@grest-ts/oauth 0.0.0-stage → 0.0.90

package/dist/src/node/store/GGOAuthStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGOAuthStore.js","sourceRoot":"","sources":["../../../../src/node/store/GGOAuthStore.ts"],"names":[],"mappings":"AA0BA,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC7C,OAAO,MAAM,cAAc;QACN,KAAK,CAAQ;QAC9B,YAAY,KAAa,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA,CAAC,CAAC;QACjD,MAAM,GAAG,CAAC,EAAU,EAAE,OAAuB,EAAE,SAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QACtH,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACjD,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAC7D,gCAAgC;QAChC,cAAc,GAAG,KAAK,IAAI,EAAE,CAAC,SAAS,CAAA;QACtC,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACvD,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACvD,eAAe,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;KACxE,CAAA;AACL,CAAC"}

package/dist/src/node/store/InMemoryOAuthStore.d.ts

@@ -0,0 +1,16 @@
+import type { GGOAuthPayload, GGOAuthStore } from "./GGOAuthStore";
+export declare class InMemoryOAuthStore implements GGOAuthStore {
+    private readonly rows;
+    private readonly now;
+    constructor(now?: () => number);
+    upsert: (model: string, id: string, payload: GGOAuthPayload, expiresInSec: number | undefined) => Promise<void>;
+    find: (model: string, id: string) => Promise<GGOAuthPayload | undefined>;
+    findByUid: (model: string, uid: string) => Promise<GGOAuthPayload | undefined>;
+    consume: (model: string, id: string) => Promise<void>;
+    destroy: (model: string, id: string) => Promise<void>;
+    revokeByGrantId: (grantId: string) => Promise<void>;
+    listIdsByAccount: (model: string, accountId: string) => Promise<string[]>;
+    private findWhere;
+    private live;
+}
+//# sourceMappingURL=InMemoryOAuthStore.d.ts.map

package/dist/src/node/store/InMemoryOAuthStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InMemoryOAuthStore.d.ts","sourceRoot":"","sources":["../../../../src/node/store/InMemoryOAuthStore.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,cAAc,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAA;AAKhE,qBAAa,kBAAmB,YAAW,YAAY;IAEnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAE9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;gBAEtB,GAAG,GAAE,MAAM,MAAiB;IAIjC,MAAM,GAAU,OAAO,MAAM,EAAE,IAAI,MAAM,EAAE,SAAS,cAAc,EAAE,cAAc,MAAM,GAAG,SAAS,KAAG,OAAO,CAAC,IAAI,CAAC,CAE1H;IAEM,IAAI,GAAU,OAAO,MAAM,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAuD;IAEpI,SAAS,GAAU,OAAO,MAAM,EAAE,KAAK,MAAM,yCAA8C;IAE3F,OAAO,GAAU,OAAO,MAAM,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC,CAQhE;IAEM,OAAO,GAAU,OAAO,MAAM,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC,CAEhE;IAEM,eAAe,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;IAEM,gBAAgB,GAAU,OAAO,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CACyC;IAE9H,OAAO,CAAC,SAAS;IAKjB,OAAO,CAAC,IAAI;CAGf"}

