@hilbras/keystone 1.6.0 → 1.9.0

package/src/db/seed.ts

@@ -1,146 +0,0 @@
-import crypto from "node:crypto";
-import { eq, and } from "drizzle-orm";
-import { db } from "./index.js";
-import { organizations, users, orgMemberships, applications, workflows } from "./schema.js";
-import { config } from "../config.js";
-import { createApplication, hashClientSecret } from "../services/applications.js";
-import { hashPassword } from "../services/secrets.js";
-
-async function seed() {
-  const clientAppUrl = process.env.CLIENT_APP_URL || "http://localhost:5173";
-  const aiAppUrl = process.env.AI_APP_URL || "http://localhost:5174";
-  const landingAppUrl = process.env.LANDING_APP_URL || "http://localhost:5175";
-
-  // Idempotently create the Hilbras organization.
-  let [hilbrasOrg] = await db.select().from(organizations).where(eq(organizations.slug, "hilbras")).limit(1);
-  if (!hilbrasOrg) {
-    [hilbrasOrg] = await db
-      .insert(organizations)
-      .values({ name: "Hilbras", slug: "hilbras", plan: "enterprise" })
-      .returning();
-    console.log(`[seed] created organization ${hilbrasOrg.id}`);
-  } else {
-    console.log(`[seed] organization Hilbras already exists`);
-  }
-
-  const appDefinitions = [
-    {
-      name: "hilbras-os",
-      clientId: "hilbras-os",
-      secretEnv: "HILBRAS_OS_CLIENT_SECRET",
-      defaultSecret: "cs_os_default_secret_replace_in_production",
-      redirectUris: [`${clientAppUrl}/auth/callback`, `${clientAppUrl}/callback`],
-      allowedOrigins: [clientAppUrl],
-    },
-    {
-      name: "hilbras-ai",
-      clientId: "hilbras-ai",
-      secretEnv: "HILBRAS_AI_CLIENT_SECRET",
-      defaultSecret: "cs_ai_default_secret_replace_in_production",
-      redirectUris: [`${aiAppUrl}/auth/callback`, `${aiAppUrl}/callback`],
-      allowedOrigins: [aiAppUrl],
-    },
-    {
-      name: "hilbras-landing",
-      clientId: "hilbras-landing",
-      secretEnv: "HILBRAS_LANDING_CLIENT_SECRET",
-      defaultSecret: "cs_landing_default_secret_replace_in_production",
-      redirectUris: [`${landingAppUrl}/auth/callback`, `${landingAppUrl}/callback`],
-      allowedOrigins: [landingAppUrl],
-    },
-  ];
-
-  for (const def of appDefinitions) {
-    const existing = await db.select().from(applications).where(eq(applications.clientId, def.clientId)).limit(1);
-    if (existing.length > 0) {
-      console.log(`[seed] application ${def.clientId} already exists`);
-      continue;
-    }
-
-    const secret = process.env[def.secretEnv] || def.defaultSecret;
-    const app = await createApplication({
-      orgId: hilbrasOrg.id,
-      name: def.name,
-      clientId: def.clientId,
-      clientSecret: secret,
-      redirectUris: def.redirectUris,
-      allowedOrigins: def.allowedOrigins,
-    });
-    console.log(`[seed] created application ${app.clientId} (${app.id})`);
-  }
-
-  // Ensure a seed owner exists and owns the Hilbras org.
