@julr/sesame 0.5.1 → 0.7.0

package/build/src/storage/types.d.ts

@@ -0,0 +1,197 @@
+import type { DateTime } from 'luxon';
+/**
+ * Stored OAuth client. `clientSecret` is a hash and must never be exposed
+ * in public responses.
+ */
+export interface OAuthClientRecord {
+    id: string;
+    clientId: string;
+    clientSecret: string | null;
+    name: string;
+    redirectUris: string[];
+    scopes: string[];
+    grantTypes: string[];
+    isPublic: boolean;
+    isDisabled: boolean;
+    requirePkce: boolean;
+    type: string | null;
+    metadata: Record<string, any> | null;
+    userId: string | null;
+    createdAt: DateTime;
+    updatedAt: DateTime;
+}
+export interface OAuthAccessTokenRecord {
+    id: string;
+    tokenHash: string;
+    clientId: string;
+    userId: string | null;
+    scopes: string[];
+    expiresAt: DateTime;
+    revokedAt: DateTime | null;
+    createdAt: DateTime;
+    updatedAt: DateTime;
+}
+export interface OAuthRefreshTokenRecord {
+    id: string;
+    token: string;
+    accessTokenId: string;
+    clientId: string;
+    userId: string;
+    scopes: string[];
+    expiresAt: DateTime;
+    revokedAt: DateTime | null;
+    createdAt: DateTime;
+    updatedAt: DateTime;
+}
+export interface OAuthAuthorizationCodeRecord {
+    id: string;
+    code: string;
+    clientId: string;
+    userId: string;
+    scopes: string[];
+    redirectUri: string;
+    codeChallenge: string | null;
+    codeChallengeMethod: string | null;
+    nonce: string | null;
+    expiresAt: DateTime;
+    createdAt: DateTime;
+    updatedAt: DateTime;
+}
+export interface OAuthConsentRecord {
+    id: string;
+    clientId: string;
+    userId: string;
+    scopes: string[];
+    createdAt: DateTime;
+    updatedAt: DateTime;
+}
+export interface OAuthPendingAuthorizationRequestRecord {
+    id: string;
+    token: string;
+    userId: string;
+    clientId: string;
+    redirectUri: string;
+    scopes: string[];
+    state: string | null;
+    codeChallenge: string | null;
+    codeChallengeMethod: string | null;
+    nonce: string | null;
+    expiresAt: DateTime;
+    createdAt: DateTime;
+}
+type SesameOptionalCreateKeys<T> = Extract<keyof T, 'createdAt' | 'updatedAt'> | {
+    [K in keyof T]-?: null extends T[K] ? K : never;
+}[keyof T];
+/**
+ * Nullable fields default to null; timestamps default to the current time.
+ */
+export type SesameCreateRecord<T> = Omit<T, SesameOptionalCreateKeys<T>> & Partial<Pick<T, SesameOptionalCreateKeys<T>>>;
+/**
+ * Creation input for each persisted OAuth record.
+ */
+export type CreateClientRecord = SesameCreateRecord<OAuthClientRecord>;
+export type CreateAccessTokenRecord = SesameCreateRecord<OAuthAccessTokenRecord>;
+export type CreateRefreshTokenRecord = SesameCreateRecord<OAuthRefreshTokenRecord>;
+export type CreateAuthorizationCodeRecord = SesameCreateRecord<OAuthAuthorizationCodeRecord>;
+export type CreatePendingAuthorizationRequestRecord = SesameCreateRecord<OAuthPendingAuthorizationRequestRecord>;
+export type UpdateClientRecord = Partial<Pick<OAuthClientRecord, 'name' | 'redirectUris' | 'scopes' | 'grantTypes' | 'isDisabled' | 'requirePkce' | 'metadata'>>;
+export interface SesamePurgeResult {
+    accessTokens: number;
+    refreshTokens: number;
+    authorizationCodes: number;
+    pendingRequests: number;
