@hotmeshio/long-tail 0.23.2 → 0.24.1

package/build/routes/workflows/config.js

@@ -33,10 +33,11 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
+const workflow_invocation_1 = require("../../services/workflow-invocation");
 const api = __importStar(require("../../api/workflows"));
 const auth_1 = require("../../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── Workflow configuration ────────────────────────────────────────────────────
 /**
  * GET /api/workflows/config
@@ -69,6 +70,18 @@ router.get('/:type/input-lookups', async (req, res) => {
  * Requires admin or superadmin role.
  */
 router.put('/:type/config', auth_1.requireAdmin, async (req, res) => {
+    // Every invocation of this workflow runs as execute_as, so it may not exceed the caller.
+    if (req.body.execute_as) {
+        try {
+            await (0, workflow_invocation_1.assertMayActAs)(req.auth.userId, req.body.execute_as);
+        }
+        catch (err) {
+            if (!(err instanceof workflow_invocation_1.InvocationError))
+                throw err;
+            res.status(err.statusCode).json({ error: err.message });
+            return;
+        }
+    }
     const result = await api.upsertWorkflowConfig({
         type: req.params.type,
         invocable: req.body.invocable,

package/build/routes/workflows/discovery.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const api = __importStar(require("../../api/workflows"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── Active workers ───────────────────────────────────────────────────────────
 /**
  * GET /api/workflows/workers

package/build/routes/workflows/index.js

@@ -3,11 +3,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const discovery_1 = __importDefault(require("./discovery"));
 const config_1 = __importDefault(require("./config"));
 const invocation_1 = __importDefault(require("./invocation"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // Mount in original route registration order:
 // 1. Discovery: /workers, /discovered, /cron/status
 router.use(discovery_1.default);

package/build/routes/workflows/invocation.js

@@ -33,9 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
+const auth_1 = require("../../modules/auth");
 const api = __importStar(require("../../api/workflows"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── Workflow invocation ─────────────────────────────────────────────────────
 /**
  * POST /api/workflows/:type/invoke
@@ -69,9 +70,9 @@ router.post('/:type/invoke', async (req, res) => {
  * Get the status of a workflow. Optional `app_id` query param selects the
  * HotMesh namespace for resolution (default: durable).
  */
-router.get('/:workflowId/status', async (req, res) => {
+router.get('/:workflowId/status', auth_1.requireBuilder, async (req, res) => {
     const result = await api.getWorkflowStatus({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
         appId: typeof req.query.app_id === 'string' ? req.query.app_id : undefined,
     });
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -82,9 +83,9 @@ router.get('/:workflowId/status', async (req, res) => {
  * Never blocks — always returns immediately. Optional `app_id` query param
  * selects the HotMesh namespace for resolution (default: durable).
  */
-router.get('/:workflowId/result', async (req, res) => {
+router.get('/:workflowId/result', auth_1.requireWorkflowReader, async (req, res) => {
     const result = await api.getWorkflowResult({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
         appId: typeof req.query.app_id === 'string' ? req.query.app_id : undefined,
     });
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -93,16 +94,16 @@ router.get('/:workflowId/result', async (req, res) => {
  * POST /api/workflows/:workflowId/terminate
  * Interrupt/terminate a running workflow.
  */
-router.post('/:workflowId/terminate', async (req, res) => {
-    const result = await api.terminateWorkflow({ workflowId: req.params.workflowId });
+router.post('/:workflowId/terminate', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.terminateWorkflow({ workflowId: String(req.params.workflowId) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * GET /api/workflows/:workflowId/export
  * Export workflow state. Convenience alias for /api/workflow-states/:workflowId.
  */
-router.get('/:workflowId/export', async (req, res) => {
-    const result = await api.exportWorkflow({ workflowId: req.params.workflowId });
+router.get('/:workflowId/export', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.exportWorkflow({ workflowId: String(req.params.workflowId) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/yaml-workflows/cron.js

