@jeffjassky/oauth-host 0.2.0 → 0.3.0

package/dist/index.js

@@ -22,9 +22,11 @@ function clientSchema() {
     {
       clientId: { type: String, required: true, unique: true },
       name: { type: String, required: true },
-      // `public` exists for CIMD clients, which hold no secret and are bound by
-      // PKCE instead. The enum was written with this widening in mind, so it
-      // was one member rather than a migration.
+      // `public` is a client that holds no secret and is bound by PKCE instead.
+      // Two ways in and they are independent: a CIMD row is written public, and
+      // `clients.create({ type: 'public' })` registers one by hand. The enum was
+      // written with this widening in mind, so it was one member rather than a
+      // migration.
       type: { type: String, enum: ["confidential", "public"], default: "confidential" },
       // How the row got here. A `cimd` row is re-derived from the client's own
       // metadata document, so this is what tells the re-fetch path which fields
@@ -1357,6 +1359,15 @@ function assertResources(ctx, input) {
   }
   return [...input];
 }
+function assertClientType(value) {
+  if (value === void 0) return "confidential";
+  if (value !== "confidential" && value !== "public") {
+    throw new TypeError(
+      `oauth-host: client type must be 'confidential' or 'public' (got ${JSON.stringify(value)})`
+    );
+  }
+  return value;
+}
 function assertName(value) {
   if (typeof value !== "string" || !value.trim()) {
     throw new TypeError("oauth-host: a client needs a non-empty `name` \u2014 it is what the consent screen shows");
@@ -1378,35 +1389,38 @@ async function revokeTokensMatching(ctx, filter) {
   return res.modifiedCount ?? 0;
 }
 function createClientsApi(ctx) {
+  async function create(spec) {
+    if (!spec || typeof spec !== "object") {
+      throw new TypeError("oauth-host: clients.create(spec) requires a spec object");
+    }
+    const name = assertName(spec.name);
+    const type = assertClientType(spec.type);
+    const redirectUris = assertRedirectUris(spec.redirectUris);
+    const allowedScopes = assertScopes(ctx, spec.allowedScopes);
+    const allowedResources = assertResources(ctx, spec.allowedResources);
+    const clientId = spec.clientId ?? generateClientId();
+    const clientSecret = type === "confidential" ? generateClientSecret() : void 0;
+    const doc = await ctx.models.Client.create({
+      clientId,
+      name,
+      type,
+      registration: "manual",
+      trusted: Boolean(spec.trusted),
+      // Only the digest is stored. `clientSecret` below is the only time the
+      // raw value exists outside the caller's variable. Empty for a public
+      // client, which is the same shape a CIMD row is written with.
+      secrets: clientSecret ? [{ hash: sha256(clientSecret), label: "initial", createdAt: /* @__PURE__ */ new Date() }] : [],
+      redirectUris,
+      allowedScopes,
+      allowedResources,
+      branding: spec.branding ?? {},
+      status: "active"
+    });
+    await ctx.audit({ type: "oauth.client_created", actor: "admin", clientId, meta: { type } });
+    return clientSecret ? { client: toPublicClient(doc), clientId, type: "confidential", clientSecret } : { client: toPublicClient(doc), clientId, type: "public" };
+  }
   return {
-    async create(spec) {
-      if (!spec || typeof spec !== "object") {
-        throw new TypeError("oauth-host: clients.create(spec) requires a spec object");
-      }
-      const name = assertName(spec.name);
-      const redirectUris = assertRedirectUris(spec.redirectUris);
-      const allowedScopes = assertScopes(ctx, spec.allowedScopes);
-      const allowedResources = assertResources(ctx, spec.allowedResources);
-      const clientId = spec.clientId ?? generateClientId();
-      const clientSecret = generateClientSecret();
-      const doc = await ctx.models.Client.create({
-        clientId,
-        name,
-        type: "confidential",
-        registration: "manual",
-        trusted: Boolean(spec.trusted),
-        // Only the digest is stored. `clientSecret` below is the only time the
-        // raw value exists outside the caller's variable.
-        secrets: [{ hash: sha256(clientSecret), label: "initial", createdAt: /* @__PURE__ */ new Date() }],
-        redirectUris,
-        allowedScopes,
-        allowedResources,
-        branding: spec.branding ?? {},
-        status: "active"
-      });
-      await ctx.audit({ type: "oauth.client_created", actor: "admin", clientId });
-      return { client: toPublicClient(doc), clientId, clientSecret };
-    },
+    create,
     async rotateSecret(clientId, opts = {}) {
       const doc = await ctx.models.Client.findOne({ clientId });
       if (!doc) throw notFound(clientId);
@@ -1435,7 +1449,7 @@ function createClientsApi(ctx) {
         clientId,
         meta: { retireAfter, retiresAt }
       });
-      return { client: toPublicClient(doc), clientId, clientSecret };
+      return { client: toPublicClient(doc), clientId, type: "confidential", clientSecret };
     },
     async update(clientId, patch) {
       const doc = await ctx.models.Client.findOne({ clientId });