+}
+export interface IssueTokenPairOptions {
+    accessToken: CreateAccessTokenRecord;
+    refreshToken: CreateRefreshTokenRecord;
+}
+export interface ExchangeAuthorizationCodeOptions {
+    codeId: string;
+    accessToken: CreateAccessTokenRecord;
+    refreshToken: CreateRefreshTokenRecord | null;
+}
+export interface RotateRefreshTokenOptions extends IssueTokenPairOptions {
+    oldRefreshTokenId: string;
+    oldAccessTokenId: string;
+    revokedAt: DateTime;
+}
+export interface PurgeTokensOptions {
+    purgeRevoked: boolean;
+    purgeExpired: boolean;
+    cutoff: DateTime;
+    now: DateTime;
+}
+/**
+ * OAuth-specific persistence operations. Callers never build database predicates.
+ * Conditional exchanges and rotations return false when another request won.
+ */
+export interface SesameStore {
+    findClient(clientId: string): Promise<OAuthClientRecord | null>;
+    listClients(options?: {
+        userId?: string;
+    }): Promise<OAuthClientRecord[]>;
+    createClient(data: CreateClientRecord): Promise<OAuthClientRecord>;
+    updateClient(options: {
+        id: string;
+        data: UpdateClientRecord;
+    }): Promise<void>;
+    updateClientSecret(options: {
+        id: string;
+        secret: string;
+    }): Promise<void>;
+    deleteClient(clientId: string): Promise<boolean>;
+    findAccessToken(options: {
+        hash: string;
+        clientId?: string;
+    }): Promise<OAuthAccessTokenRecord | null>;
+    createAccessToken(data: CreateAccessTokenRecord): Promise<void>;
+    revokeAccessToken(options: {
+        hash: string;
+        clientId: string;
+        now: DateTime;
+    }): Promise<boolean>;
+    findRefreshToken(options: {
+        hash: string;
+        clientId: string;
+    }): Promise<OAuthRefreshTokenRecord | null>;
+    revokeRefreshToken(options: {
+        hash: string;
+        clientId: string;
+        now: DateTime;
+    }): Promise<void>;
+    revokeTokenFamily(options: {
+        clientId: string;
+        userId: string;
+        now: DateTime;
+    }): Promise<void>;
+    findAuthorizationCode(options: {
+        code: string;
+        clientId: string;
+    }): Promise<OAuthAuthorizationCodeRecord | null>;
+    createAuthorizationCode(data: CreateAuthorizationCodeRecord): Promise<void>;
+    deleteAuthorizationCode(id: string): Promise<void>;
+    exchangeAuthorizationCode(options: ExchangeAuthorizationCodeOptions): Promise<boolean>;
+    findConsent(options: {
+        clientId: string;
+        userId: string;
+    }): Promise<OAuthConsentRecord | null>;
+    grantConsent(options: {
+        clientId: string;
+        userId: string;
+        scopes: string[];
+    }): Promise<void>;
+    createPendingAuthorizationRequest(data: CreatePendingAuthorizationRequestRecord): Promise<void>;
+    consumePendingAuthorizationRequest(options: {
+        token: string;
+        userId: string;
+        now: DateTime;
+    }): Promise<OAuthPendingAuthorizationRequestRecord | null>;
+    issueTokenPair(options: IssueTokenPairOptions): Promise<void>;
+    rotateRefreshToken(options: RotateRefreshTokenOptions): Promise<boolean>;
+    revokeAllForUser(options: {
+        userId: string;
+        now: DateTime;
+    }): Promise<void>;
+    purgeTokens(options: PurgeTokensOptions): Promise<SesamePurgeResult>;
+}
+export {};