@@ -33,28 +33,41 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const api = __importStar(require("../../api/yaml-workflows"));
-const router = (0, express_1.Router)();
+const auth_1 = require("../../modules/auth");
+const workflow_invocation_1 = require("../../services/workflow-invocation");
+const router = (0, http_1.Router)();
 /**
  * PUT /api/yaml-workflows/:id/cron
  * Set or update cron schedule + envelope + execute_as.
  */
-router.put('/:id/cron', async (req, res) => {
+router.put('/:id/cron', auth_1.requireBuilder, async (req, res) => {
+    if (req.body.execute_as) {
+        try {
+            await (0, workflow_invocation_1.assertMayActAs)(req.auth.userId, req.body.execute_as);
+        }
+        catch (err) {
+            if (!(err instanceof workflow_invocation_1.InvocationError))
+                throw err;
+            res.status(err.statusCode).json({ error: err.message });
+            return;
+        }
+    }
     const result = await api.setCronSchedule({
-        id: req.params.id,
+        id: String(req.params.id),
         cron_schedule: req.body.cron_schedule,
         cron_envelope: req.body.cron_envelope,
         execute_as: req.body.execute_as,
-    });
+    }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * DELETE /api/yaml-workflows/:id/cron
  * Clear cron schedule.
  */
-router.delete('/:id/cron', async (req, res) => {
-    const result = await api.clearCronSchedule({ id: req.params.id });
+router.delete('/:id/cron', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.clearCronSchedule({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**

package/build/routes/yaml-workflows/crud.js

@@ -33,9 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const api = __importStar(require("../../api/yaml-workflows"));
-const router = (0, express_1.Router)();
+const auth_1 = require("../../modules/auth");
+const router = (0, http_1.Router)();
 /**
  * GET /api/yaml-workflows
  * List YAML workflows with optional status filter.
@@ -58,7 +59,7 @@ router.get('/', async (req, res) => {
  * Generate a YAML workflow from a completed execution.
  * Body: { workflow_id, task_queue, workflow_name, name, description? }
  */
-router.post('/', async (req, res) => {
+router.post('/', auth_1.requireBuilder, async (req, res) => {
     const result = await api.createYamlWorkflow(req.body);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -76,7 +77,7 @@ router.get('/app-ids', async (_req, res) => {
  * Unlike POST /, this does not require a source execution — the YAML is provided directly.
  * Body: { name, description?, yaml_content, input_schema?, activity_manifest?, tags?, app_id? }
  */
-router.post('/direct', async (req, res) => {
+router.post('/direct', auth_1.requireBuilder, async (req, res) => {
     const result = await api.createYamlWorkflowDirect(req.body);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -85,7 +86,7 @@ router.post('/direct', async (req, res) => {
  * Compile a durable TypeScript workflow into a YAML DAG.
  * Body: { source, is_file_path?, workflow_name, name, description?, app_id?, subscribes?, tags? }
  */
-router.post('/from-durable', async (req, res) => {
+router.post('/from-durable', auth_1.requireBuilder, async (req, res) => {
     const result = await api.createYamlWorkflowFromDurable(req.body);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -95,15 +96,15 @@ router.post('/from-durable', async (req, res) => {
  * Get a single YAML workflow.
  */
 router.get('/:id', async (req, res) => {
-    const result = await api.getYamlWorkflow({ id: req.params.id });
+    const result = await api.getYamlWorkflow({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * PUT /api/yaml-workflows/:id
  * Update a YAML workflow's metadata.
  */
-router.put('/:id', async (req, res) => {
-    const result = await api.updateYamlWorkflow({ id: req.params.id, ...req.body });
+router.put('/:id', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.updateYamlWorkflow({ ...req.body, id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
@@ -111,9 +112,9 @@ router.put('/:id', async (req, res) => {
  * Re-generate the YAML from the original source execution.
  * Only allowed for non-archived workflows.
  */
-router.post('/:id/regenerate', async (req, res) => {
+router.post('/:id/regenerate', auth_1.requireBuilder, async (req, res) => {
     const result = await api.regenerateYamlWorkflow({
-        id: req.params.id,
+        id: String(req.params.id),
         task_queue: req.body.task_queue,
         compilation_feedback: req.body.compilation_feedback,
     });
@@ -123,8 +124,8 @@ router.post('/:id/regenerate', async (req, res) => {
  * DELETE /api/yaml-workflows/:id
  * Delete a YAML workflow (must be draft or archived).
  */
-router.delete('/:id', async (req, res) => {
-    const result = await api.deleteYamlWorkflow({ id: req.params.id });
+router.delete('/:id', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.deleteYamlWorkflow({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/yaml-workflows/deployment.js