-  const ownerEmail = config.SEED_OWNER_EMAIL;
-  const ownerPassword = process.env.KEYSTONE_SEED_OWNER_PASSWORD || crypto.randomUUID();
-  if (ownerEmail) {
-    let [owner] = await db.select().from(users).where(eq(users.email, ownerEmail.toLowerCase())).limit(1);
-    if (!owner) {
-      const username = ownerEmail.split("@")[0].replace(/[^a-z0-9_-]/g, "-").slice(0, 32);
-      [owner] = await db
-        .insert(users)
-        .values({
-          email: ownerEmail.toLowerCase(),
-          username,
-          name: username,
-          provider: "password",
-          emailVerified: true,
-          passwordHash: await hashPassword(ownerPassword),
-        })
-        .returning();
-      console.log(`[seed] created owner user ${owner.id}`);
-      if (!process.env.KEYSTONE_SEED_OWNER_PASSWORD) {
-        console.log(`[seed] generated owner password: ${ownerPassword}`);
-      }
-    } else {
-      console.log(`[seed] owner user already exists`);
-    }
-
-    const existingMembership = await db
-      .select()
-      .from(orgMemberships)
-      .where(and(eq(orgMemberships.orgId, hilbrasOrg.id), eq(orgMemberships.userId, owner.id)))
-      .limit(1);
-
-    if (existingMembership.length === 0) {
-      await db.insert(orgMemberships).values({
-        orgId: hilbrasOrg.id,
-        userId: owner.id,
-        role: "owner",
-      });
-      console.log(`[seed] added owner membership`);
-    }
-  }
-
-  // Seed the default signup workflow.
-  const [existingWorkflow] = await db.select().from(workflows).where(eq(workflows.trigger, "user_registered")).limit(1);
-  if (!existingWorkflow) {
-    await db.insert(workflows).values({
-      orgId: hilbrasOrg.id,
-      name: "Default signup",
-      trigger: "user_registered",
-      definition: {
-        steps: [
-          { type: "assign_role", role: "user" },
-          { type: "create_organization", orgName: "{{username}}-personal", slug: "{{username}}-personal", outputKey: "personalOrgId" },
-          { type: "add_membership", orgRef: "personalOrgId", role: "owner" },
-          { type: "add_app_membership", role: "member" },
-          { type: "send_welcome_email" },
-        ],
-      },
-    });
-    console.log("[seed] created default signup workflow");
-  } else {
-    console.log("[seed] default signup workflow already exists");
-  }
-
-  console.log("[seed] done");
-}
-
-seed()
-  .catch((err) => {
-    console.error("[seed] failed:", err);
-    process.exit(1);
-  })
-  .finally(async () => {
-    process.exit(0);
-  });

package/src/di.ts

@@ -1,81 +0,0 @@
-import { setContainer, type Container } from "./container.js";
-import { ConfigurationService } from "./services/configuration.js";
-import { DefaultFeatureFlagService } from "./services/features.js";
-import {
-  DrizzleUserRepository,
-  DrizzleIdentityRepository,
-  DrizzleOrganizationRepository,
-  DrizzleApplicationRepository,
-  DrizzleAuditRepository,
-  DrizzlePermissionRepository,
-  DrizzleApiKeyRepository,
-  DrizzleSamlConnectionRepository,
-  DrizzleOidcConnectionRepository,
-} from "./repositories/index.js";
-import { secretsProvider } from "./services/secrets/index.js";
-import { queue } from "./services/queue/index.js";
-import {
-  AuthenticationDomainService,
-  AuthorizationDomainService,
-  IdentityDomainService,
-  OrganizationDomainService,
-} from "./services/domain/index.js";
-import {
-  AuthenticationApplicationService,
-  IdentityApplicationService,
-  OrganizationApplicationService,
-} from "./services/application/index.js";
-
-export function buildContainer(overrides: Partial<Container> = {}): Container {
-  const config = new ConfigurationService();
-  const features = new DefaultFeatureFlagService(config);
-
-  const userRepository = new DrizzleUserRepository();
-  const identityRepository = new DrizzleIdentityRepository();
-  const organizationRepository = new DrizzleOrganizationRepository();
-  const applicationRepository = new DrizzleApplicationRepository();
