@geekity/cms 0.12.0 → 0.14.0

package/dist/indieauth/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/indieauth/identity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAU/E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,SAAS,CAAC,EAAU,EAAE,IAAkB;IACtD,OAAO,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,KAAyB,EAAE,IAAU,EAAE,IAAkB;IACnF,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,KAAK,EAAE,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,GAAG,IAAI,GAAG,CAAC;IAChE,OAAO,GAAG,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,SAAS,aAAa,CAAC,EAAU,EAAE,IAAkB;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAChF,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAEhD,uEAAuE;IACvE,6EAA6E;IAC7E,yDAAyD;IACzD,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,EAAE,UAAU,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC;AAC5D,CAAC"}

package/dist/indieauth/redeem.d.ts

@@ -0,0 +1,47 @@
+import type { User } from '../admin/accounts.ts';
+import type { AuthorizationCode, ExpiringStore } from './grants.ts';
+/** The OAuth errors a redemption can end in. */
+export type RedemptionError = 'invalid_request' | 'invalid_grant' | 'unsupported_grant_type';
+export type Redemption = {
+    readonly ok: true;
+    readonly grant: AuthorizationCode;
+} | {
+    readonly ok: false;
+    readonly error: RedemptionError;
+    readonly description: string;
+};
+/** The form fields a client posts to redeem a code, as they arrived. */
+export type RedemptionForm = Readonly<Record<string, string | undefined>>;
+/** A parsed form body as a {@link RedemptionForm}, a file upload read as absent. */
+export declare function redemptionForm(body: Readonly<Record<string, unknown>>): RedemptionForm;
+/**
+ * Take the code a client posts and check it against what it was issued for
+ * (TASK-159). The token endpoint (TASK-160) redeems codes through this too,
+ * so the two cannot disagree about what makes a code good.
+ *
+ * The code is taken before it is checked, so a try with the wrong verifier,
+ * client or redirect spends it: a code somebody is guessing the verifier for
+ * is a code that has leaked. `grant_type` may be left out, as clients written
+ * to the IndieAuth spec before 2020 do.
+ */
+export declare function redeemCode(codes: ExpiringStore<AuthorizationCode>, form: RedemptionForm): Redemption;
+/** The IndieAuth profile URL response: who signed in, and what they let the client see. */
+export interface ProfileResponse {
+    readonly me: string;
+    readonly profile?: {
+        readonly name?: string;
+        readonly url?: string;
+        readonly photo?: string;
+        readonly email?: string;
+    };
+}
+/**
+ * What profile redemption hands back for `grant`, signed in as `user`. The
+ * token endpoint answers it beside the token, for a code or a refresh.
+ *
+ * The name, url and photo come with the profile scope and the email with the
+ * email scope; the IndieAuth spec keeps all four under `profile`. The url is
+ * the me, the page that already carries this person's h-card.
+ */
+export declare function profileResponse(grant: Pick<AuthorizationCode, 'me' | 'scopes'>, user: User, baseUrl: string): ProfileResponse;
+//# sourceMappingURL=redeem.d.ts.map

package/dist/indieauth/redeem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redeem.d.ts","sourceRoot":"","sources":["../../src/indieauth/redeem.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEpE,gDAAgD;AAChD,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,eAAe,GAAG,wBAAwB,CAAC;AAE7F,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F,wEAAwE;AACxE,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAE1E,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,cAAc,CAOtF;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,aAAa,CAAC,iBAAiB,CAAC,EACvC,IAAI,EAAE,cAAc,GACnB,UAAU,CA2BZ;AAMD,2FAA2F;AAC3F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,GAAG,QAAQ,CAAC,EAC/C,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,GACd,eAAe,CAcjB"}