package/build/src/storage/types.js

@@ -0,0 +1 @@
+export {};

package/build/src/stores.d.ts

@@ -0,0 +1,21 @@
+import type { ApplicationService, ConfigProvider } from '@adonisjs/core/types';
+import type { Kysely } from 'kysely';
+import type { SesameStore } from './storage/types.ts';
+import type { KyselyDialect } from './storage/drivers/kysely.ts';
+export interface KyselyStoreConfig<DB> {
+    connection: Kysely<DB> | ((app: ApplicationService) => Kysely<DB> | Promise<Kysely<DB>>);
+    dialect?: KyselyDialect;
+}
+/**
+ * Store driver factories resolved by the AdonisJS service provider.
+ */
+export declare const stores: {
+    /**
+     * Use the application's Lucid connection for OAuth persistence.
+     */
+    lucid(): ConfigProvider<SesameStore>;
+    /**
+     * Use an existing Kysely connection for OAuth persistence.
+     */
+    kysely<DB>(options: KyselyStoreConfig<DB>): ConfigProvider<SesameStore>;
+};

package/build/src/types.d.ts

@@ -1,4 +1,9 @@
 import type { HttpContext } from '@adonisjs/core/http';
+import type { ConfigProvider } from '@adonisjs/core/types';
+import type { JWK } from 'jose';
+import type { OAuthUserProviderContract } from './guard/types.ts';
+import type { OAuthClientRecord, SesameStore } from './storage/types.ts';
+export type * from './storage/types.ts';
 /**
  * Augment this interface via module augmentation to enable
  * type-safe scope names across the application.
@@ -47,6 +52,46 @@ export type InferScopes<T extends {
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
  */
 export declare const BUILTIN_SCOPES: Set<string>;
+/**
+ * OIDC-recognized scopes that are accepted by server-level validation
+ * without needing to be declared in the config `scopes` map.
+ *
+ * Unlike `BUILTIN_SCOPES`, these still require explicit client authorization
+ * via `ClientService.validateClientScopes()`.
+ */
+export declare const OIDC_SCOPES: Set<string>;
+/**
+ * Protocol-managed claims that must never be overridden by `getOidcClaims()`.
+ */
+export declare const RESERVED_OIDC_CLAIMS: Set<string>;
+/**
+ * Interface for User models that provide OIDC claims.
+ * Implement this on your User model to include custom claims
+ * in id_tokens and /userinfo responses.
+ *
+ * If not implemented, only protocol-level claims (sub, iss, aud, exp, iat)
+ * are included.
+ */
+export interface OidcSubject {
+    getOidcClaims(scopes: Scope[]): Record<string, unknown> | Promise<Record<string, unknown>>;
+}
+/**
+ * Collect OIDC claims based on the granted scopes.
+ *
+ * Maps each scope to its corresponding claims object and merges
+ * only the claims for scopes present in the granted set.
+ *
+ * @example
+ * ```ts
+ * getOidcClaims(scopes: Scope[]) {
+ *   return collectOidcClaims(scopes, {
+ *     profile: { name: this.fullName },
+ *     email: { email: this.email },
+ *   })
+ * }
+ * ```
+ */
+export declare function collectOidcClaims(scopes: Scope[], claimsMap: Partial<Record<Scope, Record<string, unknown>>>): Record<string, unknown>;
 /**
  * Supported OAuth 2.1 grant types.
  *
@@ -59,6 +104,39 @@ export declare const BUILTIN_SCOPES: Set<string>;
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
  */
 export type GrantType = 'authorization_code' | 'refresh_token' | 'client_credentials';
+/**
+ * Options for creating an OAuth client programmatically.
+ */
+export interface CreateClientOptions {
+    name: string;
+    redirectUris: string[];
+    scopes?: string[];
+    grantTypes?: GrantType[];
+    isPublic?: boolean;
+    requirePkce?: boolean;
+    userId?: string;
+    metadata?: Record<string, any>;
+}
+/**
+ * Options for updating an existing OAuth client.
