.
+ *
+ * `acceptsUnbound` says whether it takes a token issued with no resource
+ * named. Micropub clients predate RFC 8707 and name none, so the Micropub
+ * endpoint will; MCP clients always name one, and the MCP spec asks a server
+ * to take only tokens issued for it, so the MCP endpoint will not.
+ */
+export interface Audience {
+    readonly resource: string;
+    readonly acceptsUnbound: boolean;
+}
+export type Refresh = {
+    readonly ok: true;
+    readonly issued: IssuedTokens;
+} | {
+    readonly ok: false;
+    readonly error: 'invalid_request' | 'invalid_grant';
+    readonly description: string;
+};
+/** Where the tokens file lives for a given data directory. */
+export declare function tokensFile(dataDir: string): string;
+/** Every connection in the file, live or not. */
+export declare function listTokens(dataDir: string): StoredToken[];
+/** Issue an access token and a refresh token for an approved code. */
+export declare function issueTokens(dataDir: string, grant: AuthorizationCode, now: Date): Promise<IssuedTokens>;
+/**
+ * Trade a refresh token for new tokens, from the client it was issued to.
+ *
+ * Both tokens rotate: the old access token and the old refresh token stop
+ * working the moment this returns. The scopes and resource stay the ones the
+ * person approved; a `scope` in the request is ignored, which RFC 6749 allows
+ * because the answer says the scope it holds.
+ */
+export declare function refreshTokens(dataDir: string, form: RedemptionForm, now: Date): Promise<Refresh>;
+/**
+ * The connection a live access token belongs to, whoever is asking; the
+ * authorization server's own endpoints take any token it issued. `undefined`
+ * for a token that is unknown or expired.
+ */
+export declare function findAccessToken(dataDir: string, accessToken: string, now: Date): StoredToken | undefined;
+/**
+ * The connection a live access token belongs to, when `audience` may accept
+ * it; `undefined` for a token that is unknown, expired or bound to another
+ * resource.
+ */
+export declare function verifyAccessToken(dataDir: string, accessToken: string, audience: Audience, now: Date): StoredToken | undefined;
+/**
+ * End the connection `presented` belongs to, whether it is the access token
+ * or the refresh token, so both stop working at once. Answers whether there
+ * was one.
+ */
+export declare function revokeToken(dataDir: string, presented: string, now: Date): Promise<boolean>;
+/**
+ * End connection `id` of `userId`, as the connected apps screen does, and
+ * answer what it was. Somebody else's connection, or one already gone, answers
+ * `undefined` and writes nothing.
+ */
+export declare function revokeConnection(dataDir: string, userId: number, id: string, now: Date): Promise<StoredToken | undefined>;
+/**
+ * Note that `token` was just accepted, unless its last use is already within
+ * {@link LAST_USE_RESOLUTION_MS}: the record says when it was last written,
+ * so no state outside the file is needed to keep the writes rare.
+ */
+export declare function recordUse(dataDir: string, token: StoredToken, now: Date): Promise<void>;
+/** Revoke every token `userId` holds. */
+export declare function revokeTokensForUser(dataDir: string, userId: number): Promise<void>;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/indieauth/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/indieauth/tokens.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE1C;;;;;;;;;;;;;GAaG;AAEH,uCAAuC;AACvC,eAAO,MAAM,WAAW,0BAA0B,CAAC;AAEnD,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAEtC,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB,QAA0B,CAAC;AAEhE,oGAAoG;AACpG,eAAO,MAAM,yBAAyB,QAA2B,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAiB,CAAC;AAErD,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,oDAAoD;IACpD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,MAAM,OAAO,GACf;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACpD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAMN,8DAA8D;AAC9D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,iDAAiD;AACjD,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CAGzD;AAED,sEAAsE;AACtE,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,YAAY,CAAC,CAevB;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,OAAO,CAAC,CAyClB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,IAAI,GACR,WAAW,GAAG,SAAS,CAKzB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,IAAI,GACR,WAAW,GAAG,SAAS,CAMzB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAQjG;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAMlC;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAO7F;AAED,yCAAyC;AACzC,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxF"}

package/dist/indieauth/tokens.js

@@ -0,0 +1,205 @@
+import { createHash, randomBytes } from 'node:crypto';
+import path from 'node:path';
+import { readFileIfPresentSync, updateFileAtomically } from '../files/atomic.js';
+/**
+ * The access tokens the token endpoint has issued: `data/indieauth-tokens.json`
+ * (TASK-160, decision-24).