package/dist/indieauth/redeem.js

@@ -0,0 +1,69 @@
+import { createHash } from 'node:crypto';
+import { avatarUrl } from '../federation/actor.js';
+/** A parsed form body as a {@link RedemptionForm}, a file upload read as absent. */
+export function redemptionForm(body) {
+    return Object.fromEntries(Object.entries(body).map(([name, value]) => [
+        name,
+        typeof value === 'string' ? value : undefined,
+    ]));
+}
+/**
+ * Take the code a client posts and check it against what it was issued for
+ * (TASK-159). The token endpoint (TASK-160) redeems codes through this too,
+ * so the two cannot disagree about what makes a code good.
+ *
+ * The code is taken before it is checked, so a try with the wrong verifier,
+ * client or redirect spends it: a code somebody is guessing the verifier for
+ * is a code that has leaked. `grant_type` may be left out, as clients written
+ * to the IndieAuth spec before 2020 do.
+ */
+export function redeemCode(codes, form) {
+    const grantType = form['grant_type'];
+    if (grantType !== undefined && grantType !== 'authorization_code') {
+        return refuse('unsupported_grant_type', 'Only authorization_code is supported.');
+    }
+    const code = form['code'];
+    const clientId = form['client_id'];
+    const redirectUri = form['redirect_uri'];
+    const verifier = form['code_verifier'];
+    if (!code || !clientId || !redirectUri || !verifier) {
+        return refuse('invalid_request', 'code, client_id, redirect_uri and code_verifier are all required.');
+    }
+    const grant = codes.take(code);
+    if (grant === undefined) {
+        return refuse('invalid_grant', 'The code is unknown, expired or already used.');
+    }
+    if (grant.clientId !== clientId || grant.redirectUri !== redirectUri) {
+        return refuse('invalid_grant', 'The code was issued to another client or redirect_uri.');
+    }
+    if (createHash('sha256').update(verifier).digest('base64url') !== grant.codeChallenge) {
+        return refuse('invalid_grant', 'The code_verifier does not match the code_challenge.');
+    }
+    return { ok: true, grant };
+}
+function refuse(error, description) {
+    return { ok: false, error, description };
+}
+/**
+ * What profile redemption hands back for `grant`, signed in as `user`. The
+ * token endpoint answers it beside the token, for a code or a refresh.
+ *
+ * The name, url and photo come with the profile scope and the email with the
+ * email scope; the IndieAuth spec keeps all four under `profile`. The url is
+ * the me, the page that already carries this person's h-card.
+ */
+export function profileResponse(grant, user, baseUrl) {
+    const photo = user.profile?.avatar === undefined ? undefined : avatarUrl(user.profile.avatar, baseUrl);
+    const profile = {
+        ...(grant.scopes.includes('profile')
+            ? {
+                name: user.profile?.displayName ?? user.username,
+                url: grant.me,
+                ...(photo === undefined ? {} : { photo }),
+            }
+            : {}),
+        ...(grant.scopes.includes('email') && user.email !== undefined ? { email: user.email } : {}),
+    };
+    return Object.keys(profile).length === 0 ? { me: grant.me } : { me: grant.me, profile };
+}
+//# sourceMappingURL=redeem.js.map

package/dist/indieauth/redeem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redeem.js","sourceRoot":"","sources":["../../src/indieauth/redeem.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAanD,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,IAAuC;IACpE,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI;QACJ,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAC9C,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CACxB,KAAuC,EACvC,IAAoB;IAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QAClE,OAAO,MAAM,CAAC,wBAAwB,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpD,OAAO,MAAM,CACX,iBAAiB,EACjB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACrE,OAAO,MAAM,CAAC,eAAe,EAAE,wDAAwD,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACtF,OAAO,MAAM,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,MAAM,CAAC,KAAsB,EAAE,WAAmB;IACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAC3C,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,KAA+C,EAC/C,IAAU,EACV,OAAe;IAEf,MAAM,KAAK,GACT,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAClC,CAAC,CAAC;gBACE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC,QAAQ;gBAChD,GAAG,EAAE,KAAK,CAAC,EAAE;gBACb,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aAC1C;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7F,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;AAC1F,CAAC"}