package/dist/src/node/store/InMemoryOAuthStore.js

@@ -0,0 +1,44 @@
+import { errors as oidcErrors } from "oidc-provider";
+// Single-process only (tests, local dev): state is lost on restart and not shared across instances.
+export class InMemoryOAuthStore {
+    rows = new Map();
+    now;
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    upsert = async (model, id, payload, expiresInSec) => {
+        this.rows.set(`${model}:${id}`, { model, id, payload, expiresAt: expiresInSec ? this.now() + expiresInSec * 1000 : undefined });
+    };
+    find = async (model, id) => this.live(this.rows.get(`${model}:${id}`))?.payload;
+    findByUid = async (model, uid) => this.findWhere(model, p => p.uid === uid);
+    consume = async (model, id) => {
+        const row = this.rows.get(`${model}:${id}`);
+        if (!row) {
+            if (model === "AuthorizationCode" || model === "RefreshToken")
+                throw new oidcErrors.InvalidGrant(`${model} revoked`);
+            return;
+        }
+        if (row.payload.consumed !== undefined)
+            throw new oidcErrors.InvalidGrant(`${model} already used`);
+        row.payload = { ...row.payload, consumed: Math.floor(this.now() / 1000) };
+    };
+    destroy = async (model, id) => {
+        this.rows.delete(`${model}:${id}`);
+    };
+    revokeByGrantId = async (grantId) => {
+        for (const [key, row] of this.rows)
+            if (row.payload.grantId === grantId)
+                this.rows.delete(key);
+    };
+    listIdsByAccount = async (model, accountId) => [...this.rows.values()].filter(r => r.model === model && this.live(r) && r.payload.accountId === accountId).map(r => r.id);
+    findWhere(model, match) {
+        for (const row of this.rows.values())
+            if (row.model === model && this.live(row) && match(row.payload))
+                return row.payload;
+        return undefined;
+    }
+    live(row) {
+        return row && (row.expiresAt === undefined || row.expiresAt > this.now()) ? row : undefined;
+    }
+}
+//# sourceMappingURL=InMemoryOAuthStore.js.map

package/dist/src/node/store/InMemoryOAuthStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InMemoryOAuthStore.js","sourceRoot":"","sources":["../../../../src/node/store/InMemoryOAuthStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,MAAM,IAAI,UAAU,EAAC,MAAM,eAAe,CAAA;AAKlD,oGAAoG;AACpG,MAAM,OAAO,kBAAkB;IAEV,IAAI,GAAG,IAAI,GAAG,EAAe,CAAA;IAE7B,GAAG,CAAc;IAElC,YAAY,MAAoB,IAAI,CAAC,GAAG;QACpC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;IAClB,CAAC;IAEM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAE,EAAU,EAAE,OAAuB,EAAE,YAAgC,EAAiB,EAAE;QAC1H,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,EAAE,EAAC,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,EAAC,CAAC,CAAA;IACjI,CAAC,CAAA;IAEM,IAAI,GAAG,KAAK,EAAE,KAAa,EAAE,EAAU,EAAuC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,CAAA;IAEpI,SAAS,GAAG,KAAK,EAAE,KAAa,EAAE,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IAE3F,OAAO,GAAG,KAAK,EAAE,KAAa,EAAE,EAAU,EAAiB,EAAE;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAA;QAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,IAAI,KAAK,KAAK,mBAAmB,IAAI,KAAK,KAAK,cAAc;gBAAE,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,GAAG,KAAK,UAAU,CAAC,CAAA;YACpH,OAAM;QACV,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,GAAG,KAAK,eAAe,CAAC,CAAA;QAClG,GAAG,CAAC,OAAO,GAAG,EAAC,GAAG,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAC,CAAA;IAC3E,CAAC,CAAA;IAEM,OAAO,GAAG,KAAK,EAAE,KAAa,EAAE,EAAU,EAAiB,EAAE;QAChE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAA;IACtC,CAAC,CAAA;IAEM,eAAe,GAAG,KAAK,EAAE,OAAe,EAAiB,EAAE;QAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAClG,CAAC,CAAA;IAEM,gBAAgB,GAAG,KAAK,EAAE,KAAa,EAAE,SAAiB,EAAqB,EAAE,CACpF,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAEtH,SAAS,CAAC,KAAa,EAAE,KAAqC;QAClE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,GAAG,CAAC,OAAO,CAAA;QACzH,OAAO,SAAS,CAAA;IACpB,CAAC;IAEO,IAAI,CAAC,GAAoB;QAC7B,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/F,CAAC;CACJ"}

