@happyvertical/auth 0.103.3 → 0.103.5

package/dist/server/index.js

@@ -0,0 +1,761 @@
+import { D as encode$1, S as JWTInvalid, T as concat, a as normalizeKey, b as JWTClaimValidationFailed, c as isDisjoint, d as JOSEAlgNotAllowed, i as validateCrit, n as JWTClaimsBuilder, p as JOSENotSupported, r as checkKeyType, s as sign, t as jwtVerify, u as assertNotSet, v as JWSInvalid, w as encode, x as JWTExpired, y as JWSSignatureVerificationFailed } from "../chunks/verify-CGYWoFss.js";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+//#region ../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/jws/flattened/sign.js
+var FlattenedSign = class {
+	#payload;
+	#protectedHeader;
+	#unprotectedHeader;
+	constructor(payload) {
+		if (!(payload instanceof Uint8Array)) throw new TypeError("payload must be an instance of Uint8Array");
+		this.#payload = payload;
+	}
+	setProtectedHeader(protectedHeader) {
+		assertNotSet(this.#protectedHeader, "setProtectedHeader");
+		this.#protectedHeader = protectedHeader;
+		return this;
+	}
+	setUnprotectedHeader(unprotectedHeader) {
+		assertNotSet(this.#unprotectedHeader, "setUnprotectedHeader");
+		this.#unprotectedHeader = unprotectedHeader;
+		return this;
+	}
+	async sign(key, options) {
+		if (!this.#protectedHeader && !this.#unprotectedHeader) throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
+		if (!isDisjoint(this.#protectedHeader, this.#unprotectedHeader)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+		const joseHeader = {
+			...this.#protectedHeader,
+			...this.#unprotectedHeader
+		};
+		const extensions = validateCrit(JWSInvalid, /* @__PURE__ */ new Map([["b64", true]]), options?.crit, this.#protectedHeader, joseHeader);
+		let b64 = true;
+		if (extensions.has("b64")) {
+			b64 = this.#protectedHeader.b64;
+			if (typeof b64 !== "boolean") throw new JWSInvalid("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
+		}
+		const { alg } = joseHeader;
+		if (typeof alg !== "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
+		checkKeyType(alg, key, "sign");
+		let payloadS;
+		let payloadB;
+		if (b64) {
+			payloadS = encode(this.#payload);
+			payloadB = encode$1(payloadS);
+		} else {
+			payloadB = this.#payload;
+			payloadS = "";
+		}
+		let protectedHeaderString;
+		let protectedHeaderBytes;
+		if (this.#protectedHeader) {
+			protectedHeaderString = encode(JSON.stringify(this.#protectedHeader));
+			protectedHeaderBytes = encode$1(protectedHeaderString);
+		} else {
+			protectedHeaderString = "";
+			protectedHeaderBytes = /* @__PURE__ */ new Uint8Array();
+		}
+		const data = concat(protectedHeaderBytes, encode$1("."), payloadB);
+		const jws = {
+			signature: encode(await sign(alg, await normalizeKey(key, alg), data)),
+			payload: payloadS
+		};
+		if (this.#unprotectedHeader) jws.header = this.#unprotectedHeader;
+		if (this.#protectedHeader) jws.protected = protectedHeaderString;
+		return jws;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/jws/compact/sign.js
+var CompactSign = class {
+	#flattened;
+	constructor(payload) {
+		this.#flattened = new FlattenedSign(payload);
+	}
+	setProtectedHeader(protectedHeader) {
+		this.#flattened.setProtectedHeader(protectedHeader);
+		return this;
+	}
+	async sign(key, options) {
+		const jws = await this.#flattened.sign(key, options);
+		if (jws.payload === void 0) throw new TypeError("use the flattened module for creating JWS with b64: false");
+		return `${jws.protected}.${jws.payload}.${jws.signature}`;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.2/node_modules/jose/dist/webapi/jwt/sign.js
+var SignJWT = class {
+	#protectedHeader;
+	#jwt;
+	constructor(payload = {}) {
+		this.#jwt = new JWTClaimsBuilder(payload);
+	}
+	setIssuer(issuer) {
+		this.#jwt.iss = issuer;
+		return this;
+	}
+	setSubject(subject) {
+		this.#jwt.sub = subject;
+		return this;
+	}
+	setAudience(audience) {
+		this.#jwt.aud = audience;
+		return this;
+	}
+	setJti(jwtId) {
+		this.#jwt.jti = jwtId;
+		return this;