+ */
+export interface UpdateClientOptions {
+    name?: string;
+    redirectUris?: string[];
+    scopes?: string[];
+    grantTypes?: GrantType[];
+    isDisabled?: boolean;
+    requirePkce?: boolean;
+    metadata?: Record<string, any>;
+}
+/**
+ * Result returned when creating a client.
+ * Includes the raw secret (only available at creation time).
+ */
+export interface CreateClientResult {
+    client: OAuthClientRecord;
+    clientSecret: string | null;
+}
 /**
  * User-facing configuration interface for Sésame.
  *
@@ -67,6 +145,10 @@ export type GrantType = 'authorization_code' | 'refresh_token' | 'client_credent
  * page redirects for the authorization flow.
  */
 export interface SesameConfig {
+    /**
+     * Store driver resolved by the service provider.
+     */
+    store: ConfigProvider<SesameStore>;
     /**
      * The issuer URL (must be HTTPS in production).
      * Used in JWT `iss` claim and discovery metadata.
@@ -100,6 +182,18 @@ export interface SesameConfig {
      * Defaults to '30d'.
      */
     refreshTokenTtl?: string;
+    /**
+     * Grace period (in seconds) during which a recently-rotated
+     * refresh token is still accepted instead of triggering
+     * replay-attack detection. Handles race conditions in
+     * multi-process clients (e.g. MCP SDK).
+     *
+     * Set to `0` to disable (strict rotation, no grace period).
+     * Defaults to `120` (2 minutes).
+     *
+     * @see https://auth0.com/docs/secure/tokens/refresh-tokens/configure-refresh-token-rotation
+     */
+    refreshTokenRotationGracePeriod?: number;
     /**
      * Access token TTL for the client_credentials grant (M2M).
      * Defaults to `accessTokenTtl`.
@@ -142,12 +236,34 @@ export interface SesameConfig {
      * Defaults to `false`.
      */
     allowPublicRegistration?: boolean;
+    /**
+     * JWK (JSON Web Key) for signing ID tokens.
+     * Must be an RSA private key in JWK format.
+     * Required together with `oidcProvider` when OIDC scopes (openid) are used.
+     * Passed via env var, parsed at boot, lives in memory.
+     */
+    jwk?: JWK;
+    /**
+     * User provider used by OIDC flows to resolve the subject for
+     * `id_token` emission and `/userinfo`.
+     *
+     * This is independent from `@adonisjs/auth` guards. The provider is
+     * configured once for the authorization server and must be stable for
+     * the issuer. Required together with `jwk` to enable OIDC.
+     */
+    oidcProvider?: OAuthUserProviderContract<unknown>;
+    /**
+     * ID token TTL as a string duration (e.g. '1h', '10m').
+     * Defaults to '1h'.
+     */
+    idTokenTtl?: string;
 }
 /**
  * Fully resolved configuration with defaults applied.
  * Created by `defineConfig()` from user-supplied `SesameConfig`.
  */
 export interface ResolvedSesameConfig {
+    store: ConfigProvider<SesameStore>;
     issuer: string;
     scopes: Record<string, string>;
     defaultScopes: string[];
@@ -155,12 +271,16 @@ export interface ResolvedSesameConfig {
     accessTokenTtl: string;
     clientCredentialsAccessTokenTtl: string;
     refreshTokenTtl: string;
+    refreshTokenRotationGracePeriod: number;
     authorizationCodeTtl: string;
     authorizationRequestTtl: string;
     loginPage: string | ((ctx: HttpContext, params: URLSearchParams) => string);
     consentPage: string | ((ctx: HttpContext, params: URLSearchParams) => string);
     allowDynamicRegistration: boolean;
     allowPublicRegistration: boolean;
+    jwk?: JWK;
+    oidcProvider?: OAuthUserProviderContract<unknown>;
+    idTokenTtl: string;
 }
 /**
  * OAuth 2.0 Authorization Server Metadata as defined by RFC 8414.