@@ -33,24 +33,25 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const api = __importStar(require("../../api/yaml-workflows"));
-const router = (0, express_1.Router)();
+const auth_1 = require("../../modules/auth");
+const router = (0, http_1.Router)();
 /**
  * POST /api/yaml-workflows/:id/deploy
  * Deploy all YAML workflows sharing this workflow's app_id as a merged version.
  * Bumps the version and deploys all graphs together.
  */
-router.post('/:id/deploy', async (req, res) => {
-    const result = await api.deployYamlWorkflow({ id: req.params.id });
+router.post('/:id/deploy', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.deployYamlWorkflow({ id: String(req.params.id) }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * POST /api/yaml-workflows/:id/activate
  * Activate the deployed version for this workflow's app_id and register all workers.
  */
-router.post('/:id/activate', async (req, res) => {
-    const result = await api.activateYamlWorkflow({ id: req.params.id });
+router.post('/:id/activate', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.activateYamlWorkflow({ id: String(req.params.id) }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
@@ -72,16 +73,16 @@ router.post('/:id/invoke', async (req, res) => {
  * POST /api/yaml-workflows/:id/archive
  * Archive a YAML workflow (stops accepting new invocations).
  */
-router.post('/:id/archive', async (req, res) => {
-    const result = await api.archiveYamlWorkflow({ id: req.params.id });
+router.post('/:id/archive', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.archiveYamlWorkflow({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * POST /api/yaml-workflows/:id/restore
  * Restore an archived YAML workflow back to draft status for redeployment.
  */
-router.post('/:id/restore', async (req, res) => {
-    const result = await api.restoreYamlWorkflow({ id: req.params.id });
+router.post('/:id/restore', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.restoreYamlWorkflow({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/yaml-workflows/index.js

@@ -3,12 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const cron_1 = __importDefault(require("./cron"));
 const crud_1 = __importDefault(require("./crud"));
 const deployment_1 = __importDefault(require("./deployment"));
 const versions_1 = __importDefault(require("./versions"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // cron.ts handles: GET /cron/status, PUT /:id/cron, DELETE /:id/cron
 // Mount before crud so /cron/status doesn't match /:id
 router.use(cron_1.default);

package/build/routes/yaml-workflows/versions.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const api = __importStar(require("../../api/yaml-workflows"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/yaml-workflows/:id/versions
  * Return version history for a YAML workflow.

package/build/services/agent/authority.d.ts

@@ -0,0 +1,15 @@
+import type { AgentBehaviors } from '../../types/agent';
+/** Refuse an agent create or update whose schedules the caller could not run themselves. */
+export declare function assertMayConfigureAgent(callerId: string, input: {
+    id?: string;
+    user_id?: string | null;
+    behaviors?: AgentBehaviors;
+}): Promise<void>;
+/** Refuse a subscription create or update the caller could not run themselves. */
+export declare function assertMayConfigureSubscription(callerId: string, input: {
+    agentId: string;
+    subscriptionId?: string;
+    reaction_type?: string;
+    workflow_type?: string | null;
+    execute_as?: string | null;
+}): Promise<void>;