+	}
+	setNotBefore(input) {
+		this.#jwt.nbf = input;
+		return this;
+	}
+	setExpirationTime(input) {
+		this.#jwt.exp = input;
+		return this;
+	}
+	setIssuedAt(input) {
+		this.#jwt.iat = input;
+		return this;
+	}
+	setProtectedHeader(protectedHeader) {
+		this.#protectedHeader = protectedHeader;
+		return this;
+	}
+	async sign(key, options) {
+		const sig = new CompactSign(this.#jwt.data());
+		sig.setProtectedHeader(this.#protectedHeader);
+		if (Array.isArray(this.#protectedHeader?.crit) && this.#protectedHeader.crit.includes("b64") && this.#protectedHeader.b64 === false) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+		return sig.sign(key, options);
+	}
+};
+//#endregion
+//#region src/server/types.ts
+/** OAuth errors safe to serialize at an endpoint or redirect to a registered callback. */
+var OAuthServerError = class extends Error {
+	error;
+	description;
+	status;
+	constructor(error, description, status = 400) {
+		super(description);
+		this.error = error;
+		this.description = description;
+		this.status = status;
+		this.name = "OAuthServerError";
+	}
+};
+//#endregion
+//#region src/server/memory.ts
+/** Test-only reference store. Production callers must provide durable transactional persistence. */
+var InMemoryOAuthAuthorizationStorage = class {
+	clients = /* @__PURE__ */ new Map();
+	codes = /* @__PURE__ */ new Map();
+	refreshes = /* @__PURE__ */ new Map();
+	usedCodes = /* @__PURE__ */ new Set();
+	usedRefreshes = /* @__PURE__ */ new Set();
+	revokedFamilies = /* @__PURE__ */ new Set();
+	revokedAccess = /* @__PURE__ */ new Map();
+	async getClient(clientId) {
+		return this.clients.get(clientId) ?? null;
+	}
+	async registerClient(client) {
+		this.clients.set(client.id, client);
+	}
+	async createAuthorizationCode(grant) {
+		this.codes.set(grant.id, grant);
+	}
+	async consumeAuthorizationCode(input) {
+		const grant = this.codes.get(input.id);
+		if (!grant || grant.codeHash !== input.codeHash) return { status: "invalid" };
+		if (this.usedCodes.has(grant.id)) return { status: "replayed" };
+		if (grant.expiresAt <= input.now) return { status: "expired" };
+		if (grant.clientId !== input.clientId || grant.redirectUri !== input.redirectUri || grant.resource !== input.resource) return { status: "invalid" };
+		this.usedCodes.add(grant.id);
+		return {
+			status: "consumed",
+			grant
+		};
+	}
+	async createRefreshGrant(grant) {
+		this.refreshes.set(grant.id, grant);
+	}
+	async narrowRefreshGrant(input) {
+		const grant = this.refreshes.get(input.id);
+		if (!grant || this.usedRefreshes.has(grant.id) || this.revokedFamilies.has(grant.familyId) || grant.tokenHash !== input.tokenHash || input.scopes.some((scope) => !grant.scopes.includes(scope))) throw new Error("Invalid refresh narrowing");
+		this.refreshes.set(input.id, {
+			...grant,
+			scopes: [...input.scopes],
+			claims: input.claims
+		});
+	}
+	async rotateRefreshGrant(input) {
+		const grant = this.refreshes.get(input.id);
+		if (!grant || grant.tokenHash !== input.tokenHash) return { status: "invalid" };
+		if (this.revokedFamilies.has(grant.familyId)) return { status: "revoked" };
+		if (this.usedRefreshes.has(grant.id)) {
+			this.revokedFamilies.add(grant.familyId);
+			return { status: "replayed" };
+		}
+		if (grant.expiresAt <= input.now) return { status: "expired" };
+		if (grant.clientId !== input.clientId || grant.resource !== input.resource) return { status: "invalid" };
+		this.usedRefreshes.add(grant.id);
+		this.refreshes.set(input.replacement.id, {
+			...grant,
+			...input.replacement
+		});
+		return {
+			status: "rotated",
+			grant
+		};
+	}
+	async revokeRefreshGrant(input) {
+		const grant = this.refreshes.get(input.id);
+		if (grant?.tokenHash === input.tokenHash) this.revokedFamilies.add(grant.familyId);
+	}
+	async revokeAccessToken(input) {
+		this.revokedAccess.set(input.jti, input.expiresAt);
+	}
+	async isAccessTokenRevoked(jti, now) {
+		const expiry = this.revokedAccess.get(jti);