package/build/src/types.js

@@ -0,0 +1,2 @@
+import { i as collectOidcClaims, n as OIDC_SCOPES, r as RESERVED_OIDC_CLAIMS, t as BUILTIN_SCOPES } from "../types-DEtn2Zdb.js";
+export { BUILTIN_SCOPES, OIDC_SCOPES, RESERVED_OIDC_CLAIMS, collectOidcClaims };

package/build/stubs/config/sesame.stub

@@ -1,12 +1,15 @@
 {{{
-  exports: { defineConfig: 'import { defineConfig } from \'@julr/sesame\'' }
+  exports({ to: app.configPath('sesame.ts') })
 }}}
 import env from '#start/env'
+import { defineConfig, stores } from '@julr/sesame'
 import type { InferScopes } from '@julr/sesame/types'
 
 const sesameConfig = defineConfig({
   issuer: env.get('APP_URL'),
 
+  store: stores.lucid(),
+
   scopes: {
     // Define your available scopes here
     // 'read': 'Read access',

package/build/stubs/config/sesame_kysely.stub

@@ -0,0 +1,35 @@
+{{{
+  exports({ to: app.configPath('sesame.ts') })
+}}}
+import env from '#start/env'
+import { defineConfig, stores } from '@julr/sesame'
+import type { InferScopes } from '@julr/sesame/types'
+
+const sesameConfig = defineConfig({
+  issuer: env.get('APP_URL'),
+
+  // Replace this import with your application's Kysely instance.
+  store: stores.kysely({
+    connection: async () => {
+      const { db } = await import('#services/kysely')
+      return db
+    },
+  }),
+
+  scopes: {},
+  defaultScopes: [],
+  grantTypes: ['authorization_code', 'refresh_token'],
+  accessTokenTtl: '1h',
+  refreshTokenTtl: '30d',
+  authorizationCodeTtl: '10m',
+  loginPage: '/login',
+  consentPage: '/oauth/consent',
+  allowDynamicRegistration: false,
+  allowPublicRegistration: false,
+})
+
+export default sesameConfig
+
+declare module '@julr/sesame/types' {
+  interface SesameScopes extends InferScopes<typeof sesameConfig> {}
+}

package/build/stubs/main.ts

@@ -0,0 +1,5 @@
+/**
+ * Path to the root directory where the stubs are stored. We use
+ * this path within commands and the configure hook
+ */
+export const stubsRoot = import.meta.dirname

package/build/stubs/migrations/create_oauth_authorization_codes_table.stub

@@ -15,6 +15,7 @@ export default class extends BaseSchema {
       table.text('redirect_uri').notNullable()
       table.string('code_challenge').nullable()
       table.string('code_challenge_method').nullable()
+      table.string('nonce').nullable()
       table.timestamp('expires_at').notNullable()
       table.timestamp('created_at').notNullable()
       table.timestamp('updated_at').notNullable()

package/build/stubs/migrations/create_oauth_pending_authorization_requests_table.stub

@@ -21,6 +21,7 @@ export default class extends BaseSchema {
       table.string('state').nullable()
       table.string('code_challenge').nullable()
       table.string('code_challenge_method').nullable()
+      table.string('nonce').nullable()
       table.timestamp('expires_at').notNullable()
       table.timestamp('created_at').notNullable()
     })

package/build/stubs/migrations/create_oauth_refresh_tokens_table.stub

@@ -9,7 +9,7 @@ export default class extends BaseSchema {
     this.schema.createTable(this.tableName, (table) => {
       table.uuid('id').primary()
       table.string('token').notNullable().index()
-      table.string('access_token_id').notNullable()
+      table.uuid('access_token_id').notNullable()
       table.string('client_id').notNullable().references('client_id').inTable('oauth_clients').onDelete('CASCADE')
       table.string('user_id').notNullable()
       table.json('scopes').notNullable()