+ *
+ * A token is irreducible state under decision-9: a client holding one cannot
+ * be handed it again, so losing it signs the person out of every app. So it
+ * lives in a file in `data/`, written 0600 like `users.json`, and holds a
+ * SHA-256 hash of each token rather than the token. A token is 32 random
+ * bytes, so the hash needs no salt: nobody can guess their way back to one.
+ *
+ * One record per connection, that is per approval of a client: a refresh
+ * replaces both hashes in place, so the record keeps the id and the time the
+ * person approved it while the tokens change under it.
+ */
+/** The file, relative to `dataDir`. */
+export const TOKENS_FILE = 'indieauth-tokens.json';
+/** The permissions the file is written with: nobody but the site's own user. */
+export const TOKENS_FILE_MODE = 0o600;
+/** How long an access token works for. */
+export const ACCESS_TOKEN_LIFETIME_MS = 7 * 24 * 60 * 60 * 1000;
+/** How long a refresh token works for, counted from its own issue: each refresh starts it again. */
+export const REFRESH_TOKEN_LIFETIME_MS = 60 * 24 * 60 * 60 * 1000;
+/**
+ * How stale a connection's last use may be. A token's use is written only
+ * when the stored one is older than this, so a client calling the API all
+ * day rewrites the file once an hour rather than once a request (TASK-162,
+ * decision-24).
+ */
+export const LAST_USE_RESOLUTION_MS = 60 * 60 * 1000;
+/** Where the tokens file lives for a given data directory. */
+export function tokensFile(dataDir) {
+    return path.join(dataDir, TOKENS_FILE);
+}
+/** Every connection in the file, live or not. */
+export function listTokens(dataDir) {
+    const text = readFileIfPresentSync(tokensFile(dataDir));
+    return text === undefined ? [] : JSON.parse(text).tokens;
+}
+/** Issue an access token and a refresh token for an approved code. */
+export async function issueTokens(dataDir, grant, now) {
+    const minted = mint(now);
+    const token = {
+        id: randomBytes(16).toString('base64url'),
+        userId: grant.userId,
+        me: grant.me,
+        clientId: grant.clientId,
+        ...(grant.clientName === undefined ? {} : { clientName: grant.clientName }),
+        scopes: grant.scopes,
+        ...(grant.resource === undefined ? {} : { resource: grant.resource }),
+        issuedAt: now.toISOString(),
+        ...minted.hashes,
+    };
+    await update(dataDir, now, (tokens) => [...tokens, token]);
+    return { accessToken: minted.accessToken, refreshToken: minted.refreshToken, token };
+}
+/**
+ * Trade a refresh token for new tokens, from the client it was issued to.
+ *
+ * Both tokens rotate: the old access token and the old refresh token stop
+ * working the moment this returns. The scopes and resource stay the ones the
+ * person approved; a `scope` in the request is ignored, which RFC 6749 allows
+ * because the answer says the scope it holds.
+ */
+export async function refreshTokens(dataDir, form, now) {
+    const presented = form['refresh_token'];
+    const clientId = form['client_id'];
+    if (!presented || !clientId) {
+        return {
+            ok: false,
+            error: 'invalid_request',
+            description: 'refresh_token and client_id are both required.',
+        };
+    }
+    const hash = hashToken(presented);
+    const refused = {
+        ok: false,
+        error: 'invalid_grant',
+        description: 'The refresh token is unknown, expired, already used or another client’s.',
+    };
+    // Looked for before the write, so a client guessing tokens cannot make the
+    // site rewrite the file; the write below checks again under its lock.
+    const matches = (token) => token.refreshTokenHash === hash &&
+        token.clientId === clientId &&
+        Date.parse(token.refreshExpiresAt) > now.getTime();
+    if (!listTokens(dataDir).some(matches))
+        return refused;
+    let issued;
+    await update(dataDir, now, (tokens) => tokens.map((token) => {
+        if (!matches(token))
+            return token;
+        const minted = mint(now);
+        const rotated = { ...token, ...minted.hashes };
+        issued = {
+            accessToken: minted.accessToken,
+            refreshToken: minted.refreshToken,
+            token: rotated,
+        };
+        return rotated;
+    }));
+    if (issued === undefined)
+        return refused;
+    return { ok: true, issued };
+}
+/**
+ * The connection a live access token belongs to, whoever is asking; the
+ * authorization server's own endpoints take any token it issued. `undefined`
+ * for a token that is unknown or expired.