+		return Boolean(expiry && expiry > now);
+	}
+};
+//#endregion
+//#region src/server/index.ts
+var maxRegistrationBodyBytes = 16 * 1024;
+var maxRedirectUris = 10;
+var maxMetadataStringLength = 2048;
+var maxClientNameLength = 256;
+var maxLifetime = 3600 * 24 * 90;
+var scopePattern = /^[\x21\x23-\x5b\x5d-\x7e]+$/u;
+function opaque() {
+	const id = randomUUID();
+	const secret = randomBytes(32).toString("base64url");
+	return {
+		id,
+		secret,
+		value: `${id}.${secret}`,
+		hash: hash(secret)
+	};
+}
+function hash(value) {
+	return createHash("sha256").update(value).digest("base64url");
+}
+function parseOpaque(value) {
+	const [id, secret, extra] = value.split(".");
+	if (!id || !secret || extra || !/^[0-9a-f-]{36}$/iu.test(id) || !/^[A-Za-z0-9_-]{32,}$/u.test(secret)) return null;
+	return {
+		id,
+		hash: hash(secret)
+	};
+}
+function same(a, b) {
+	const left = Buffer.from(a);
+	const right = Buffer.from(b);
+	return left.length === right.length && timingSafeEqual(left, right);
+}
+function scopeList(value) {
+	if (!value) return [];
+	const scopes = value.split(" ").filter(Boolean);
+	if (!scopes.length || scopes.some((scope) => !scopePattern.test(scope))) throw new OAuthServerError("invalid_scope", "Invalid scope.");
+	return [...new Set(scopes)];
+}
+function endpoint(issuer, path) {
+	return new URL(path, issuer.endsWith("/") ? issuer : `${issuer}/`).href;
+}
+function json(body, status = 200) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: {
+			"content-type": "application/json",
+			"cache-control": "no-store",
+			pragma: "no-cache"
+		}
+	});
+}
+function errorResponse(error) {
+	const value = error instanceof OAuthServerError ? error : new OAuthServerError("server_error", "The authorization server could not complete the request.", 500);
+	return json({
+		error: value.error,
+		error_description: value.description
+	}, value.status);
+}
+/** Framework-independent OAuth authorization server. Mount {@link handle} in any Fetch-compatible router. */
+var OAuthAuthorizationServer = class {
+	issuer;
+	issuerUrl;
+	options;
+	constructor(options) {
+		this.issuerUrl = this.assertIssuer(options.issuer);
+		if (options.issueRefreshTokens !== false && typeof options.storage.narrowRefreshGrant !== "function") throw new TypeError("OAuth storage must implement narrowRefreshGrant when refresh tokens are issued.");
+		this.issuer = this.issuerUrl.href.replace(/\/$/u, "");
+		for (const lifetime of [
+			options.authorizationCodeLifetimeSeconds ?? 300,
+			options.accessTokenLifetimeSeconds ?? 300,
+			options.refreshTokenLifetimeSeconds ?? 3600 * 24 * 30
+		]) if (!Number.isInteger(lifetime) || lifetime < 30 || lifetime > maxLifetime) throw new TypeError("OAuth lifetimes must be whole seconds between 30 and 90 days.");
+		this.options = {
+			...options,
+			authorizationCodeLifetimeSeconds: options.authorizationCodeLifetimeSeconds ?? 300,
+			accessTokenLifetimeSeconds: options.accessTokenLifetimeSeconds ?? 300,
+			refreshTokenLifetimeSeconds: options.refreshTokenLifetimeSeconds ?? 3600 * 24 * 30,
+			issueRefreshTokens: options.issueRefreshTokens !== false,
+			dynamicClientRegistration: options.dynamicClientRegistration === true
+		};
+	}
+	/** Parse and validate an authorization request without authenticating a browser session. */
+	async parseAuthorizationRequest(input) {
+		if (input.get("response_type") !== "code") throw new OAuthServerError("unsupported_response_type", "Only authorization code is supported.");
+		const clientId = required(input, "client_id");
+		const redirectUri = required(input, "redirect_uri");
+		const client = await this.options.storage.getClient(clientId);
+		if (!client) throw new OAuthServerError("invalid_request", "Unknown client.");
+		this.assertRedirect(client, redirectUri);
+		const codeChallenge = required(input, "code_challenge");
+		if (!/^[A-Za-z0-9_-]{43,128}$/u.test(codeChallenge) || input.get("code_challenge_method") !== "S256") throw new OAuthServerError("invalid_request", "S256 PKCE is required.");
