@hotmeshio/long-tail 0.23.2 → 0.24.1

package/build/routes/file-browser.js

@@ -36,18 +36,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const path_1 = __importDefault(require("path"));
 const api = __importStar(require("../api/files"));
 const storage_1 = require("../lib/storage");
 const mime_1 = require("../lib/storage/mime");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/file-browser/browse
  * List files and directories at a given prefix.
  * Query: ?prefix=screenshots/&pageSize=100&continuationToken=...
  */
-router.get('/browse', async (req, res) => {
+router.get('/browse', auth_1.requireBuilder, async (req, res) => {
     const result = await api.browseFiles({
         prefix: req.query.prefix,
         pageSize: req.query.pageSize ? parseInt(req.query.pageSize, 10) : undefined,
@@ -59,7 +60,7 @@ router.get('/browse', async (req, res) => {
  * GET /api/file-browser/metadata/*
  * Get metadata for a single file.
  */
-router.get('/metadata/{*filePath}', async (req, res) => {
+router.get('/metadata/{*filePath}', auth_1.requireBuilder, async (req, res) => {
     const raw = req.params.filePath;
     const filePath = Array.isArray(raw) ? raw.join('/') : raw;
     if (!filePath) {
@@ -74,7 +75,7 @@ router.get('/metadata/{*filePath}', async (req, res) => {
  * Generate a time-limited signed URL for sharing.
  * Body: { path, expiresIn } — expiresIn in seconds (3600, 21600, 86400, 604800, 2592000)
  */
-router.post('/signed-url', async (req, res) => {
+router.post('/signed-url', auth_1.requireBuilder, async (req, res) => {
     const { path: filePath, expiresIn } = req.body;
     if (!filePath || !expiresIn) {
         res.status(400).json({ error: 'path and expiresIn are required' });
@@ -90,7 +91,7 @@ router.post('/signed-url', async (req, res) => {
  * DELETE /api/file-browser/delete/*
  * Permanently delete a file.
  */
-router.delete('/delete/{*filePath}', async (req, res) => {
+router.delete('/delete/{*filePath}', auth_1.requireBuilder, async (req, res) => {
     const raw = req.params.filePath;
     const filePath = Array.isArray(raw) ? raw.join('/') : raw;
     if (!filePath) {
@@ -104,7 +105,7 @@ router.delete('/delete/{*filePath}', async (req, res) => {
  * GET /api/file-browser/download/*
  * Download a file with Content-Disposition: attachment.
  */
-router.get('/download/{*filePath}', async (req, res) => {
+router.get('/download/{*filePath}', auth_1.requireBuilder, async (req, res) => {
     const raw = req.params.filePath;
     const filePath = Array.isArray(raw) ? raw.join('/') : raw;
     if (!filePath) {
@@ -129,7 +130,7 @@ router.get('/download/{*filePath}', async (req, res) => {
  * Query: ?path=images/photo.png (target path including filename)
  * Body: raw file bytes (Content-Type should match the file type)
  */
-router.post('/upload', async (req, res) => {
+router.post('/upload', auth_1.requireBuilder, async (req, res) => {
     const targetPath = req.query.path;
     if (!targetPath) {
         res.status(400).json({ error: 'path query parameter required (e.g., ?path=images/photo.png)' });

package/build/routes/files.js

@@ -3,11 +3,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const storage_1 = require("../lib/storage");
 const mime_1 = require("../lib/storage/mime");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/files/*
  * Serve files from managed file storage.

package/build/routes/index.js

@@ -3,11 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const auth_2 = __importDefault(require("./auth"));
 const auth_sso_1 = __importDefault(require("./auth-sso"));
 const oauth_1 = __importDefault(require("./oauth"));
+const oauth_server_1 = __importDefault(require("./oauth-server"));
 const delegation_1 = __importDefault(require("./delegation"));
 const tasks_1 = __importDefault(require("./tasks"));
 const escalations_1 = __importDefault(require("./escalations"));
@@ -39,11 +40,12 @@ const nats_credentials_1 = __importDefault(require("./nats-credentials"));
 const scan_codes_1 = __importDefault(require("./scan-codes"));
 const domain_1 = __importDefault(require("./domain"));
 const announcements_1 = __importDefault(require("./announcements"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // Public routes (no auth required — they handle their own auth)
 router.use('/auth', auth_2.default);
 router.use('/auth', auth_sso_1.default);
 router.use('/auth/oauth', oauth_1.default);
+router.use('/oauth', oauth_server_1.default);
 router.use('/delegation', delegation_1.default);
 router.use('/files', files_1.default);
 router.use('/settings', settings_1.default);