+ */
+export function findAccessToken(dataDir, accessToken, now) {
+    const hash = hashToken(accessToken);
+    const token = listTokens(dataDir).find((candidate) => candidate.accessTokenHash === hash);
+    if (token === undefined || Date.parse(token.expiresAt) <= now.getTime())
+        return undefined;
+    return token;
+}
+/**
+ * The connection a live access token belongs to, when `audience` may accept
+ * it; `undefined` for a token that is unknown, expired or bound to another
+ * resource.
+ */
+export function verifyAccessToken(dataDir, accessToken, audience, now) {
+    const token = findAccessToken(dataDir, accessToken, now);
+    if (token === undefined)
+        return undefined;
+    const bound = token.resource === undefined ? audience.acceptsUnbound : token.resource === audience.resource;
+    return bound ? token : undefined;
+}
+/**
+ * End the connection `presented` belongs to, whether it is the access token
+ * or the refresh token, so both stop working at once. Answers whether there
+ * was one.
+ */
+export async function revokeToken(dataDir, presented, now) {
+    const hash = hashToken(presented);
+    const matches = (token) => token.accessTokenHash === hash || token.refreshTokenHash === hash;
+    // Looked for first, so a guessed token cannot make the site rewrite the file.
+    if (!listTokens(dataDir).some(matches))
+        return false;
+    await update(dataDir, now, (tokens) => tokens.filter((token) => !matches(token)));
+    return true;
+}
+/**
+ * End connection `id` of `userId`, as the connected apps screen does, and
+ * answer what it was. Somebody else's connection, or one already gone, answers
+ * `undefined` and writes nothing.
+ */
+export async function revokeConnection(dataDir, userId, id, now) {
+    const matches = (token) => token.id === id && token.userId === userId;
+    const revoked = listTokens(dataDir).find(matches);
+    if (revoked === undefined)
+        return undefined;
+    await update(dataDir, now, (tokens) => tokens.filter((token) => !matches(token)));
+    return revoked;
+}
+/**
+ * Note that `token` was just accepted, unless its last use is already within
+ * {@link LAST_USE_RESOLUTION_MS}: the record says when it was last written,
+ * so no state outside the file is needed to keep the writes rare.
+ */
+export async function recordUse(dataDir, token, now) {
+    const last = token.lastUsedAt === undefined ? undefined : Date.parse(token.lastUsedAt);
+    if (last !== undefined && now.getTime() - last <= LAST_USE_RESOLUTION_MS)
+        return;
+    const lastUsedAt = now.toISOString();
+    await update(dataDir, now, (tokens) => tokens.map((stored) => (stored.id === token.id ? { ...stored, lastUsedAt } : stored)));
+}
+/** Revoke every token `userId` holds. */
+export async function revokeTokensForUser(dataDir, userId) {
+    if (listTokens(dataDir).every((token) => token.userId !== userId))
+        return;
+    await update(dataDir, new Date(), (tokens) => tokens.filter((token) => token.userId !== userId));
+}
+/**
+ * Rewrite the file through `change`, dropping every connection whose refresh
+ * token has expired first: such a connection can never be used again, and
+ * sweeping on write keeps the file to the ones that can.