+		const scopes = scopeList(input.get("scope"));
+		this.assertScopes(client, scopes);
+		const resource = input.get("resource") ?? void 0;
+		this.assertResource(client, resource);
+		return {
+			clientId,
+			redirectUri,
+			responseType: "code",
+			scopes,
+			resource,
+			state: input.get("state") ?? void 0,
+			codeChallenge,
+			codeChallengeMethod: "S256"
+		};
+	}
+	/** Records an application-approved authorization decision and returns its redirect URI. */
+	async approve(request, consent) {
+		if (!consent.subject || consent.subject.length > 512) throw new OAuthServerError("access_denied", "Authorization denied.");
+		const client = await this.options.storage.getClient(request.clientId);
+		if (!client) throw new OAuthServerError("invalid_request", "Unknown client.");
+		this.assertRedirect(client, request.redirectUri);
+		this.assertScopes(client, request.scopes);
+		this.assertResource(client, request.resource);
+		const code = opaque();
+		const now = /* @__PURE__ */ new Date();
+		const grant = {
+			id: code.id,
+			codeHash: code.hash,
+			clientId: request.clientId,
+			subject: consent.subject,
+			...consent.tenantId ? { tenantId: consent.tenantId } : {},
+			...consent.claims ? { claims: consent.claims } : {},
+			redirectUri: request.redirectUri,
+			scopes: request.scopes,
+			...request.resource ? { resource: request.resource } : {},
+			codeChallenge: request.codeChallenge,
+			expiresAt: new Date(now.getTime() + this.options.authorizationCodeLifetimeSeconds * 1e3)
+		};
+		await this.options.storage.createAuthorizationCode(this.applyConsent(grant, consent));
+		const redirect = new URL(request.redirectUri);
+		redirect.searchParams.set("code", code.value);
+		if (request.state) redirect.searchParams.set("state", request.state);
+		redirect.searchParams.set("iss", this.issuer);
+		return { redirectUri: redirect.href };
+	}
+	/** Exchanges an authorization code or a rotating refresh token for an access token. */
+	async token(input) {
+		const grantType = required(input, "grant_type");
+		if (grantType === "authorization_code") return this.exchangeCode(input);
+		if (grantType === "refresh_token") {
+			if (!this.options.issueRefreshTokens) throw new OAuthServerError("unsupported_grant_type", "Refresh tokens are not enabled.");
+			return this.refresh(input);
+		}
+		throw new OAuthServerError("unsupported_grant_type", "Unsupported grant_type.");
+	}
+	/** RFC 7009-style best-effort revocation; unknown token values deliberately succeed. */
+	async revoke(input) {
+		const token = required(input, "token");
+		const parsed = parseOpaque(token);
+		if (parsed) {
+			await this.options.storage.revokeRefreshGrant({
+				id: parsed.id,
+				tokenHash: parsed.hash,
+				now: /* @__PURE__ */ new Date()
+			});
+			return;
+		}
+		try {
+			await this.revokeAccessToken(token);
+		} catch (error) {
+			if (error instanceof OAuthServerError && error.error === "invalid_token") return;
+			if ([
+				JWTExpired,
+				JWTClaimValidationFailed,
+				JWTInvalid,
+				JWSInvalid,
+				JWSSignatureVerificationFailed,
+				JOSEAlgNotAllowed,
+				JOSENotSupported
+			].some((ErrorType) => error instanceof ErrorType)) return;
+			throw error;
+		}
+	}
+	/** Immediately makes a valid, unexpired access JWT inactive through the injected revocation store. */
+	async revokeAccessToken(token) {
+		const payload = await this.verifyJwt(token);
+		if (typeof payload.jti !== "string" || typeof payload.exp !== "number") throw new OAuthServerError("invalid_token", "Invalid access token.", 401);
+		await this.options.storage.revokeAccessToken({
+			jti: payload.jti,
+			expiresAt: /* @__PURE__ */ new Date(payload.exp * 1e3)
+		});
+	}
+	/**
+	* Verifies issuer, signature, expiry, the caller's own resource audience and
+	* live server-side access-token revocation. Resource servers must always pass
+	* the audience (resource URI) they serve so tokens minted for another
+	* resource are rejected.