package/build/routes/insight.js

@@ -33,9 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/insight"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * POST /api/insight/mcp-query
  * Run a general-purpose MCP query using all available tools.
@@ -52,7 +53,7 @@ router.post('/mcp-query', async (req, res) => {
  * The LLM reasons about tool schemas and constructs the YAML declaratively.
  * Body: { prompt: string, tags?: string[], wait?: boolean, feedback?: string, prior_yaml?: string }
  */
-router.post('/build-workflow', async (req, res) => {
+router.post('/build-workflow', auth_1.requireBuilder, async (req, res) => {
     const { prompt, tags, wait, feedback, prior_yaml, answers, prior_questions } = req.body;
     const result = await api.buildWorkflow({ prompt, tags, wait, feedback, prior_yaml, answers, prior_questions }, req.auth ? { userId: req.auth.userId } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -62,7 +63,7 @@ router.post('/build-workflow', async (req, res) => {
  * Refine a previously built workflow using execution feedback.
  * Body: { prompt: string, prior_yaml: string, feedback: string, tags?: string[], wait?: boolean }
  */
-router.post('/build-workflow/refine', async (req, res) => {
+router.post('/build-workflow/refine', auth_1.requireBuilder, async (req, res) => {
     const { prompt, prior_yaml, feedback, tags, wait } = req.body;
     const result = await api.refineWorkflow({ prompt, prior_yaml, feedback, tags, wait }, req.auth ? { userId: req.auth.userId } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });

package/build/routes/knowledge.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/knowledge"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // The knowledge store is a builder surface (superadmin or engineer) — the
 // same gate as the dashboard's Knowledge page. Members reach knowledge
 // content only through escalation lookup refs: an escalation's

package/build/routes/maintenance.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/maintenance"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/config/maintenance
  * Return the current maintenance configuration.

package/build/routes/mcp-endpoint.d.ts

@@ -6,7 +6,9 @@
  * streamable-http transport protocol.
  *
  * Stateless mode — each POST creates a fresh server+transport pair.
- * Auth via Bearer token (JWT or bot API key) in the Authorization header.
+ * Auth via Bearer token (JWT, bot API key, or OAuth access token) in the
+ * Authorization header.
+ * The caller sees only the tools whose manifest gate they hold.
  *
  * Mount at /mcp:
  *   POST /mcp  → JSON-RPC messages (initialize, tools/list, tools/call)