package/dist/src/shared/interactionContract.d.ts

@@ -0,0 +1,77 @@
+import { GGContractClass } from "@grest-ts/schema";
+export declare const IsGGOAuthInteractionClient: import("@grest-ts/schema").ObjectSchema<{
+    clientId: string;
+    name: string;
+    firstParty: boolean;
+    redirectHosts: string[];
+    loopbackOnly: boolean;
+}>;
+export type GGOAuthInteractionClient = typeof IsGGOAuthInteractionClient.infer;
+export declare const IsGGOAuthInteraction: import("@grest-ts/schema").ObjectSchema<{
+    uid: string;
+    client: {
+        clientId: string;
+        name: string;
+        firstParty: boolean;
+        redirectHosts: string[];
+        loopbackOnly: boolean;
+    };
+    scopes: string[];
+    resource: string;
+}>;
+export type GGOAuthInteraction = typeof IsGGOAuthInteraction.infer;
+/**
+ * The app's login/consent page talks to this. Bind it with the app's own user wire — the
+ * signed-in user becomes the OAuth subject — e.g.
+ *   new GGHttpSchema({contract: GGOAuthInteractionContract, pathPrefix: "api/oauth/interaction", use: [USER_WIRE], routes: {...}})
+ */
+export declare const GGOAuthInteractionContract: GGContractClass<{
+    get: {
+        input: import("@grest-ts/schema").ObjectSchema<{
+            uid: string;
+        }>;
+        success: import("@grest-ts/schema").ObjectSchema<{
+            uid: string;
+            client: {
+                clientId: string;
+                name: string;
+                firstParty: boolean;
+                redirectHosts: string[];
+                loopbackOnly: boolean;
+            };
+            scopes: string[];
+            resource: string;
+        }>;
+        errors: (import("@grest-ts/schema").ERR_CLASS<"NOT_FOUND"> | import("@grest-ts/schema").ERR_CLASS<"NOT_AUTHORIZED"> | import("@grest-ts/schema").ERR_CLASS<"SERVER_ERROR">)[];
+        permission: Readonly<{
+            readonly __permission: "none";
+        }>;
+    };
+    /** The signed-in user approves: the browser then follows redirectUrl to receive the code. */
+    approve: {
+        input: import("@grest-ts/schema").ObjectSchema<{
+            uid: string;
+        }>;
+        success: import("@grest-ts/schema").ObjectSchema<{
+            redirectUrl: string;
+        }>;
+        errors: (import("@grest-ts/schema").ERR_CLASS<"NOT_FOUND"> | import("@grest-ts/schema").ERR_CLASS<"NOT_AUTHORIZED"> | import("@grest-ts/schema").ERR_CLASS<"SERVER_ERROR"> | import("@grest-ts/schema").ERR_CLASS<"FORBIDDEN">)[];
+        permission: Readonly<{
+            readonly __permission: "none";
+        }>;
+    };
+    /** The user declines: the client receives access_denied. */
+    deny: {
+        input: import("@grest-ts/schema").ObjectSchema<{
+            uid: string;
+        }>;
+        success: import("@grest-ts/schema").ObjectSchema<{
+            redirectUrl: string;
+        }>;
+        errors: (import("@grest-ts/schema").ERR_CLASS<"NOT_FOUND"> | import("@grest-ts/schema").ERR_CLASS<"NOT_AUTHORIZED"> | import("@grest-ts/schema").ERR_CLASS<"SERVER_ERROR">)[];
+        permission: Readonly<{
+            readonly __permission: "none";
+        }>;
+    };
+}>;
+//# sourceMappingURL=interactionContract.d.ts.map

package/dist/src/shared/interactionContract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactionContract.d.ts","sourceRoot":"","sources":["../../../src/shared/interactionContract.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,eAAe,EAAkF,MAAM,kBAAkB,CAAA;AAE/J,eAAO,MAAM,0BAA0B;;;;;;EASrC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,OAAO,0BAA0B,CAAC,KAAK,CAAA;AAE9E,eAAO,MAAM,oBAAoB;;;;;;;;;;;EAM/B,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,OAAO,oBAAoB,CAAC,KAAK,CAAA;AAMlE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;IAEnC,6FAA6F;;;;;;;;;;;;;IAE7F,4DAA4D;;;;;;;;;;;;;EAE9D,CAAA"}