package/dist/indieauth/request.d.ts

@@ -0,0 +1,47 @@
+import { SCOPES } from './discovery.ts';
+/** A scope this site can grant. */
+export type Scope = (typeof SCOPES)[number];
+/** A sign-in a client asked for, every field checked. */
+export interface AuthorizationRequest {
+    /** The client's URL, which is its identifier. */
+    readonly clientId: string;
+    /** Where the person is sent back with the answer. */
+    readonly redirectUri: string;
+    /** Handed back untouched, so the client can match the answer to its request. */
+    readonly state: string;
+    /** The S256 PKCE challenge the code will be bound to. */
+    readonly codeChallenge: string;
+    /** The scopes asked for that this site offers, in the order asked. */
+    readonly scopes: readonly Scope[];
+    /** The URL the person typed into the client, when the client passed it on. */
+    readonly me?: string;
+    /** The RFC 8707 resource the token is wanted for, when the client named one. */
+    readonly resource?: string;
+}
+/** The OAuth error codes a refused request is reported with. */
+export type AuthorizationError = 'invalid_request' | 'unsupported_response_type' | 'invalid_target';
+/**
+ * What a request to the authorization endpoint came to.
+ *
+ * `unredirectable` is a fault in `client_id` or `redirect_uri`: there is no
+ * address known to be the client's, so the person is shown a page. `refused`
+ * is any other fault, reported at `redirect_uri` once the client's metadata
+ * shows that address is the client's.
+ */
+export type ParsedAuthorizationRequest = {
+    readonly kind: 'valid';
+    readonly request: AuthorizationRequest;
+} | {
+    readonly kind: 'refused';
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly state: string | undefined;
+    readonly error: AuthorizationError;
+    readonly description: string;
+} | {
+    readonly kind: 'unredirectable';
+    readonly message: string;
+};
+/** Read an authorization request off its query string, for a site at `baseUrl`. */
+export declare function parseAuthorizationRequest(params: URLSearchParams, baseUrl: string): ParsedAuthorizationRequest;
+//# sourceMappingURL=request.d.ts.map

package/dist/indieauth/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/indieauth/request.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,mCAAmC;AACnC,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5C,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,gEAAgE;AAChE,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,2BAA2B,GAAG,gBAAgB,CAAC;AAEpG;;;;;;;GAOG;AACH,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GAClE;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAelE,mFAAmF;AACnF,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,MAAM,GACd,0BAA0B,CAyD5B"}