-  const auditRepository = new DrizzleAuditRepository();
-  const permissionRepository = new DrizzlePermissionRepository();
-  const apiKeyRepository = new DrizzleApiKeyRepository();
-  const samlConnectionRepository = new DrizzleSamlConnectionRepository();
-  const oidcConnectionRepository = new DrizzleOidcConnectionRepository();
-
-  const container: Container = {
-    config,
-    features,
-    userRepository,
-    identityRepository,
-    organizationRepository,
-    applicationRepository,
-    auditRepository,
-    permissionRepository,
-    apiKeyRepository,
-    samlConnectionRepository,
-    oidcConnectionRepository,
-    secretsProvider,
-    queue,
-    ...overrides,
-  };
-
-  return container;
-}
-
-export function initializeContainer(overrides?: Partial<Container>): Container {
-  const container = buildContainer(overrides);
-  setContainer(container);
-  return container;
-}
-
-export function buildApplicationServices(container: Container) {
-  const authorizationDomain = new AuthorizationDomainService(container.organizationRepository, container.permissionRepository);
-  const authenticationDomain = new AuthenticationDomainService(container.userRepository, container.applicationRepository);
-  const identityDomain = new IdentityDomainService(container.userRepository, container.identityRepository);
-  const organizationDomain = new OrganizationDomainService(container.organizationRepository, container.applicationRepository, container.userRepository);
-
-  return {
-    auth: new AuthenticationApplicationService(authenticationDomain),
-    identity: new IdentityApplicationService(identityDomain),
-    organization: new OrganizationApplicationService(organizationDomain, authorizationDomain, identityDomain),
-    authorization: authorizationDomain,
-  };
-}

package/src/index.ts

@@ -1,326 +0,0 @@
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import fastify, { type FastifyInstance } from "fastify";
-import cors from "@fastify/cors";
-import cookie from "@fastify/cookie";
-import swagger from "@fastify/swagger";
-import swaggerUi from "@fastify/swagger-ui";
-import { migrate } from "drizzle-orm/postgres-js/migrator";
-import { config } from "./config.js";
-import { db } from "./db/index.js";
-import { initializeContainer } from "./di.js";
-import { redis } from "./services/redis.js";
-import { loadSigningKeys, getPublicJwks } from "./services/tokens.js";
-
-import { loadWorkflows } from "./services/workflows/engine.js";
-import { startTracing, stopTracing } from "./plugins/tracing.js";
-import authPlugin from "./plugins/auth.js";
-import auditPlugin from "./plugins/audit.js";
-import requestLogger from "./plugins/requestLogger.js";
-import { subscribe, subscribeAll } from "./services/events/bus.js";
-import { auditLogSubscriber } from "./services/events/subscribers/auditLog.js";
-import { webhookSubscriber } from "./services/events/subscribers/webhook.js";
-import { webhookDispatchSubscriber } from "./services/events/subscribers/webhookDispatch.js";
-import { startWebhookWorker } from "./services/webhooks.js";
-import { anomalySubscriber } from "./services/events/subscribers/anomaly.js";
-import { queue } from "./services/queue/index.js";
-import { cache } from "./services/cache.js";
-import { emailProvider } from "./services/email.js";
-import { registerPlugin } from "./services/plugins/registry.js";
-import type { KeystonePlugin } from "./services/plugins/types.js";
-import appContextPlugin from "./plugins/appContext.js";
-import permissionsPlugin from "./plugins/permissions.js";
-import mtlsPlugin from "./plugins/mtls.js";
-import metricsPlugin from "./plugins/metrics.js";
-import { globalRateLimit } from "./plugins/rateLimit.js";
-import authRoutes from "./routes/auth.js";
-import oauthRoutes from "./routes/oauth.js";
-import oauth2Routes from "./routes/oauth2.js";
-import passwordRoutes from "./routes/password.js";
-import apiKeyRoutes from "./routes/apiKeys.js";