package/build/services/agent/authority.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertMayConfigureAgent = assertMayConfigureAgent;
+exports.assertMayConfigureSubscription = assertMayConfigureSubscription;
+/**
+ * Who may configure automation. Agents run on their own, as the identity they
+ * name (an execute_as, else the agent's user_id) or, with none, as lt-system.
+ * Whoever configures one must be able to run as that identity: the same rule
+ * as an execute_as override. Automation that would run as lt-system, or a
+ * capability subscription (a tool called with lt-system authority), is a
+ * superadmin's to configure. A durable subscription starts its workflow
+ * under that workflow's invocation rules, for the configurer here and for
+ * the run identity each time it fires.
+ */
+const workflow_invocation_1 = require("../workflow-invocation");
+const user_1 = require("../user");
+const index_1 = require("./index");
+const subscriptions_1 = require("./subscriptions");
+const SYSTEM_AUTHORITY = 'runs as lt-system; only superadmin can configure it';
+const DURABLE_REACTION = 'durable';
+async function assertIdentity(callerId, identity, what) {
+    if (!identity)
+        throw new workflow_invocation_1.InvocationError(`${what} has no identity, so it ${SYSTEM_AUTHORITY}`, 403);
+    await (0, workflow_invocation_1.assertMayActAs)(callerId, identity);
+}
+/** Refuse an agent create or update whose schedules the caller could not run themselves. */
+async function assertMayConfigureAgent(callerId, input) {
+    if (await (0, user_1.isSuperAdmin)(callerId))
+        return;
+    const existing = input.id ? await (0, index_1.getAgent)(input.id) : null;
+    const userId = input.user_id !== undefined ? input.user_id : existing?.user_id ?? null;
+    const behaviors = input.behaviors ?? existing?.behaviors;
+    if (userId)
+        await (0, workflow_invocation_1.assertMayActAs)(callerId, userId);
+    if (behaviors?.cron)
+        await assertIdentity(callerId, userId, 'the agent schedule');
+    for (const schedule of behaviors?.schedules ?? []) {
+        await assertIdentity(callerId, schedule.execute_as || userId, 'an agent schedule');
+    }
+}
+/** Refuse a subscription create or update the caller could not run themselves. */
+async function assertMayConfigureSubscription(callerId, input) {
+    if (await (0, user_1.isSuperAdmin)(callerId))
+        return;
+    const existing = input.subscriptionId ? await (0, subscriptions_1.getSubscription)(input.subscriptionId) : null;
+    if (input.subscriptionId && (!existing || existing.agent_id !== input.agentId)) {
+        throw new workflow_invocation_1.InvocationError('Subscription not found', 404);
+    }
+    const reaction = input.reaction_type ?? existing?.reaction_type;
+    if (reaction === 'capability') {
+        throw new workflow_invocation_1.InvocationError(`a capability subscription calls a tool directly, so it ${SYSTEM_AUTHORITY}`, 403);
+    }
+    const workflowType = input.workflow_type !== undefined ? input.workflow_type : existing?.workflow_type;
+    if (reaction === DURABLE_REACTION && workflowType)
+        await (0, workflow_invocation_1.checkInvocationRoles)(workflowType, callerId);
+    const agent = await (0, index_1.getAgent)(input.agentId);
+    const executeAs = input.execute_as !== undefined ? input.execute_as : existing?.execute_as;
+    await assertIdentity(callerId, executeAs || agent?.user_id, 'the subscription');
+}

package/build/services/agent/trigger-registry.js

@@ -245,12 +245,17 @@ class AgentTriggerRegistry {
     async executeReaction(sub, mapped, deterministicId) {
         switch (sub.reaction_type) {
             case 'durable': {
-                const { invokeWorkflow } = await Promise.resolve().then(() => __importStar(require('../workflow-invocation')));
+                const { invokeWorkflow, checkInvocationRoles } = await Promise.resolve().then(() => __importStar(require('../workflow-invocation')));
+                // The run identity must be able to start this workflow now. Only a
+                // superadmin configures a subscription with no identity.
+                const runAs = sub.execute_as ?? sub.agent_user_id ?? undefined;
+                if (runAs)
+                    await checkInvocationRoles(sub.workflow_type, runAs);
                 await invokeWorkflow({
                     workflowType: sub.workflow_type,
                     data: mapped.data ?? mapped,
                     metadata: mapped.metadata ?? { source: 'agent', certified: true },
-                    executeAs: sub.execute_as ?? sub.agent_user_id ?? undefined,
+                    executeAs: runAs,
                     options: { workflowId: deterministicId },
                     auth: { userId: sub.agent_user_id || 'lt-system', role: 'admin' },
                 });