package/build/routes/mcp-endpoint.js

@@ -7,7 +7,9 @@
  * streamable-http transport protocol.
  *
  * Stateless mode — each POST creates a fresh server+transport pair.
- * Auth via Bearer token (JWT or bot API key) in the Authorization header.
+ * Auth via Bearer token (JWT, bot API key, or OAuth access token) in the
+ * Authorization header.
+ * The caller sees only the tools whose manifest gate they hold.
  *
  * Mount at /mcp:
  *   POST /mcp  → JSON-RPC messages (initialize, tools/list, tools/call)
@@ -15,19 +17,27 @@
  *   DELETE /mcp → 405 (no sessions in stateless mode)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
-const auth_1 = require("../modules/auth");
+const mcp_auth_1 = require("../modules/mcp-auth");
+const capabilities_1 = require("../modules/capabilities");
 const logger_1 = require("../lib/logger");
 const external_server_1 = require("../services/mcp/external-server");
 const exposure_1 = require("../services/mcp/exposure");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
+/** The tool a single `tools/call` message names; undefined for anything else. */
+function requestedToolName(body) {
+    const message = body;
+    if (message?.method !== 'tools/call')
+        return undefined;
+    return typeof message.params?.name === 'string' ? message.params.name : undefined;
+}
 // POST /mcp — JSON-RPC messages
-router.post('/', auth_1.requireAuth, async (req, res) => {
+router.post('/', mcp_auth_1.requireMcpAuth, async (req, res) => {
     try {
         const exposure = (0, exposure_1.getExposureConfig)();
         const callerScopes = req.auth?.scopes;
-        const server = await (0, external_server_1.createUnifiedMcpServer)(exposure, callerScopes);
+        const server = await (0, external_server_1.createUnifiedMcpServer)((0, capabilities_1.capabilityAccess)(req.auth), exposure, callerScopes, requestedToolName(req.body));
         const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
             sessionIdGenerator: undefined, // stateless
         });
@@ -53,7 +63,7 @@ router.post('/', auth_1.requireAuth, async (req, res) => {
     }
 });
 // GET /mcp — SSE stream (not supported in stateless mode)
-router.get('/', auth_1.requireAuth, (_req, res) => {
+router.get('/', mcp_auth_1.requireMcpAuth, (_req, res) => {
     res.status(405).json({
         jsonrpc: '2.0',
         error: { code: -32000, message: 'Method not allowed. Use POST for stateless requests.' },
@@ -61,7 +71,7 @@ router.get('/', auth_1.requireAuth, (_req, res) => {
     });
 });
 // DELETE /mcp — session close (not supported in stateless mode)
-router.delete('/', auth_1.requireAuth, (_req, res) => {
+router.delete('/', mcp_auth_1.requireMcpAuth, (_req, res) => {
     res.status(405).json({
         jsonrpc: '2.0',
         error: { code: -32000, message: 'Method not allowed. Stateless mode has no sessions.' },

package/build/routes/mcp.js

@@ -33,9 +33,28 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/mcp"));
-const router = (0, express_1.Router)();
+const capabilities_1 = require("../modules/capabilities");
+const auth_1 = require("../modules/auth");
+const router = (0, http_1.Router)();
+/**
+ * A server's transport_config carries connection secrets (headers, env,
+ * commands). Only a builder, who may edit the server, reads it back.
+ */
+async function redactTransport(result, auth) {
+    if (!result.data || (await (0, capabilities_1.mayBuild)(auth ? { userId: auth.userId } : undefined)))
+        return result;
+    const strip = (server) => {
+        const { transport_config: _secret, ...rest } = server;
+        return rest;
+    };
+    const data = result.data;
+    return {
+        ...result,
+        data: Array.isArray(data.servers) ? { ...data, servers: data.servers.map(strip) } : strip(data),
+    };
+}
 // ── Server registration CRUD ──────────────────────────────────────────
 /**
  * GET /api/mcp/servers
@@ -52,13 +71,14 @@ router.get('/servers', async (req, res) => {
         limit: req.query.limit ? parseInt(req.query.limit, 10) : undefined,
         offset: req.query.offset ? parseInt(req.query.offset, 10) : undefined,
     });
-    res.status(result.status).json(result.data ?? { error: result.error });
+    const shown = await redactTransport(result, req.auth);
+    res.status(shown.status).json(shown.data ?? { error: shown.error });
 });
 /**
  * POST /api/mcp/servers
  * Register a new MCP server.
  */
-router.post('/servers', async (req, res) => {
+router.post('/servers', auth_1.requireBuilder, async (req, res) => {
     const { name, description, transport_type, transport_config, auto_connect, metadata, tags, compile_hints, credential_providers } = req.body;
     const result = await api.createMcpServer({
         name,
@@ -77,7 +97,7 @@ router.post('/servers', async (req, res) => {
  * POST /api/mcp/servers/test-connection
  * Test connectivity to an MCP server without persisting it.
  */
-router.post('/servers/test-connection', async (req, res) => {
+router.post('/servers/test-connection', auth_1.requireBuilder, async (req, res) => {
     const { transport_type, transport_config } = req.body;
     const result = await api.testConnection({ transport_type, transport_config });
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -88,23 +108,23 @@ router.post('/servers/test-connection', async (req, res) => {
  * Get a specific MCP server.
  */
 router.get('/servers/:id', async (req, res) => {
-    const result = await api.getMcpServer({ id: req.params.id });
+    const result = await redactTransport(await api.getMcpServer({ id: req.params.id }), req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * PUT /api/mcp/servers/:id
  * Update an MCP server registration.
  */
-router.put('/servers/:id', async (req, res) => {
-    const result = await api.updateMcpServer({ id: req.params.id, ...req.body });
+router.put('/servers/:id', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.updateMcpServer({ ...req.body, id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * DELETE /api/mcp/servers/:id
  * Delete an MCP server registration.
  */
-router.delete('/servers/:id', async (req, res) => {
-    const result = await api.deleteMcpServer({ id: req.params.id });
+router.delete('/servers/:id', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.deleteMcpServer({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 // ── Connection management ─────────────────────────────────────────────
@@ -112,16 +132,16 @@ router.delete('/servers/:id', async (req, res) => {
  * POST /api/mcp/servers/:id/connect
  * Connect to a registered MCP server.
  */
-router.post('/servers/:id/connect', async (req, res) => {
-    const result = await api.connectMcpServer({ id: req.params.id });
+router.post('/servers/:id/connect', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.connectMcpServer({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * POST /api/mcp/servers/:id/disconnect
  * Disconnect from a specific MCP server.
  */
-router.post('/servers/:id/disconnect', async (req, res) => {
-    const result = await api.disconnectMcpServer({ id: req.params.id });
+router.post('/servers/:id/disconnect', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.disconnectMcpServer({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 // ── Credential status ────────────────────────────────────────────────
@@ -153,7 +173,7 @@ router.post('/servers/:id/tools/:toolName/call', async (req, res) => {
         toolName: req.params.toolName,
         arguments: req.body.arguments,
         execute_as: req.body.execute_as,
-    }, req.auth ? { userId: req.auth.userId } : undefined);
+    }, req.auth ? { userId: req.auth.userId, role: req.auth.role } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/me.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/me"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── Self-service (/api/me) — the authenticated user, no admin gates ─────────
 /**
  * GET /api/me/preferences