-import adminRoutes from "./routes/admin.js";
-import serviceAccountRoutes from "./routes/serviceAccounts.js";
-import magicLinkRoutes from "./routes/magicLinks.js";
-import totpRoutes from "./routes/totp.js";
-import webauthnRoutes from "./routes/webauthn.js";
-import smsOtpRoutes from "./routes/smsOtp.js";
-import authzRoutes from "./routes/authz.js";
-import samlRoutes from "./routes/saml.js";
-import oidcEnterpriseRoutes from "./routes/oidcEnterprise.js";
-import scimRoutes from "./routes/scim.js";
-import federationRoutes from "./routes/federation.js";
-import workflowRoutes from "./routes/workflows.js";
-import setupRoutes from "./routes/setup.js";
-import sdkRoutes from "./routes/sdk.js";
-import configRoutes from "./routes/config.js";
-import sessionRoutes from "./routes/sessions.js";
-import profileRoutes from "./routes/profile.js";
-import emailVerificationRoutes from "./routes/emailVerification.js";
-import { generateSetupToken, printSetupToken } from "./services/setup/token.js";
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-async function loadPluginsFromEnv(app: FastifyInstance) {
-  const pluginPaths = (config.KEYSTONE_PLUGINS || "")
-    .split(",")
-    .map((s) => s.trim())
-    .filter(Boolean);
-  for (const pluginPath of pluginPaths) {
-    try {
-      const module = await import(pluginPath);
-      const plugin = module.default || module.plugin || module;
-      if (plugin && typeof plugin === "object" && "metadata" in plugin) {
-        registerPlugin(plugin as KeystonePlugin);
-        app.log.info(`Loaded plugin from ${pluginPath}: ${plugin.metadata.name}`);
-      } else {
-        app.log.warn(`Plugin ${pluginPath} did not export a valid KeystonePlugin`);
-      }
-    } catch (err) {
-      app.log.warn({ err }, `Failed to load plugin ${pluginPath}`);
-    }
-  }
-}
-
-export async function buildApp() {
-  const container = initializeContainer();
-
-  const app = fastify({
-    logger: { level: config.NODE_ENV === "production" ? "info" : "debug" },
-    trustProxy: true,
-    genReqId: () => crypto.randomUUID(),
-  });
-
-  app.decorate("container", container);
-
-  await app.register(requestLogger);
-
-  await app.register(swagger, {
-    openapi: {
-      info: {
-        title: "Hilbras Keystone API",
-        description: "Identity platform API for Hilbras products and third-party apps.",
-        version: "1.0.0",
-      },
-      servers: [{ url: config.AUTH_API_PUBLIC_URL || `http://localhost:${config.PORT}` }],
-      tags: [
-        { name: "Auth", description: "Authentication and session management" },
-        { name: "Admin", description: "Organization and application management" },
-        { name: "Discovery", description: "JWKS and health endpoints" },
-      ],
-    },
-  });
-  await app.register(swaggerUi, {
-    routePrefix: "/documentation",
-  });
-
-  await app.register(cors, {
-    origin: (origin, cb) => {
-      if (!origin) return cb(null, true);
-      if (config.ALLOWED_ORIGINS.length === 0) return cb(null, true);
-      if (config.ALLOWED_ORIGINS.includes(origin)) return cb(null, true);
-      // In development, allow any localhost origin so external test projects
-      // can connect without pre-registering them in ALLOWED_ORIGINS.
-      if (config.NODE_ENV !== "production" && origin?.startsWith("http://localhost:")) {
-        return cb(null, true);
-      }
-      cb(new Error("Origin not allowed"), false);
-    },
-    credentials: true,
-  });
-
-  await app.register(cookie, {
-    secret: config.INTERNAL_API_KEY || undefined,
-    parseOptions: {},
-  });
-
-  await app.register(auditPlugin);
-
-  // Wire up event-bus subscribers.
-  subscribeAll(auditLogSubscriber);
-  subscribeAll(webhookSubscriber);
-  subscribeAll(webhookDispatchSubscriber);
-  subscribe("user_login_failed", anomalySubscriber);
-  subscribe("new_device_detected", anomalySubscriber);
-
-  // Register background job processors.