package/build/stubs/migrations/kysely/create_oauth_tables.stub

@@ -0,0 +1,151 @@
+{{{
+  exports({
+    to: app.makePath('database/kysely_migrations/create_oauth_tables.ts')
+  })
+}}}
+
+import type { Kysely } from 'kysely'
+
+/**
+ * Kysely migration for Sesame's OAuth tables.
+ */
+export async function up(db: Kysely<any>): Promise<void> {
+  // Clients own OAuth grants and define the allowed redirects, scopes, and grant types.
+  await db.schema
+    .createTable('oauth_clients')
+    .addColumn('id', 'varchar(36)', (column) => column.primaryKey())
+    .addColumn('client_id', 'varchar(255)', (column) => column.notNull().unique())
+    .addColumn('client_secret', 'text')
+    .addColumn('name', 'varchar(255)', (column) => column.notNull())
+    .addColumn('redirect_uris', 'json', (column) => column.notNull())
+    .addColumn('scopes', 'json', (column) => column.notNull())
+    .addColumn('grant_types', 'json', (column) => column.notNull())
+    .addColumn('is_public', 'boolean', (column) => column.notNull().defaultTo(false))
+    .addColumn('is_disabled', 'boolean', (column) => column.notNull().defaultTo(false))
+    .addColumn('require_pkce', 'boolean', (column) => column.notNull().defaultTo(true))
+    .addColumn('type', 'varchar(255)')
+    .addColumn('metadata', 'json')
+    .addColumn('user_id', 'varchar(255)')
+    .addColumn('created_at', 'timestamp', (column) => column.notNull())
+    .addColumn('updated_at', 'timestamp', (column) => column.notNull())
+    .execute()
+
+  // Access tokens are stored by hash so a leaked database never exposes bearer tokens.
+  await db.schema
+    .createTable('oauth_access_tokens')
+    .addColumn('id', 'varchar(36)', (column) => column.primaryKey())
+    .addColumn('token_hash', 'varchar(255)', (column) => column.notNull().unique())
+    .addColumn('client_id', 'varchar(255)', (column) =>
+      column.notNull().references('oauth_clients.client_id').onDelete('cascade')
+    )
+    .addColumn('user_id', 'varchar(255)')
+    .addColumn('scopes', 'json', (column) => column.notNull())
+    .addColumn('expires_at', 'timestamp', (column) => column.notNull())
+    .addColumn('revoked_at', 'timestamp')
+    .addColumn('created_at', 'timestamp', (column) => column.notNull())
+    .addColumn('updated_at', 'timestamp', (column) => column.notNull())
+    .execute()
+
+  // Refresh tokens point to their access token so rotation can revoke the old pair.
+  await db.schema
+    .createTable('oauth_refresh_tokens')
+    .addColumn('id', 'varchar(36)', (column) => column.primaryKey())
+    .addColumn('token', 'varchar(255)', (column) => column.notNull())
+    .addColumn('access_token_id', 'varchar(36)', (column) => column.notNull())
+    .addColumn('client_id', 'varchar(255)', (column) =>
+      column.notNull().references('oauth_clients.client_id').onDelete('cascade')
+    )
+    .addColumn('user_id', 'varchar(255)', (column) => column.notNull())
+    .addColumn('scopes', 'json', (column) => column.notNull())
+    .addColumn('expires_at', 'timestamp', (column) => column.notNull())
+    .addColumn('revoked_at', 'timestamp')
+    .addColumn('created_at', 'timestamp', (column) => column.notNull())
+    .addColumn('updated_at', 'timestamp', (column) => column.notNull())
+    .execute()
+  // Token lookup is part of the refresh grant's hot path.
+  await db.schema
+    .createIndex('oauth_refresh_tokens_token_idx')
+    .on('oauth_refresh_tokens')
+    .column('token')
+    .execute()
+
+  // Authorization codes are short-lived, single-use credentials for the code grant.
+  await db.schema
+    .createTable('oauth_authorization_codes')
+    .addColumn('id', 'varchar(36)', (column) => column.primaryKey())
+    .addColumn('code', 'varchar(255)', (column) => column.notNull())