package/dist/indieauth/request.js

@@ -0,0 +1,104 @@
+import { isIP } from 'node:net';
+import { SCOPES } from './discovery.js';
+/** An S256 challenge: 32 bytes of hash in unpadded base64url. */
+const S256_CHALLENGE = /^[A-Za-z0-9_-]{43}$/;
+/** Schemes a redirect may never use, whatever a client's metadata lists. */
+const SCRIPTING_SCHEMES = new Set([
+    'javascript:',
+    'data:',
+    'vbscript:',
+    'file:',
+    'blob:',
+    'about:',
+]);
+/** Read an authorization request off its query string, for a site at `baseUrl`. */
+export function parseAuthorizationRequest(params, baseUrl) {
+    const clientId = clientIdentifier(params.get('client_id') ?? '');
+    if (clientId === undefined) {
+        return { kind: 'unredirectable', message: 'The app did not say which app it is.' };
+    }
+    const redirectUri = redirectAddress(params.get('redirect_uri') ?? '');
+    if (redirectUri === undefined) {
+        return { kind: 'unredirectable', message: 'The app did not say where to send you back.' };
+    }
+    const state = params.get('state') ?? undefined;
+    const refuse = (error, description) => ({
+        kind: 'refused',
+        clientId,
+        redirectUri,
+        state,
+        error,
+        description,
+    });
+    if (params.get('response_type') !== 'code') {
+        return refuse('unsupported_response_type', 'response_type must be code');
+    }
+    if (state === undefined || state === '')
+        return refuse('invalid_request', 'state is required');
+    const codeChallenge = params.get('code_challenge') ?? '';
+    if (!S256_CHALLENGE.test(codeChallenge)) {
+        return refuse('invalid_request', 'code_challenge must be an S256 PKCE challenge');
+    }
+    if (params.get('code_challenge_method') !== 'S256') {
+        return refuse('invalid_request', 'code_challenge_method must be S256');
+    }
+    const resources = params.getAll('resource');
+    if (resources.length > 1)
+        return refuse('invalid_target', 'name at most one resource');
+    const resource = resources[0];
+    if (resource !== undefined && !onSite(resource, baseUrl)) {
+        return refuse('invalid_target', 'resource must be an absolute URL on this site');
+    }
+    const offered = new Set(SCOPES);
+    const scopes = [...new Set((params.get('scope') ?? '').split(' '))].filter((scope) => offered.has(scope));
+    const me = params.get('me') ?? '';
+    return {
+        kind: 'valid',
+        request: {
+            clientId,
+            redirectUri,
+            state,
+            codeChallenge,
+            scopes,
+            ...(me === '' ? {} : { me }),
+            ...(resource === undefined ? {} : { resource }),
+        },
+    };
+}
+/**
+ * A client_id the IndieAuth spec allows, as given, or `undefined`.
+ *
+ * http or https, with no fragment, credentials or dot segments, and a domain
+ * name for a host: an IP address only when it is the loopback one a client
+ * in development runs on.
+ */
+function clientIdentifier(value) {
+    const url = URL.parse(value);
+    if (url === null || (url.protocol !== 'https:' && url.protocol !== 'http:'))
+        return undefined;
+    if (url.username !== '' || url.password !== '' || value.includes('#'))
+        return undefined;
+    const path = value
+        .slice(url.protocol.length + 2)
+        .replace(/^[^/?]*/, '')
+        .split('?')[0] ?? '';
+    if (path.split('/').some((segment) => segment === '.' || segment === '..'))
+        return undefined;
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    if (isIP(host) !== 0 && host !== '127.0.0.1' && host !== '::1')
+        return undefined;
+    return value;
+}
+/** An absolute redirect_uri with no fragment and no scripting scheme, or `undefined`. */
+function redirectAddress(value) {
+    const url = URL.parse(value);
+    if (url === null || value.includes('#') || SCRIPTING_SCHEMES.has(url.protocol))
+        return undefined;
+    return value;
+}
+/** Whether `value` is an absolute URL, with no fragment, on the site's own origin. */
+function onSite(value, baseUrl) {
+    const url = URL.parse(value);
+    return url !== null && !value.includes('#') && url.origin === new URL(baseUrl).origin;
+}
+//# sourceMappingURL=request.js.map

package/dist/indieauth/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/indieauth/request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AA8CxC,iEAAiE;AACjE,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C,4EAA4E;AAC5E,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,aAAa;IACb,OAAO;IACP,WAAW;IACX,OAAO;IACP,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,UAAU,yBAAyB,CACvC,MAAuB,EACvB,OAAe;IAEf,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IAC/C,MAAM,MAAM,GAAG,CAAC,KAAyB,EAAE,WAAmB,EAA8B,EAAE,CAAC,CAAC;QAC9F,IAAI,EAAE,SAAS;QACf,QAAQ;QACR,WAAW;QACX,KAAK;QACL,KAAK;QACL,WAAW;KACZ,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,MAAM,CAAC,2BAA2B,EAAE,4BAA4B,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC/F,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACzD,OAAO,MAAM,CAAC,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,OAAO,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CACxE,CAAC,KAAK,EAAkB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAC9C,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAElC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE;YACP,QAAQ;YACR,WAAW;YACX,KAAK;YACL,aAAa;YACb,MAAM;YACN,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YAC5B,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;SAChD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9F,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,MAAM,IAAI,GACR,KAAK;SACF,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;SAC9B,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7F,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yFAAyF;AACzF,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACjG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,SAAS,MAAM,CAAC,KAAa,EAAE,OAAe;IAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;AACxF,CAAC"}