-  queue.process("email", async (job) => {
-    const { message } = job.payload as { message: import("./services/email.js").EmailMessage };
-    await emailProvider.send(message);
-  });
-  startWebhookWorker();
-  queue.process("webhook", async (job) => {
-    const { url, method, body, headers } = job.payload as {
-      url: string;
-      method?: string;
-      body?: unknown;
-      headers?: Record<string, string>;
-    };
-    await fetch(url, {
-      method: method || "POST",
-      headers: { "Content-Type": "application/json", ...(headers || {}) },
-      body: body ? JSON.stringify(body) : undefined,
-    });
-  });
-  queue.process("workflow_run", async (job) => {
-    const { runId, workflowId } = job.payload as { runId: string; workflowId: string };
-    const { executeRunById } = await import("./services/workflows/engine.js");
-    await executeRunById(runId, workflowId);
-  });
-
-  // Expose plugin registration on the Fastify instance.
-  app.decorate("registerPlugin", (plugin: KeystonePlugin) => {
-    registerPlugin(plugin);
-    app.log.info(`Registered plugin: ${plugin.metadata.name}`);
-  });
-
-  // Load plugins configured via env (comma-separated list of module paths).
-  await loadPluginsFromEnv(app);
-
-  app.addHook("onClose", async () => {
-    await queue.close?.();
-    // The cache owns its own Redis connection (opened eagerly when REDIS_URL
-    // is set); without this it keeps a socket open after shutdown.
-    await cache.close().catch(() => {});
-  });
-
-  // Global API rate limiting to protect the platform from abuse.
-  app.addHook("onRequest", globalRateLimit({
-    maxRequests: Number(config.GLOBAL_RATE_LIMIT_MAX) || 100,
-    windowSeconds: Number(config.GLOBAL_RATE_LIMIT_WINDOW) || 60,
-  }));
-
-  await app.register(appContextPlugin);
-  await app.register(authPlugin);
-  await app.register(permissionsPlugin);
-  await app.register(mtlsPlugin);
-  await app.register(metricsPlugin);
-
-  await app.register(authRoutes, { prefix: "/auth" });
-  await app.register(sessionRoutes, { prefix: "/auth" });
-  await app.register(profileRoutes, { prefix: "/auth" });
-  await app.register(emailVerificationRoutes, { prefix: "/auth" });
-  await app.register(oauthRoutes, { prefix: "/auth" });
-  await app.register(oauth2Routes, { prefix: "/oauth2" });
-  await app.register(passwordRoutes, { prefix: "/auth" });
-  await app.register(apiKeyRoutes, { prefix: "/auth" });
-  await app.register(adminRoutes, { prefix: "/v1/admin" });
-  await app.register(serviceAccountRoutes, { prefix: "/v1/admin" });
-  await app.register(magicLinkRoutes, { prefix: "/auth" });
-  await app.register(totpRoutes, { prefix: "/auth" });
-  await app.register(webauthnRoutes, { prefix: "/auth" });
-  await app.register(smsOtpRoutes, { prefix: "/auth" });
-  await app.register(authzRoutes, { prefix: "/v1" });
-  await app.register(samlRoutes, { prefix: "/sso" });
-  await app.register(oidcEnterpriseRoutes, { prefix: "/sso" });
-  await app.register(scimRoutes, { prefix: "/" });
-  await app.register(federationRoutes, { prefix: "/federation" });
-  await app.register(workflowRoutes, { prefix: "/v1/admin" });
-  await app.register(sdkRoutes, { prefix: "/sdk" });
-  await app.register(configRoutes, { prefix: "/v1/admin/config" });
-
-  const issuer = config.AUTH_API_PUBLIC_URL || `http://localhost:${config.PORT}`;
-  app.get("/.well-known/openid-configuration", { schema: { tags: ["Discovery"] } }, async () => ({
-    issuer,
-    authorization_endpoint: `${issuer}/oauth2/authorize`,
-    token_endpoint: `${issuer}/oauth2/token`,
-    userinfo_endpoint: `${issuer}/oauth2/userinfo`,