package/build/routes/namespaces.js

@@ -33,9 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/namespaces"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/namespaces
  * List all registered MCP YAML namespaces.
@@ -49,7 +50,7 @@ router.get('/', async (_req, res) => {
  * Register a new namespace.
  * Body: { name: string, description?: string, metadata?: object }
  */
-router.post('/', async (req, res) => {
+router.post('/', auth_1.requireBuilder, async (req, res) => {
     const result = await api.registerNamespace({
         name: req.body?.name,
         description: req.body?.description,

package/build/routes/nats-credentials.js

@@ -1,10 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const events_1 = require("../lib/events");
 const nats_1 = require("../lib/events/nats");
 const nats_ws_proxy_1 = require("../lib/events/nats-ws-proxy");
-const router = (0, express_1.Router)();
+const nats_ws_ticket_1 = require("../lib/events/nats-ws-ticket");
+const logger_1 = require("../lib/logger");
+const config_1 = require("../modules/config");
+let warnedServerToken = false;
+/** The WebSocket URL with a ticket for this person; the proxy holds the NATS credential. */
+function withTicket(wsUrl, userId) {
+    const ticket = (0, nats_ws_ticket_1.signNatsWsTicket)(userId);
+    if (!ticket)
+        return null;
+    const url = new URL(wsUrl);
+    url.searchParams.set(nats_ws_ticket_1.NATS_WS_TICKET_PARAM, ticket);
+    return url.toString();
+}
+const router = (0, http_1.Router)();
 /**
  * GET /api/nats-credentials
  * Returns NATS WebSocket URL and auth token.
@@ -21,9 +34,20 @@ router.get('/', async (req, res) => {
         wsUrl = (0, nats_ws_proxy_1.deriveWsUrlFromRequest)(req, natsAdapter.wsProxyBasePath);
         natsAdapter.setWsUrl(wsUrl);
     }
+    // Behind the proxy the browser gets a ticket, never the NATS credential, and
+    // the proxy lets it subscribe only.
+    if (natsAdapter.wsProxyTarget && wsUrl) {
+        return res.json({ natsWsUrl: withTicket(wsUrl, req.auth.userId), natsToken: null });
+    }
+    // A direct connection needs a credential: a subscribe-only one when the
+    // deployment provides it.
+    if (!config_1.config.NATS_DASHBOARD_TOKEN && natsAdapter.authToken && !warnedServerToken) {
+        warnedServerToken = true;
+        logger_1.loggerRegistry.warn('[lt-nats] browsers receive the NATS server token; set NATS_DASHBOARD_TOKEN to a subscribe-only credential, or use the WebSocket proxy');
+    }
     res.json({
         natsWsUrl: wsUrl,
-        natsToken: natsAdapter.authToken,
+        natsToken: config_1.config.NATS_DASHBOARD_TOKEN || natsAdapter.authToken,
     });
 });
 exports.default = router;