package/build/services/auth/bot-api-key.d.ts

@@ -29,4 +29,6 @@ export declare function revokeBotApiKey(id: string): Promise<boolean>;
 /**
  * List API keys for a bot account (without hashes).
  */
+/** The bot account a key belongs to, or null when there is no such key. */
+export declare function getBotApiKeyOwner(keyId: string): Promise<string | null>;
 export declare function listBotApiKeys(userId: string): Promise<BotApiKeyRecord[]>;

package/build/services/auth/bot-api-key.js

@@ -39,8 +39,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateBotApiKey = generateBotApiKey;
 exports.validateBotApiKey = validateBotApiKey;
 exports.revokeBotApiKey = revokeBotApiKey;
+exports.getBotApiKeyOwner = getBotApiKeyOwner;
 exports.listBotApiKeys = listBotApiKeys;
 const crypto = __importStar(require("crypto"));
+const uuid_1 = require("../../lib/uuid");
 const bcryptjs_1 = __importDefault(require("bcryptjs"));
 const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
@@ -87,6 +89,14 @@ async function revokeBotApiKey(id) {
 /**
  * List API keys for a bot account (without hashes).
  */
+/** The bot account a key belongs to, or null when there is no such key. */
+async function getBotApiKeyOwner(keyId) {
+    if (!(0, uuid_1.isUuid)(keyId))
+        return null;
+    const pool = await (0, db_1.getPool)();
+    const { rows } = await pool.query(sql_1.GET_BOT_KEY_OWNER, [keyId]);
+    return rows[0]?.user_id ?? null;
+}
 async function listBotApiKeys(userId) {
     const pool = await (0, db_1.getPool)();
     const { rows } = await pool.query(sql_1.LIST_BOT_KEYS_BY_USER, [userId]);

package/build/services/auth/oauth-server/access-token.d.ts

@@ -0,0 +1,36 @@
+import type { AuthPayload, LTGrantPolicy, LTGrantRole, LTGrantSnapshot } from '../../../types';
+/**
+ * Access tokens are HS256 JWTs for one resource (`aud`, the `/mcp` URL). They
+ * name the grant (`gid`) and the person (`sub`) and carry no `userId` claim,
+ * so `requireAuth` refuses them on `/api`. A verified token is honored only
+ * while its grant is live: `/mcp` reads the grant on each request and acts on
+ * its current roles, policy and scope.
+ */
+export interface AccessTokenTarget {
+    issuer: string;
+    audience: string;
+}
+export interface LTAccessTokenClaims {
+    iss: string;
+    aud: string;
+    sub: string;
+    client_id: string;
+    gid: string;
+    scope: string;
+    policy: LTGrantPolicy;
+    roles: LTGrantRole[];
+    iat: number;
+    exp: number;
+}
+export declare function signAccessToken(snapshot: LTGrantSnapshot, target: AccessTokenTarget, ttlSeconds?: number): {
+    token: string;
+    expiresIn: number;
+};
+/** The claims of a valid access token for `target`; null for anything else. */
+export declare function verifyAccessToken(token: string, target: AccessTokenTarget): LTAccessTokenClaims | null;
+/**
+ * The request identity for a verified access token and its live grant, in the
+ * shape other credentials produce. Roles, policy and scope come from the grant
+ * as it stands now, not as the token recorded them.
+ */
+export declare function accessTokenPrincipal(claims: LTAccessTokenClaims, live: LTGrantSnapshot): AuthPayload;