+	*/
+	async verifyAccessToken(token, audience) {
+		if (!audience) throw new TypeError("verifyAccessToken requires the expected audience.");
+		return this.verifyJwt(token, audience);
+	}
+	async verifyJwt(token, audience) {
+		const { payload } = await jwtVerify(token, this.options.signingKey.publicKey, {
+			issuer: this.issuer,
+			typ: "at+jwt",
+			requiredClaims: [
+				"exp",
+				"iat",
+				"sub",
+				"client_id",
+				"scope",
+				"aud",
+				"jti"
+			],
+			...audience ? { audience } : {},
+			algorithms: [this.options.signingKey.algorithm]
+		});
+		if (typeof payload.jti !== "string" || !payload.jti || typeof payload.sub !== "string" || !payload.sub || typeof payload.client_id !== "string" || !payload.client_id || typeof payload.scope !== "string" || typeof payload.aud !== "string" || !payload.aud || typeof payload.iat !== "number" || !Number.isInteger(payload.iat) || typeof payload.exp !== "number" || !Number.isInteger(payload.exp) || payload.exp <= payload.iat || payload.tenant_id !== void 0 && (typeof payload.tenant_id !== "string" || !payload.tenant_id) || await this.options.storage.isAccessTokenRevoked(payload.jti, /* @__PURE__ */ new Date())) throw new OAuthServerError("invalid_token", "Invalid access token.", 401);
+		return payload;
+	}
+	/** Returns RFC 8414 authorization-server metadata. */
+	discovery() {
+		return {
+			issuer: this.issuer,
+			authorization_endpoint: endpoint(this.issuer, "authorize"),
+			token_endpoint: endpoint(this.issuer, "token"),
+			jwks_uri: endpoint(this.issuer, "jwks"),
+			...this.options.dynamicClientRegistration ? { registration_endpoint: endpoint(this.issuer, "register") } : {},
+			response_types_supported: ["code"],
+			grant_types_supported: ["authorization_code", ...this.options.issueRefreshTokens ? ["refresh_token"] : []],
+			token_endpoint_auth_methods_supported: ["none", "client_secret_post"],
+			code_challenge_methods_supported: ["S256"],
+			authorization_response_iss_parameter_supported: true,
+			scopes_supported: [...this.options.scopes]
+		};
+	}
+	/** Returns the public signing JWK. */
+	jwks() {
+		return { keys: [{
+			...this.options.signingKey.publicJwk,
+			kid: this.options.signingKey.keyId,
+			alg: this.options.signingKey.algorithm,
+			use: "sig"
+		}] };
+	}
+	/** Safely registers a public authorization-code client when DCR is explicitly enabled. */
+	async register(input) {
+		if (!this.options.dynamicClientRegistration) throw new OAuthServerError("invalid_request", "Dynamic client registration is disabled.", 404);
+		if (!input || typeof input !== "object" || Array.isArray(input)) throw new OAuthServerError("invalid_request", "Client metadata must be an object.");
+		const value = input;
+		if (value.client_name !== void 0 && (typeof value.client_name !== "string" || value.client_name.length > maxClientNameLength) || typeof value.scope === "string" && value.scope.length > maxMetadataStringLength) throw new OAuthServerError("invalid_request", "Client metadata exceeds supported bounds.");
+		for (const [field, allowed] of [["grant_types", ["authorization_code", ...this.options.issueRefreshTokens ? ["refresh_token"] : []]], ["response_types", ["code"]]]) {
+			const values = value[field];
+			if (values !== void 0 && (!Array.isArray(values) || !values.length || values.length > allowed.length || values.some((entry) => typeof entry !== "string" || !allowed.includes(entry)))) throw new OAuthServerError("invalid_request", "Unsupported client metadata.");
+		}
+		if (value.scope !== void 0 && (typeof value.scope !== "string" || scopeList(value.scope).some((scope) => !this.options.scopes.includes(scope)))) throw new OAuthServerError("invalid_scope", "Unsupported client scope.");
+		if (!Array.isArray(value.redirect_uris) || !value.redirect_uris.length || value.redirect_uris.length > maxRedirectUris || value.redirect_uris.some((uri) => typeof uri !== "string" || uri.length > maxMetadataStringLength)) throw new OAuthServerError("invalid_request", "redirect_uris is required.");