+    .addColumn('client_id', 'varchar(255)', (column) =>
+      column.notNull().references('oauth_clients.client_id').onDelete('cascade')
+    )
+    .addColumn('user_id', 'varchar(255)', (column) => column.notNull())
+    .addColumn('scopes', 'json', (column) => column.notNull())
+    .addColumn('redirect_uri', 'text', (column) => column.notNull())
+    .addColumn('code_challenge', 'varchar(255)')
+    .addColumn('code_challenge_method', 'varchar(255)')
+    .addColumn('nonce', 'varchar(255)')
+    .addColumn('expires_at', 'timestamp', (column) => column.notNull())
+    .addColumn('created_at', 'timestamp', (column) => column.notNull())
+    .addColumn('updated_at', 'timestamp', (column) => column.notNull())
+    .execute()
+  // Locate the authorization code submitted to the token endpoint.
+  await db.schema
+    .createIndex('oauth_authorization_codes_code_idx')
+    .on('oauth_authorization_codes')
+    .column('code')
+    .execute()
+
+  // A consent records the scopes approved by one user for one client.
+  await db.schema
+    .createTable('oauth_consents')
+    .addColumn('id', 'varchar(36)', (column) => column.primaryKey())
+    .addColumn('client_id', 'varchar(255)', (column) =>
+      column.notNull().references('oauth_clients.client_id').onDelete('cascade')
+    )
+    .addColumn('user_id', 'varchar(255)', (column) => column.notNull())
+    .addColumn('scopes', 'json', (column) => column.notNull())
+    .addColumn('created_at', 'timestamp', (column) => column.notNull())
+    .addColumn('updated_at', 'timestamp', (column) => column.notNull())
+    .execute()
+  // Only one consent record may exist for a client and user pair.
+  await db.schema
+    .createIndex('oauth_consents_client_id_user_id_unique')
+    .on('oauth_consents')
+    .columns(['client_id', 'user_id'])
+    .unique()
+    .execute()
+
+  // Pending requests carry the authorization context across the consent redirect.
+  await db.schema
+    .createTable('oauth_pending_authorization_requests')
+    .addColumn('id', 'varchar(36)', (column) => column.primaryKey())
+    .addColumn('token', 'varchar(255)', (column) => column.notNull())
+    .addColumn('client_id', 'varchar(255)', (column) =>
+      column.notNull().references('oauth_clients.client_id').onDelete('cascade')
+    )
+    .addColumn('user_id', 'varchar(255)', (column) => column.notNull())
+    .addColumn('scopes', 'json', (column) => column.notNull())
+    .addColumn('redirect_uri', 'text', (column) => column.notNull())
+    .addColumn('state', 'varchar(255)')
+    .addColumn('code_challenge', 'varchar(255)')
+    .addColumn('code_challenge_method', 'varchar(255)')
+    .addColumn('nonce', 'varchar(255)')
+    .addColumn('expires_at', 'timestamp', (column) => column.notNull())
+    .addColumn('created_at', 'timestamp', (column) => column.notNull())
+    .execute()
+  // Resolve the opaque pending-request token when the consent form returns.
+  await db.schema
+    .createIndex('oauth_pending_authorization_requests_token_idx')
+    .on('oauth_pending_authorization_requests')
+    .column('token')
+    .execute()
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  // Drop children before clients to respect the client foreign keys.
+  await db.schema.dropTable('oauth_pending_authorization_requests').execute()
+  await db.schema.dropTable('oauth_consents').execute()
+  await db.schema.dropTable('oauth_authorization_codes').execute()
+  await db.schema.dropTable('oauth_refresh_tokens').execute()
+  await db.schema.dropTable('oauth_access_tokens').execute()
+  await db.schema.dropTable('oauth_clients').execute()
+}

package/build/taze.config.d.ts

@@ -0,0 +1,2 @@
+declare const _default: Partial<import("taze").CheckOptions>;
+export default _default;