-    revocation_endpoint: `${issuer}/oauth2/revoke`,
-    jwks_uri: `${issuer}/.well-known/jwks.json`,
-    response_types_supported: ["code"],
-    grant_types_supported: ["authorization_code", "refresh_token", "client_credentials"],
-    subject_types_supported: ["public"],
-    id_token_signing_alg_values_supported: ["RS256"],
-    scopes_supported: ["openid", "profile", "email"],
-    token_endpoint_auth_methods_supported: ["client_secret_post", "client_secret_basic"],
-    code_challenge_methods_supported: ["S256"],
-  }));
-
-  app.get("/.well-known/jwks.json", { schema: { tags: ["Discovery"] } }, async () => {
-    return getPublicJwks();
-  });
-
-  app.get("/health", { schema: { tags: ["Discovery"] } }, async () => ({ status: "ok" }));
-
-  await app.register(setupRoutes, { prefix: "/setup" });
-
-  app.setErrorHandler((error: unknown, request, reply) => {
-    if (error && typeof error === "object" && "validation" in error) {
-      const message = error instanceof Error ? error.message : String(error);
-      return reply.status(400).send({ error: "Invalid input", details: message });
-    }
-
-    if (error instanceof Error && "statusCode" in error) {
-      const statusCode = (error as Error & { statusCode: number }).statusCode;
-      const code = (error as Error & { code?: string }).code;
-      if (statusCode >= 400 && statusCode < 600) {
-        return reply.status(statusCode).send({ error: error.message, code });
-      }
-    }
-
-    request.log.error({ err: error }, "Unhandled error");
-    const message = config.NODE_ENV === "production" ? "Internal server error" : String(error);
-    return reply.status(500).send({ error: message });
-  });
-
-  return app;
-}
-
-async function start() {
-  startTracing();
-  await redis.connect().catch((err: unknown) => {
-    console.warn("Redis not available; rate limiting will fail open", err);
-  });
-
-  const app = await buildApp();
-
-  try {
-    await migrate(db, { migrationsFolder: path.resolve(__dirname, "./db/migrations") });
-    app.log.info("Database migrations applied");
-  } catch (err) {
-    app.log.error({ err }, "Database migration failed — the application may not work correctly");
-  }
-
-  try {
-    await loadSigningKeys();
-    app.log.info("JWT signing keys loaded");
-  } catch (err) {
-    app.log.error({ err }, "JWT signing key loading failed — token signing will not work");
-  }
-
-  try {
-    generateSetupToken();
-    printSetupToken();
-  } catch (err) {
-    app.log.warn({ err }, "Could not generate setup token (may already exist)");
-  }
-
-  try {
-    await app.container.permissionRepository.ensureRolePermissionsSeeded();
-    app.log.info("Role permissions seeded");
-  } catch (err) {
-    app.log.error({ err }, "Role permission seeding failed — authorization may not work correctly");
-  }
-
-  try {
-    await loadWorkflows();
-    app.log.info("Workflows loaded");
-  } catch (err) {
-    app.log.warn({ err }, "Workflow loading failed (workflows feature may be unavailable)");
-  }
-
-  app.addHook("onClose", async () => {
-    await stopTracing();
-  });
-
-  try {
-    await app.listen({ port: config.PORT, host: config.HOST });
-    app.log.info(`Hilbras Keystone running on http://${config.HOST}:${config.PORT}`);
-  } catch (err) {
-    app.log.error(err);
-    process.exit(1);
-  }
-}
-
-if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
-  start();
-}

package/src/lib/errors.ts

@@ -1,139 +0,0 @@
-import { config } from "../config.js";
-
-/**
- * Public OAuth/OIDC/Federation error codes. These are the only values we
- * expose to browsers or third-party clients; internal failure details stay
- * in server logs.