+		if (value.token_endpoint_auth_method !== void 0 && value.token_endpoint_auth_method !== "none") throw new OAuthServerError("invalid_request", "Only public clients are supported.");
+		const client = {
+			id: randomUUID(),
+			redirectUris: value.redirect_uris.map((uri) => this.assertPublicRedirect(uri)),
+			allowedScopes: typeof value.scope === "string" ? scopeList(value.scope) : this.options.scopes,
+			tokenEndpointAuthMethod: "none",
+			createdAt: /* @__PURE__ */ new Date()
+		};
+		await this.options.storage.registerClient(client);
+		const grantTypes = ["authorization_code", ...this.options.issueRefreshTokens ? ["refresh_token"] : []];
+		return {
+			client_id: client.id,
+			client_id_issued_at: Math.floor(client.createdAt.getTime() / 1e3),
+			redirect_uris: [...client.redirectUris],
+			token_endpoint_auth_method: "none",
+			grant_types: grantTypes,
+			response_types: ["code"],
+			scope: client.allowedScopes.join(" "),
+			...typeof value.client_name === "string" ? { client_name: value.client_name } : {}
+		};
+	}
+	/** Fetch-native routing for discovery, JWKS, registration, token and revocation endpoints. Authorization approval stays application-owned. */
+	async handle(request) {
+		try {
+			const path = new URL(request.url).pathname;
+			const prefix = this.issuerUrl.pathname.replace(/\/$/u, "");
+			const route = path.startsWith(`${prefix}/`) ? path.slice(prefix.length) : path;
+			if (request.method === "GET" && (path === `/.well-known/oauth-authorization-server${prefix}` || route === "/.well-known/oauth-authorization-server")) return json(this.discovery());
+			if (request.method === "GET" && (path === `/.well-known/openid-configuration${prefix}` || route === "/.well-known/openid-configuration")) return json(this.discovery());
+			if (request.method === "GET" && route === "/jwks") return json(this.jwks());
+			if (request.method === "POST" && route === "/token") return json(await this.token(await form(request)));
+			if (request.method === "POST" && route === "/revoke") {
+				await this.revoke(await form(request));
+				return new Response(null, {
+					status: 200,
+					headers: { "cache-control": "no-store" }
+				});
+			}
+			if (request.method === "POST" && route === "/register") return json(await this.register(await registrationBody(request)), 201);
+			return new Response(null, { status: 404 });
+		} catch (error) {
+			return errorResponse(error);
+		}
+	}
+	async exchangeCode(input) {
+		const client = await this.client(input);
+		const raw = parseOpaque(required(input, "code"));
+		if (!raw) throw new OAuthServerError("invalid_grant", "Invalid authorization code.");
+		const redirectUri = required(input, "redirect_uri");
+		const verifier = required(input, "code_verifier");
+		if (!/^[A-Za-z0-9._~-]{43,128}$/u.test(verifier)) throw new OAuthServerError("invalid_grant", "Invalid PKCE verifier.");
+		const resource = input.get("resource") ?? void 0;
+		const result = await this.options.storage.consumeAuthorizationCode({
+			id: raw.id,
+			codeHash: raw.hash,
+			clientId: client.id,
+			redirectUri,
+			...resource ? { resource } : {},
+			now: /* @__PURE__ */ new Date()
+		});
+		if (result.status !== "consumed") throw new OAuthServerError("invalid_grant", "Invalid authorization code.");
+		if (!same(hash(verifier), result.grant.codeChallenge)) throw new OAuthServerError("invalid_grant", "Invalid authorization code.");
+		const consent = await this.revalidate(result.grant);
+		return this.issue(this.applyConsent(result.grant, consent), true);
+	}
+	async refresh(input) {
+		const client = await this.client(input);
+		const raw = parseOpaque(required(input, "refresh_token"));
+		if (!raw) throw new OAuthServerError("invalid_grant", "Invalid refresh token.");
+		const resource = input.get("resource") ?? void 0;
+		const candidate = opaque();
+		const now = /* @__PURE__ */ new Date();
+		const replacement = {
+			id: candidate.id,
+			tokenHash: candidate.hash,
+			expiresAt: new Date(now.getTime() + this.options.refreshTokenLifetimeSeconds * 1e3)
+		};
+		const result = await this.options.storage.rotateRefreshGrant({
+			id: raw.id,
+			tokenHash: raw.hash,