package/build/routes/oauth-server/authorize.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/oauth-server/authorize.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = require("../../lib/http");
+const auth_1 = require("../../modules/auth");
+const oauth_server_1 = require("../../modules/oauth-server");
+const defaults_1 = require("../../modules/defaults");
+const oauth_server_2 = require("../../services/auth/oauth-server");
+const authorization_1 = require("../../services/auth/oauth-server/authorization");
+const user_1 = require("../../services/user");
+const router = (0, http_1.Router)();
+const CONSENT_PAGE_PATH = '/oauth/consent';
+const BOT_PRINCIPAL_TYPE = 'bot';
+/** Send a failed authorization check: here when the client is untrusted, else back to the client. */
+function sendAuthorizationError(res, check, issuer, asJson) {
+    if (!check.redirect) {
+        res.status(400).json({ error: check.error, error_description: check.description });
+        return;
+    }
+    const redirect = (0, authorization_1.withQuery)(check.redirectUri, {
+        error: check.error, error_description: check.description, state: check.state, iss: issuer,
+    });
+    if (asJson)
+        res.json({ redirect });
+    else
+        res.redirect(302, redirect);
+}
+/**
+ * GET /api/oauth/authorize
+ * The authorization request (RFC 6749 §4.1.1, PKCE S256 required). Redirects
+ * to the dashboard consent page with the validated request.
+ */
+router.get('/authorize', async (req, res) => {
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    const check = await (0, authorization_1.checkAuthorizationRequest)(req.query, settings);
+    if (!check.ok)
+        return sendAuthorizationError(res, check, settings.issuer, false);
+    const { client, redirectUri, codeChallenge, state, scope, resource } = check.request;
+    res.redirect(302, (0, authorization_1.withQuery)(`${settings.issuer}${CONSENT_PAGE_PATH}`, {
+        client_id: client.client_id, redirect_uri: redirectUri, code_challenge: codeChallenge,
+        code_challenge_method: 'S256', response_type: 'code', state, scope, resource,
+    }));
+});
+/** Consent is a person's decision: a bot key may not grant access. */
+function refuseBots(req, res) {
+    if (req.auth?.principalType !== BOT_PRINCIPAL_TYPE)
+        return false;
+    res.status(403).json({ error: 'access_denied', error_description: 'a service account cannot grant access' });
+    return true;
+}
+/**
+ * POST /api/oauth/authorize
+ * The person approves. Body: the authorization request plus
+ * { preset: 'read_only' | 'just_me' }. Returns { redirect } for the consent
+ * page to navigate to, carrying the code. Only the dashboard's own bearer
+ * credential approves: a host session cookie, which any same-site script
+ * could send, does not.
+ */
+router.post('/authorize', auth_1.requireCredentialAuth, async (req, res) => {
+    if (refuseBots(req, res))
+        return;
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    const check = await (0, authorization_1.checkAuthorizationRequest)(req.body ?? {}, settings);
+    if (!check.ok)
+        return sendAuthorizationError(res, check, settings.issuer, true);
+    const preset = req.body?.preset;
+    if (!(0, authorization_1.isGrantPreset)(preset)) {
+        res.status(400).json({ error: 'invalid_request', error_description: 'preset must be read_only or just_me' });
+        return;
+    }
+    if (!(0, authorization_1.grantablePresets)(await (0, user_1.getUserRoles)(req.auth.userId)).includes(preset)) {
+        res.status(403).json({ error: 'access_denied', error_description: `you may not grant ${preset}` });
+        return;
+    }
+    const { client, redirectUri, codeChallenge, state, resource } = check.request;
+    const { code } = await (0, oauth_server_2.issueAuthorizationCode)({
+        userId: req.auth.userId, clientId: client.client_id, policy: { preset }, scope: oauth_server_2.PRESET_SCOPE[preset],
+        redirectUri, codeChallenge, resource, ttlSeconds: defaults_1.OAUTH_CODE_TTL_SECONDS,
+    });
+    res.json({ redirect: (0, authorization_1.withQuery)(redirectUri, { code, state, iss: settings.issuer }) });
+});
+/**
+ * POST /api/oauth/deny
+ * The person declines. Body: { client_id, redirect_uri, state? }. Returns
+ * { redirect } carrying error=access_denied. Bearer credential only, as authorize.
+ */
+router.post('/deny', auth_1.requireCredentialAuth, async (req, res) => {
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    const clientId = typeof req.body?.client_id === 'string' ? req.body.client_id : '';
+    const client = clientId ? await (0, oauth_server_2.getClient)(clientId) : null;
+    const redirectUri = req.body?.redirect_uri;
+    if (!client || typeof redirectUri !== 'string' || !client.redirect_uris.includes(redirectUri)) {
+        res.status(400).json({ error: 'invalid_request', error_description: 'unknown client or redirect_uri' });
+        return;
+    }
+    const state = typeof req.body?.state === 'string' ? req.body.state : undefined;
+    res.json({ redirect: (0, authorization_1.withQuery)(redirectUri, { error: 'access_denied', state, iss: settings.issuer }) });
+});
+/**
+ * GET /api/oauth/clients/:id
+ * The client the consent page is asking about.
+ */
+router.get('/clients/:id', auth_1.requireAuth, async (req, res) => {
+    const client = await (0, oauth_server_2.getClient)(String(req.params.id));
+    if (!client) {
+        res.status(404).json({ error: 'not_found' });
+        return;
+    }
+    res.json({ client_id: client.client_id, client_name: client.client_name, redirect_uris: client.redirect_uris });
+});
+exports.default = router;