package/dist/indieauth/token.d.ts

@@ -0,0 +1,19 @@
+import type { Hono } from 'hono';
+import type { GeekityEnv } from '../env.ts';
+/**
+ * The token endpoint (TASK-160): a client redeems its code here for a bearer
+ * token, or trades a refresh token for a new pair.
+ *
+ * A code is checked by the same {@link redeemCode} profile redemption uses, so
+ * a code spent at one endpoint is spent at both. Outside `/admin`, because the
+ * client posting here has no admin session, and not exempt from maintenance
+ * mode, like the authorization endpoint beside it.
+ */
+export declare function mountTokenEndpoint(app: Hono<GeekityEnv>): void;
+/**
+ * The endpoints that answer for a token once it is issued (TASK-161):
+ * introspection, revocation and userinfo. Outside `/admin` and behind the
+ * maintenance gate, like the token endpoint.
+ */
+export declare function mountTokenInfoEndpoints(app: Hono<GeekityEnv>): void;
+//# sourceMappingURL=token.d.ts.map

package/dist/indieauth/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/indieauth/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAC;AAI1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAoB5C;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CA2B9D;AA0BD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CA6CnE"}

package/dist/indieauth/token.js

@@ -0,0 +1,110 @@
+import { findUserById } from '../admin/accounts.js';
+import { requireBearer } from './bearer.js';
+import { INTROSPECTION_PATH, REVOCATION_PATH, TOKEN_PATH, USERINFO_PATH, siteBaseUrl, } from './discovery.js';
+import { profileResponse, redeemCode, redemptionForm } from './redeem.js';
+import { ACCESS_TOKEN_LIFETIME_MS, findAccessToken, issueTokens, refreshTokens, revokeToken, } from './tokens.js';
+/**
+ * The token endpoint (TASK-160): a client redeems its code here for a bearer
+ * token, or trades a refresh token for a new pair.
+ *
+ * A code is checked by the same {@link redeemCode} profile redemption uses, so
+ * a code spent at one endpoint is spent at both. Outside `/admin`, because the
+ * client posting here has no admin session, and not exempt from maintenance
+ * mode, like the authorization endpoint beside it.
+ */
+export function mountTokenEndpoint(app) {
+    app.post(TOKEN_PATH, async (c) => {
+        c.header('cache-control', 'no-store');
+        const form = redemptionForm(await c.req.parseBody());
+        const now = c.var.config.now();
+        if (form['grant_type'] === 'refresh_token') {
+            const refreshed = await refreshTokens(c.var.config.dataDir, form, now);
+            if (!refreshed.ok)
+                return refuse(c, refreshed.error, refreshed.description);
+            const user = findUserById(c.var.config.dataDir, refreshed.issued.token.userId);
+            if (user === undefined)
+                return refuse(c, 'invalid_grant', GONE);
+            return answer(c, refreshed.issued, user);
+        }
+        const redeemed = redeemCode(c.var.indieauth.codes, form);
+        if (!redeemed.ok)
+            return refuse(c, redeemed.error, redeemed.description);
+        const { grant } = redeemed;
+        if (grant.scopes.length === 0) {
+            return refuse(c, 'invalid_grant', 'The code was approved with no scope, so earns no token.');
+        }
+        if (!sameResource(form, grant.resource)) {
+            return refuse(c, 'invalid_target', 'resource must be the one the person approved.');
+        }
+        const user = findUserById(c.var.config.dataDir, grant.userId);
+        if (user === undefined)
+            return refuse(c, 'invalid_grant', GONE);
+        return answer(c, await issueTokens(c.var.config.dataDir, grant, now), user);
+    });
+}
+const GONE = 'The person who approved this is gone.';
+/** Whether the request names no resource, or the one the code was approved for (RFC 8707). */
+function sameResource(form, approved) {
+    const named = form['resource'];
+    return named === undefined || named === approved;
+}
+function answer(c, issued, user) {
+    const { token } = issued;
+    return c.json({
+        access_token: issued.accessToken,
+        token_type: 'Bearer',
+        scope: token.scopes.join(' '),
+        expires_in: ACCESS_TOKEN_LIFETIME_MS / 1000,
+        refresh_token: issued.refreshToken,
+        ...profileResponse(token, user, siteBaseUrl(c)),
+    });
+}
+function refuse(c, error, description) {
+    return c.json({ error, error_description: description }, 400);