package/dist/src/shared/interactionContract.js

@@ -0,0 +1,34 @@
+import { FORBIDDEN, GG_NO_PERMISSIONS, GGContractClass, IsArray, IsBoolean, IsObject, IsString, NOT_AUTHORIZED, NOT_FOUND, SERVER_ERROR } from "@grest-ts/schema";
+export const IsGGOAuthInteractionClient = IsObject({
+    clientId: IsString,
+    name: IsString,
+    /** Pre-registered by the app (its own UI/CLI). Third-party clients must be shown a consent screen. */
+    firstParty: IsBoolean,
+    /** Hosts the authorization code is sent to — show these on the consent screen. */
+    redirectHosts: IsArray(IsString),
+    /** Every redirect is a loopback address: any local process could be posing as this client. */
+    loopbackOnly: IsBoolean,
+});
+export const IsGGOAuthInteraction = IsObject({
+    uid: IsString,
+    client: IsGGOAuthInteractionClient,
+    scopes: IsArray(IsString),
+    /** The resource (API) the client asks for access to. */
+    resource: IsString,
+});
+const IsUid = IsObject({ uid: IsString.nonEmpty });
+/** Where the browser must navigate next: back to the authorization server, which finishes the flow. */
+const IsRedirect = IsObject({ redirectUrl: IsString });
+/**
+ * The app's login/consent page talks to this. Bind it with the app's own user wire — the
+ * signed-in user becomes the OAuth subject — e.g.
+ *   new GGHttpSchema({contract: GGOAuthInteractionContract, pathPrefix: "api/oauth/interaction", use: [USER_WIRE], routes: {...}})
+ */
+export const GGOAuthInteractionContract = new GGContractClass("GGOAuthInteraction", {
+    get: { input: IsUid, success: IsGGOAuthInteraction, errors: [NOT_FOUND, NOT_AUTHORIZED, SERVER_ERROR], permission: GG_NO_PERMISSIONS },
+    /** The signed-in user approves: the browser then follows redirectUrl to receive the code. */
+    approve: { input: IsUid, success: IsRedirect, errors: [NOT_FOUND, NOT_AUTHORIZED, FORBIDDEN, SERVER_ERROR], permission: GG_NO_PERMISSIONS },
+    /** The user declines: the client receives access_denied. */
+    deny: { input: IsUid, success: IsRedirect, errors: [NOT_FOUND, NOT_AUTHORIZED, SERVER_ERROR], permission: GG_NO_PERMISSIONS },
+});
+//# sourceMappingURL=interactionContract.js.map

package/dist/src/shared/interactionContract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactionContract.js","sourceRoot":"","sources":["../../../src/shared/interactionContract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,SAAS,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAC,MAAM,kBAAkB,CAAA;AAE/J,MAAM,CAAC,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAC/C,QAAQ,EAAE,QAAQ;IAClB,IAAI,EAAE,QAAQ;IACd,sGAAsG;IACtG,UAAU,EAAE,SAAS;IACrB,kFAAkF;IAClF,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC;IAChC,8FAA8F;IAC9F,YAAY,EAAE,SAAS;CAC1B,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IACzC,GAAG,EAAE,QAAQ;IACb,MAAM,EAAE,0BAA0B;IAClC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC;IACzB,wDAAwD;IACxD,QAAQ,EAAE,QAAQ;CACrB,CAAC,CAAA;AAGF,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAC,CAAC,CAAA;AAChD,uGAAuG;AACvG,MAAM,UAAU,GAAG,QAAQ,CAAC,EAAC,WAAW,EAAE,QAAQ,EAAC,CAAC,CAAA;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,eAAe,CAAC,oBAAoB,EAAE;IAChF,GAAG,EAAE,EAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAC;IACpI,6FAA6F;IAC7F,OAAO,EAAE,EAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAC;IACzI,4DAA4D;IAC5D,IAAI,EAAE,EAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAC;CAC9H,CAAC,CAAA"}

package/dist/src/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "//": "THIS FILE IS GENERATED - DO NOT EDIT",
+  "extends": "../../../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": ".",
+    "lib": [
+      "ES2022",
+      "DOM"
+    ],
+    "types": [
+      "node",
+      "vitest/globals"
+    ]
+  },
+  "include": [
+    "**/*"
+  ]
+}