package/build/routes/oauth-server/grants.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/oauth-server/grants.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = require("../../lib/http");
+const auth_1 = require("../../modules/auth");
+const roles_1 = require("../../services/user/roles");
+const oauth_server_1 = require("../../services/auth/oauth-server");
+const authorization_1 = require("../../services/auth/oauth-server/authorization");
+const router = (0, http_1.Router)();
+/**
+ * GET /api/oauth/presets
+ * The presets the signed-in person may grant at consent.
+ */
+router.get('/presets', auth_1.requireAuth, async (req, res) => {
+    res.json({ presets: (0, authorization_1.grantablePresets)(await (0, roles_1.getUserRoles)(req.auth.userId)) });
+});
+/**
+ * GET /api/oauth/grants
+ * The signed-in person's connected apps.
+ */
+router.get('/grants', auth_1.requireAuth, async (req, res) => {
+    res.json({ grants: await (0, oauth_server_1.listGrants)(req.auth.userId) });
+});
+/**
+ * DELETE /api/oauth/grants/:id
+ * Disconnect one of the signed-in person's apps. Its tokens stop working at once.
+ */
+router.delete('/grants/:id', auth_1.requireAuth, async (req, res) => {
+    const revoked = await (0, oauth_server_1.revokeGrant)(String(req.params.id), req.auth.userId);
+    if (!revoked) {
+        res.status(404).json({ error: 'not_found' });
+        return;
+    }
+    res.json({ disconnected: true });
+});
+exports.default = router;

package/build/routes/oauth-server/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * OAuth authorization server endpoints under /api/oauth. The public ones
+ * (metadata, register, token, revoke) take no Long Tail session and allow
+ * any origin. The consent endpoints take the person's dashboard session.
+ * Every endpoint answers 404 until the server is configured.
+ */
+declare const router: import("express-serve-static-core").Router;
+export default router;