- */
-export type OAuthErrorCode =
-  | "invalid_request"
-  | "invalid_client"
-  | "invalid_grant"
-  | "access_denied"
-  | "server_error"
-  | "identity_broker_failure";
-
-export interface OAuthErrorResponse {
-  statusCode: number;
-  body: {
-    error: OAuthErrorCode;
-    error_description?: string;
-  };
-}
-
-function isDevelopment(): boolean {
-  return config.NODE_ENV === "development";
-}
-
-function errorMessage(error: unknown): string | undefined {
-  return error instanceof Error ? error.message : undefined;
-}
-
-/**
- * Map an internal error to a stable public OAuth-style code and HTTP status.
- *
- * The mapping is intentionally conservative: anything that could reveal
- * implementation details or provider-specific behaviour collapses into a
- * small set of opaque codes. Detailed diagnostics are written to server logs
- * by the caller before this helper is invoked.
- */
-export function classifyOAuthError(error: unknown): { code: OAuthErrorCode; statusCode: number } {
-  const message = errorMessage(error)?.toLowerCase() ?? "";
-
-  if (message.includes("state") || message.includes("denied") || message.includes("cancel")) {
-    return { code: "access_denied", statusCode: 400 };
-  }
-
-  if (
-    message.includes("client") &&
-    (message.includes("unknown") || message.includes("invalid") || message.includes("not found"))
-  ) {
-    return { code: "invalid_client", statusCode: 400 };
-  }
-
-  if (
-    message.includes("token exchange failed") ||
-    message.includes("pkce") ||
-    message.includes("authorization code") ||
-    message.includes("invalid grant") ||
-    message.includes("code verifier")
-  ) {
-    return { code: "invalid_grant", statusCode: 400 };
-  }
-
-  if (message.includes("not configured") || message.includes("missing required")) {
-    return { code: "server_error", statusCode: 500 };
-  }
-
-  if (
-    message.includes("connector") ||
-    message.includes("federation") ||
-    message.includes("oidc") ||
-    message.includes("provider") ||
-    message.includes("userinfo") ||
-    message.includes("broker") ||
-    message.includes("idp")
-  ) {
-    return { code: "identity_broker_failure", statusCode: 502 };
-  }
-
-  return { code: "server_error", statusCode: 500 };
-}
-
-export interface OAuthRedirectOptions {
-  /** OAuth `state` value that must be echoed back to the client. */
-  state?: string;
-  /** Override whether to include the original error message. Defaults to `true` only in development. */
-  includeDescription?: boolean;
-}
-
-/**
- * Build a redirect URL that carries only a sanitized error code (and, in
- * development, an optional description). Any existing query parameters on
- * `redirectUrl` are preserved.
- */
-export function buildOAuthErrorRedirect(
-  error: unknown,
-  redirectUrl: string,
-  options?: OAuthRedirectOptions
-): string {
-  const { code } = classifyOAuthError(error);
-  const url = new URL(redirectUrl);
-  url.searchParams.set("error", code);
-
-  const includeDescription = options?.includeDescription ?? isDevelopment();
-  const description = errorMessage(error);
-  if (includeDescription && description) {
-    url.searchParams.set("error_description", description);
-  }
-
-  if (options?.state) {
-    url.searchParams.set("state", options.state);
-  }
-
-  return url.toString();
-}
-
-export interface OAuthResponseOptions {
-  /** Override whether to include the original error message. Defaults to `true` only in development. */
-  includeDescription?: boolean;
-}
-
-/**
- * Build a sanitized JSON error response for endpoints that do not redirect.
- */
-export function buildOAuthErrorResponse(
-  error: unknown,
-  options?: OAuthResponseOptions
-): OAuthErrorResponse {
-  const { code, statusCode } = classifyOAuthError(error);
-  const body: OAuthErrorResponse["body"] = { error: code };
-
-  const includeDescription = options?.includeDescription ?? isDevelopment();
-  const description = errorMessage(error);
-  if (includeDescription && description) {
-    body.error_description = description;
-  }
-
-  return { statusCode, body };
-}