+			clientId: client.id,
+			...resource ? { resource } : {},
+			replacement,
+			now
+		});
+		if (result.status !== "rotated") throw new OAuthServerError("invalid_grant", "Invalid refresh token.");
+		try {
+			const requestedScope = input.get("scope");
+			const requestedScopes = requestedScope === null ? result.grant.scopes : [...new Set(requestedScope.split(" ").filter(Boolean))];
+			if (requestedScopes.some((scope) => !result.grant.scopes.includes(scope))) throw new OAuthServerError("invalid_scope", "Refresh scope expansion is not allowed.");
+			const consent = await this.revalidate(result.grant);
+			const authorized = this.applyConsent(result.grant, consent);
+			const grant = {
+				...authorized,
+				scopes: authorized.scopes.filter((scope) => requestedScopes.includes(scope))
+			};
+			await this.options.storage.narrowRefreshGrant({
+				id: candidate.id,
+				tokenHash: candidate.hash,
+				scopes: grant.scopes,
+				claims: grant.claims
+			});
+			return await this.issue(grant, false, candidate.value);
+		} catch (error) {
+			await this.options.storage.revokeRefreshGrant({
+				id: raw.id,
+				tokenHash: raw.hash,
+				now
+			});
+			throw error;
+		}
+	}
+	async issue(grant, refresh = false, existingRefresh) {
+		const now = Math.floor(Date.now() / 1e3);
+		const jti = randomUUID();
+		const claims = grant.claims ?? {};
+		for (const reserved of [
+			"scope",
+			"client_id",
+			"tenant_id",
+			"aud",
+			"iss",
+			"sub",
+			"jti",
+			"exp",
+			"iat",
+			"nbf"
+		]) if (reserved in claims) throw new OAuthServerError("invalid_request", "Reserved token claim.");
+		const token = await new SignJWT({
+			scope: grant.scopes.join(" "),
+			client_id: grant.clientId,
+			...grant.tenantId ? { tenant_id: grant.tenantId } : {},
+			...claims
+		}).setProtectedHeader({
+			alg: this.options.signingKey.algorithm,
+			kid: this.options.signingKey.keyId,
+			typ: "at+jwt"
+		}).setIssuer(this.issuer).setSubject(grant.subject).setJti(jti).setIssuedAt(now).setExpirationTime(now + this.options.accessTokenLifetimeSeconds).setAudience(grant.resource ?? this.issuer).sign(this.options.signingKey.privateKey);
+		let refreshToken;
+		if (this.options.issueRefreshTokens) if (existingRefresh) refreshToken = existingRefresh;
+		else {
+			const raw = opaque();
+			await this.options.storage.createRefreshGrant({
+				id: raw.id,
+				tokenHash: raw.hash,
+				familyId: randomUUID(),
+				clientId: grant.clientId,
+				subject: grant.subject,
+				...grant.tenantId ? { tenantId: grant.tenantId } : {},
+				...grant.claims ? { claims: grant.claims } : {},
+				scopes: grant.scopes,
+				...grant.resource ? { resource: grant.resource } : {},
+				expiresAt: new Date(Date.now() + this.options.refreshTokenLifetimeSeconds * 1e3)
+			});
+			refreshToken = raw.value;
+		}
+		return {
+			access_token: token,
+			token_type: "Bearer",
+			expires_in: this.options.accessTokenLifetimeSeconds,
+			scope: grant.scopes.join(" "),
+			...refreshToken ? { refresh_token: refreshToken } : {}
+		};
+	}
+	async client(input) {
+		const id = required(input, "client_id");
+		const client = await this.options.storage.getClient(id);
+		if (!client) throw new OAuthServerError("invalid_client", "Invalid client.", 401);
+		if (client.tokenEndpointAuthMethod === "client_secret_post") {
+			const secret = required(input, "client_secret");
+			if (!client.secretHash || !same(hash(secret), client.secretHash)) throw new OAuthServerError("invalid_client", "Invalid client.", 401);
+		}
+		return client;
+	}
+	assertRedirect(client, redirectUri) {
+		if (!client.redirectUris.includes(redirectUri)) throw new OAuthServerError("invalid_request", "Invalid redirect_uri.");
+	}
+	assertScopes(client, scopes) {
+		if (scopes.some((scope) => !this.options.scopes.includes(scope) || !client.allowedScopes.includes(scope))) throw new OAuthServerError("invalid_scope", "Requested scope is not allowed.");
+	}
+	assertResource(client, resource) {
+		if (!resource) return;
+		if (!this.options.resources?.includes(resource) || client.allowedResources && !client.allowedResources.includes(resource)) throw new OAuthServerError("invalid_request", "Requested resource is not allowed.");