+}
+/**
+ * The endpoints that answer for a token once it is issued (TASK-161):
+ * introspection, revocation and userinfo. Outside `/admin` and behind the
+ * maintenance gate, like the token endpoint.
+ */
+export function mountTokenInfoEndpoints(app) {
+    // RFC 7662. The IndieAuth spec asks that introspection need authorization
+    // of its own: here, another live token, and it answers only for tokens held
+    // by the same person, so one person's token can never tell anything about
+    // another's.
+    app.post(INTROSPECTION_PATH, requireBearer({ audience: 'authorization-server' }), async (c) => {
+        c.header('cache-control', 'no-store');
+        const presented = (await c.req.parseBody())['token'];
+        if (typeof presented !== 'string' || presented === '') {
+            return refuse(c, 'invalid_request', 'token is required.');
+        }
+        const token = findAccessToken(c.var.config.dataDir, presented, c.var.config.now());
+        if (token === undefined || token.userId !== c.var.bearer.user.id) {
+            return c.json({ active: false });
+        }
+        return c.json({
+            active: true,
+            me: token.me,
+            client_id: token.clientId,
+            scope: token.scopes.join(' '),
+            exp: Math.floor(Date.parse(token.expiresAt) / 1000),
+        });
+    });
+    // RFC 7009: holding the token is the authorization, and the answer is 200
+    // whether or not it was one, so a client learns nothing by guessing.
+    app.post(REVOCATION_PATH, async (c) => {
+        c.header('cache-control', 'no-store');
+        const presented = (await c.req.parseBody())['token'];
+        if (typeof presented !== 'string' || presented === '') {
+            return refuse(c, 'invalid_request', 'token is required.');
+        }
+        await revokeToken(c.var.config.dataDir, presented, c.var.config.now());
+        return c.body(null, 200);
+    });
+    app.get(USERINFO_PATH, requireBearer({ audience: 'authorization-server', scope: 'profile' }), (c) => {
+        c.header('cache-control', 'no-store');
+        const { token, user } = c.var.bearer;
+        return c.json(profileResponse(token, user, siteBaseUrl(c)).profile ?? {});
+    });
+}
+//# sourceMappingURL=token.js.map

package/dist/indieauth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/indieauth/token.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,aAAa,EACb,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE1E,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,WAAW,EACX,aAAa,EACb,WAAW,GACZ,MAAM,aAAa,CAAC;AAGrB;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAqB;IACtD,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAE/B,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,eAAe,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACvE,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;YAC5E,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/E,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;YAChE,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,CAAC,EAAE,eAAe,EAAE,yDAAyD,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,CAAC,EAAE,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,CAAC,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,IAAI,GAAG,uCAAuC,CAAC;AAErD,8FAA8F;AAC9F,SAAS,YAAY,CAAC,IAAoB,EAAE,QAA4B;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,SAAS,MAAM,CAAC,CAAsB,EAAE,MAAoB,EAAE,IAAU;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,UAAU,EAAE,wBAAwB,GAAG,IAAI;QAC3C,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAuB,CAAa,EAAE,KAAa,EAAE,WAAmB;IACrF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAqB;IAC3D,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,aAAa;IACb,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5F,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACtD,OAAO,MAAM,CAAC,CAAC,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACnF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,IAAI;YACZ,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;SACpD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,qEAAqE;IACrE,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACtD,OAAO,MAAM,CAAC,CAAC,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,aAAa,EACb,aAAa,CAAC,EAAE,QAAQ,EAAE,sBAAsB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EACrE,CAAC,CAAC,EAAE,EAAE;QACJ,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/indieauth/tokens.d.ts