+ */
+async function update(dataDir, now, change) {
+    await updateFileAtomically(tokensFile(dataDir), (current) => {
+        const tokens = current === undefined ? [] : JSON.parse(current).tokens;
+        const live = tokens.filter((token) => Date.parse(token.refreshExpiresAt) > now.getTime());
+        return `${JSON.stringify({ tokens: change(live) }, null, 2)}\n`;
+    }, { mode: TOKENS_FILE_MODE });
+}
+function mint(now) {
+    const accessToken = randomBytes(32).toString('base64url');
+    const refreshToken = randomBytes(32).toString('base64url');
+    return {
+        accessToken,
+        refreshToken,
+        hashes: {
+            accessTokenHash: hashToken(accessToken),
+            expiresAt: new Date(now.getTime() + ACCESS_TOKEN_LIFETIME_MS).toISOString(),
+            refreshTokenHash: hashToken(refreshToken),
+            refreshExpiresAt: new Date(now.getTime() + REFRESH_TOKEN_LIFETIME_MS).toISOString(),
+        },
+    };
+}
+function hashToken(token) {
+    return createHash('sha256').update(token).digest('base64url');
+}
+//# sourceMappingURL=tokens.js.map

package/dist/indieauth/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/indieauth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAKjF;;;;;;;;;;;;;GAaG;AAEH,uCAAuC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAEnD,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAEtC,0CAA0C;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhE,oGAAoG;AACpG,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA4DrD,8DAA8D;AAC9D,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,MAAM,IAAI,GAAG,qBAAqB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC,MAAM,CAAC;AAC3E,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,KAAwB,EACxB,GAAS;IAET,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAgB;QACzB,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3E,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrE,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE;QAC3B,GAAG,MAAM,CAAC,MAAM;KACjB,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;AACvF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,IAAoB,EACpB,GAAS;IAET,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,gDAAgD;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,OAAO,GAAY;QACvB,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,0EAA0E;KACxF,CAAC;IACF,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,OAAO,GAAG,CAAC,KAAkB,EAAE,EAAE,CACrC,KAAK,CAAC,gBAAgB,KAAK,IAAI;QAC/B,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAC3B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAEvD,IAAI,MAAgC,CAAC;IACrC,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CACpC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACnB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/C,MAAM,GAAG;YACP,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,KAAK,EAAE,OAAO;SACf,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CACH,CAAC;IACF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,WAAmB,EACnB,GAAS;IAET,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC;IAC1F,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1F,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,WAAmB,EACnB,QAAkB,EAClB,GAAS;IAET,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,KAAK,GACT,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC;IAChG,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,SAAiB,EAAE,GAAS;IAC7E,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,CAAC,KAAkB,EAAE,EAAE,CACrC,KAAK,CAAC,eAAe,KAAK,IAAI,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC;IACpE,8EAA8E;IAC9E,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,MAAc,EACd,EAAU,EACV,GAAS;IAET,MAAM,OAAO,GAAG,CAAC,KAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;IACnF,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe,EAAE,KAAkB,EAAE,GAAS;IAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACvF,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,sBAAsB;QAAE,OAAO;IACjF,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CACpC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACtF,CAAC;AACJ,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAe,EAAE,MAAc;IACvE,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;QAAE,OAAO;IAC1E,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,MAAM,CACnB,OAAe,EACf,GAAS,EACT,MAAgD;IAEhD,MAAM,oBAAoB,CACxB,UAAU,CAAC,OAAO,CAAC,EACnB,CAAC,OAAO,EAAE,EAAE;QACV,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC,MAAM,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1F,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAuB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACvF,CAAC,EACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,GAAS;IACrB,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,OAAO;QACL,WAAW;QACX,YAAY;QACZ,MAAM,EAAE;YACN,eAAe,EAAE,SAAS,CAAC,WAAW,CAAC;YACvC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,wBAAwB,CAAC,CAAC,WAAW,EAAE;YAC3E,gBAAgB,EAAE,SAAS,CAAC,YAAY,CAAC;YACzC,gBAAgB,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,yBAAyB,CAAC,CAAC,WAAW,EAAE;SACpF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC"}

package/dist/web/archive.d.ts

@@ -45,5 +45,5 @@ export interface ArchiveMonth {
  * own: an archive is a calendar, and a post that is on no day of it is not a
  * month a reader could be shown.
  */
-export declare function archiveMonths(posts: readonly Document[], timezone?: string): ArchiveMonth[];
+export declare function archiveMonths(posts: readonly Document[], timezone?: string, locale?: string): ArchiveMonth[];
 //# sourceMappingURL=archive.d.ts.map

package/dist/web/archive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../src/web/archive.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAIvD;;;;;;;;;;;;;;GAcG;AAEH,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAElD,+DAA+D;AAC/D,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAEvD;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,EAAE,YAAY,EAAE,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,SAAS,QAAQ,EAAE,EAC1B,QAAQ,GAAE,MAAyB,GAClC,YAAY,EAAE,CAyBhB"}
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../src/web/archive.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAKvD;;;;;;;;;;;;;;GAcG;AAEH,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAElD,+DAA+D;AAC/D,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAEvD;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,EAAE,YAAY,EAAE,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,SAAS,QAAQ,EAAE,EAC1B,QAAQ,GAAE,MAAyB,EACnC,MAAM,GAAE,MAAuB,GAC9B,YAAY,EAAE,CAyBhB"}