+	}
+	assertIssuer(issuer) {
+		let url;
+		try {
+			url = new URL(issuer);
+		} catch {
+			throw new TypeError("issuer must be an absolute URL.");
+		}
+		if (url.protocol !== "https:" || url.search || url.hash || url.username || url.password) throw new TypeError("issuer must be an HTTPS origin or path without query, fragment, or credentials.");
+		return url;
+	}
+	async revalidate(grant) {
+		const context = {
+			subject: grant.subject,
+			...grant.tenantId ? { tenantId: grant.tenantId } : {},
+			...grant.claims ? { claims: grant.claims } : {}
+		};
+		const result = this.options.identity.revalidateConsent ? await this.options.identity.revalidateConsent(context, grant) : await this.options.identity.refreshConsent?.(context, grant);
+		if (!result) throw new OAuthServerError("invalid_grant", "Authorization is no longer active.");
+		return result;
+	}
+	applyConsent(grant, consent) {
+		if (!consent.subject || consent.subject !== grant.subject || consent.tenantId !== grant.tenantId) throw new OAuthServerError("invalid_grant", "Live authorization changed identity or tenant.");
+		const scopes = [...new Set(consent.scopes ?? grant.scopes)];
+		if (scopes.some((scope) => !grant.scopes.includes(scope))) throw new OAuthServerError("invalid_scope", "Live authorization expanded scope.");
+		return {
+			...grant,
+			subject: consent.subject,
+			...consent.tenantId ? { tenantId: consent.tenantId } : {},
+			claims: consent.claims,
+			scopes
+		};
+	}
+	assertPublicRedirect(uri) {
+		let url;
+		try {
+			url = new URL(uri);
+		} catch {
+			throw new OAuthServerError("invalid_request", "Invalid redirect URI.");
+		}
+		if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.hash || url.search || url.protocol === "http:" && (!this.options.allowLoopbackRedirects || ![
+			"localhost",
+			"127.0.0.1",
+			"[::1]"
+		].includes(url.hostname))) throw new OAuthServerError("invalid_request", "Invalid redirect URI.");
+		return url.href;
+	}
+};
+/** Creates a framework-independent OAuth server; callers must provide durable storage in production. */
+function createAuthorizationServer(options) {
+	return new OAuthAuthorizationServer(options);
+}
+function required(params, name) {
+	const value = params.get(name);
+	if (!value) throw new OAuthServerError("invalid_request", `${name} is required.`);
+	return value;
+}
+async function form(request) {
+	if (!(request.headers.get("content-type") ?? "").startsWith("application/x-www-form-urlencoded")) throw new OAuthServerError("invalid_request", "Form-encoded request required.");
+	return new URLSearchParams(new TextDecoder().decode(await boundedBody(request)));
+}
+/** Bound bytes while streaming before endpoint parsing or persistence. */
+async function boundedBody(request) {
+	const tooLarge = () => new OAuthServerError("invalid_request", "Request body exceeds 16384 bytes.", 413);
+	const declaredLength = request.headers.get("content-length");
+	if (declaredLength !== null && Number(declaredLength) > maxRegistrationBodyBytes) {
+		await request.body?.cancel().catch(() => {});
+		throw tooLarge();
+	}
+	const reader = request.body?.getReader();
+	if (!reader) return /* @__PURE__ */ new Uint8Array();
+	const chunks = [];
+	let length = 0;
+	try {
+		while (true) {
+			const next = await reader.read();
+			if (next.done) break;
+			length += next.value.byteLength;
+			if (length > maxRegistrationBodyBytes) {
+				await reader.cancel().catch(() => {});
+				throw tooLarge();
+			}
+			chunks.push(next.value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
+async function registrationBody(request) {
+	const bytes = await boundedBody(request);
+	try {
+		return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+	} catch {
+		throw new OAuthServerError("invalid_request", "Client metadata must be valid JSON.");
+	}
+}
+//#endregion
+export { InMemoryOAuthAuthorizationStorage, OAuthAuthorizationServer, OAuthServerError, createAuthorizationServer };
+
+//# sourceMappingURL=index.js.map