@@ -0,0 +1,131 @@
+import type { AuthorizationCode } from './grants.ts';
+import type { RedemptionForm } from './redeem.ts';
+import type { Scope } from './request.ts';
+/**
+ * The access tokens the token endpoint has issued: `data/indieauth-tokens.json`
+ * (TASK-160, decision-24).
+ *
+ * A token is irreducible state under decision-9: a client holding one cannot
+ * be handed it again, so losing it signs the person out of every app. So it
+ * lives in a file in `data/`, written 0600 like `users.json`, and holds a
+ * SHA-256 hash of each token rather than the token. A token is 32 random
+ * bytes, so the hash needs no salt: nobody can guess their way back to one.
+ *
+ * One record per connection, that is per approval of a client: a refresh
+ * replaces both hashes in place, so the record keeps the id and the time the
+ * person approved it while the tokens change under it.
+ */
+/** The file, relative to `dataDir`. */
+export declare const TOKENS_FILE = "indieauth-tokens.json";
+/** The permissions the file is written with: nobody but the site's own user. */
+export declare const TOKENS_FILE_MODE = 384;
+/** How long an access token works for. */
+export declare const ACCESS_TOKEN_LIFETIME_MS: number;
+/** How long a refresh token works for, counted from its own issue: each refresh starts it again. */
+export declare const REFRESH_TOKEN_LIFETIME_MS: number;
+/**
+ * How stale a connection's last use may be. A token's use is written only
+ * when the stored one is older than this, so a client calling the API all
+ * day rewrites the file once an hour rather than once a request (TASK-162,
+ * decision-24).
+ */
+export declare const LAST_USE_RESOLUTION_MS: number;
+/** One connection as the file keeps it. */
+export interface StoredToken {
+    /** Stable for the life of the connection, so a screen can name it. */
+    readonly id: string;
+    readonly userId: number;
+    /** The canonical me URL the client was handed. */
+    readonly me: string;
+    readonly clientId: string;
+    /** What the client called itself on the consent screen, when it said. */
+    readonly clientName?: string;
+    readonly scopes: readonly Scope[];
+    /** The RFC 8707 resource the token is good at, or absent when the client named none. */
+    readonly resource?: string;
+    /** When the person approved the connection, as an ISO 8601 instant. */
+    readonly issuedAt: string;
+    /** When a resource server last accepted its token, to {@link LAST_USE_RESOLUTION_MS}. */
+    readonly lastUsedAt?: string;
+    readonly accessTokenHash: string;
+    /** When the current access token stops working. */
+    readonly expiresAt: string;
+    readonly refreshTokenHash: string;
+    /** When the current refresh token stops working. */
+    readonly refreshExpiresAt: string;
+}
+/** Tokens just issued: the only time the tokens themselves exist anywhere. */
+export interface IssuedTokens {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly token: StoredToken;
+}
+/**
+ * Who is asking a token to be checked: a resource server, by the resource
+ * identifier clients name it with.
+ *
+ * `acceptsUnbound` says whether it takes a token issued with no resource
+ * named. Micropub clients predate RFC 8707 and name none, so the Micropub
+ * endpoint will; MCP clients always name one, and the MCP spec asks a server
+ * to take only tokens issued for it, so the MCP endpoint will not.
+ */
+export interface Audience {
+    readonly resource: string;
+    readonly acceptsUnbound: boolean;
+}
+export type Refresh = {
+    readonly ok: true;
+    readonly issued: IssuedTokens;
+} | {
+    readonly ok: false;
+    readonly error: 'invalid_request' | 'invalid_grant';
+    readonly description: string;
+};
+/** Where the tokens file lives for a given data directory. */
+export declare function tokensFile(dataDir: string): string;
+/** Every connection in the file, live or not. */