package/build/services/auth/oauth-server/access-token.js

@@ -0,0 +1,80 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signAccessToken = signAccessToken;
+exports.verifyAccessToken = verifyAccessToken;
+exports.accessTokenPrincipal = accessTokenPrincipal;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const config_1 = require("../../../modules/config");
+const defaults_1 = require("../../../modules/defaults");
+const constants_1 = require("./constants");
+function signAccessToken(snapshot, target, ttlSeconds = defaults_1.OAUTH_ACCESS_TOKEN_TTL_SECONDS) {
+    if (!config_1.config.JWT_SECRET)
+        throw new Error('signAccessToken: JWT_SECRET is not configured');
+    const token = jsonwebtoken_1.default.sign({
+        client_id: snapshot.client_id,
+        gid: snapshot.grant_id,
+        scope: snapshot.scope,
+        policy: snapshot.policy,
+        roles: snapshot.roles,
+    }, config_1.config.JWT_SECRET, {
+        algorithm: 'HS256',
+        header: { alg: 'HS256', typ: constants_1.ACCESS_TOKEN_TYPE },
+        issuer: target.issuer,
+        audience: target.audience,
+        subject: snapshot.user_id,
+        expiresIn: ttlSeconds,
+    });
+    return { token, expiresIn: ttlSeconds };
+}
+/** The claims of a valid access token for `target`; null for anything else. */
+function verifyAccessToken(token, target) {
+    if (!config_1.config.JWT_SECRET)
+        return null;
+    try {
+        const decoded = jsonwebtoken_1.default.verify(token, config_1.config.JWT_SECRET, {
+            algorithms: ['HS256'],
+            issuer: target.issuer,
+            audience: target.audience,
+            complete: true,
+        });
+        if (decoded.header.typ !== constants_1.ACCESS_TOKEN_TYPE)
+            return null;
+        const claims = decoded.payload;
+        if (typeof claims.exp !== 'number')
+            return null;
+        if (!claims.sub || !claims.gid || !claims.client_id || !Array.isArray(claims.roles))
+            return null;
+        return claims;
+    }
+    catch {
+        return null;
+    }
+}
+function highestRoleType(roles) {
+    if (roles.some((r) => r.type === 'superadmin'))
+        return 'superadmin';
+    if (roles.some((r) => r.type === 'admin'))
+        return 'admin';
+    return 'member';
+}
+/**
+ * The request identity for a verified access token and its live grant, in the
+ * shape other credentials produce. Roles, policy and scope come from the grant
+ * as it stands now, not as the token recorded them.
+ */
+function accessTokenPrincipal(claims, live) {
+    return {
+        userId: claims.sub,
+        role: highestRoleType(live.roles),
+        roles: live.roles.map((r) => ({ role: r.role, type: r.type })),
+        scopes: [live.scope],
+        principalType: constants_1.OAUTH_PRINCIPAL_TYPE,
+        clientId: live.client_id,
+        grantId: live.grant_id,
+        policy: live.policy,
+        grantRoles: live.roles,
+    };
+}

package/build/services/auth/oauth-server/authorization.d.ts

@@ -0,0 +1,47 @@
+import type { OAuthServerSettings } from '../../../modules/oauth-server';
+import type { LTGrantPreset, LTOAuthClient } from '../../../types/oauth-server';
+/**
+ * Validation of an authorization request (RFC 6749 §4.1.1 with PKCE, RFC 7636,
+ * and resource indicators, RFC 8707). Used by the authorize redirect and again
+ * when the person approves, so the consent page is never trusted.
+ */
+export interface AuthorizationRequest {
+    client: LTOAuthClient;
+    redirectUri: string;
+    codeChallenge: string;
+    state?: string;
+    scope?: string;
+    resource: string;
+}
+export type AuthorizationCheck = {
+    ok: true;
+    request: AuthorizationRequest;
+}
+/** The client or redirect URI can't be trusted: answer here, never redirect. */
+ | {
+    ok: false;
+    redirect: false;
+    error: string;
+    description: string;
+}
+/** The client and redirect URI are known: report the error to the client. */
+ | {
+    ok: false;
+    redirect: true;
+    redirectUri: string;
+    state?: string;
+    error: string;
+    description: string;
+};
+export declare function checkAuthorizationRequest(params: Record<string, unknown>, settings: OAuthServerSettings): Promise<AuthorizationCheck>;
+export declare function isGrantPreset(value: unknown): value is LTGrantPreset;
+/** `uri` with `params` added to its query, keeping any query it already has. */
+export declare function withQuery(uri: string, params: Record<string, string | undefined>): string;
+/**
+ * The presets the person may grant. Read-only always; Just be me only when it
+ * adds something: a membership that can write, or an admin tier.
+ */
+export declare function grantablePresets(roles: Array<{
+    type: string;
+    write_scope?: string | null;
+}>): LTGrantPreset[];