+export declare function listTokens(dataDir: string): StoredToken[];
+/** Issue an access token and a refresh token for an approved code. */
+export declare function issueTokens(dataDir: string, grant: AuthorizationCode, now: Date): Promise<IssuedTokens>;
+/**
+ * Trade a refresh token for new tokens, from the client it was issued to.
+ *
+ * Both tokens rotate: the old access token and the old refresh token stop
+ * working the moment this returns. The scopes and resource stay the ones the
+ * person approved; a `scope` in the request is ignored, which RFC 6749 allows
+ * because the answer says the scope it holds.
+ */
+export declare function refreshTokens(dataDir: string, form: RedemptionForm, now: Date): Promise<Refresh>;
+/**
+ * The connection a live access token belongs to, whoever is asking; the
+ * authorization server's own endpoints take any token it issued. `undefined`
+ * for a token that is unknown or expired.
+ */
+export declare function findAccessToken(dataDir: string, accessToken: string, now: Date): StoredToken | undefined;
+/**
+ * The connection a live access token belongs to, when `audience` may accept
+ * it; `undefined` for a token that is unknown, expired or bound to another
+ * resource.
+ */
+export declare function verifyAccessToken(dataDir: string, accessToken: string, audience: Audience, now: Date): StoredToken | undefined;
+/**
+ * End the connection `presented` belongs to, whether it is the access token
+ * or the refresh token, so both stop working at once. Answers whether there
+ * was one.
+ */
+export declare function revokeToken(dataDir: string, presented: string, now: Date): Promise<boolean>;
+/**
+ * End connection `id` of `userId`, as the connected apps screen does, and
+ * answer what it was. Somebody else's connection, or one already gone, answers
+ * `undefined` and writes nothing.
+ */
+export declare function revokeConnection(dataDir: string, userId: number, id: string, now: Date): Promise<StoredToken | undefined>;
+/**
+ * Note that `token` was just accepted, unless its last use is already within
+ * {@link LAST_USE_RESOLUTION_MS}: the record says when it was last written,
+ * so no state outside the file is needed to keep the writes rare.
+ */
+export declare function recordUse(dataDir: string, token: StoredToken, now: Date): Promise<void>;
+/** Revoke every token `userId` holds. */
+export declare function revokeTokensForUser(dataDir: string, userId: number): Promise<void>;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/indieauth/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/indieauth/tokens.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE1C;;;;;;;;;;;;;GAaG;AAEH,uCAAuC;AACvC,eAAO,MAAM,WAAW,0BAA0B,CAAC;AAEnD,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAEtC,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB,QAA0B,CAAC;AAEhE,oGAAoG;AACpG,eAAO,MAAM,yBAAyB,QAA2B,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAiB,CAAC;AAErD,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,oDAAoD;IACpD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,MAAM,OAAO,GACf;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACpD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAMN,8DAA8D;AAC9D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,iDAAiD;AACjD,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CAGzD;AAED,sEAAsE;AACtE,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,YAAY,CAAC,CAevB;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,OAAO,CAAC,CAyClB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,IAAI,GACR,WAAW,GAAG,SAAS,CAKzB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,IAAI,GACR,WAAW,GAAG,SAAS,CAMzB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAQjG;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAMlC;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAO7F;AAED,yCAAyC;AACzC,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxF"}