@julr/sesame 0.5.1 → 0.7.0

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@julr/sesame",
   "description": "OAuth 2.1 + OIDC server for AdonisJS",
-  "version": "0.5.1",
+  "version": "0.7.0",
   "engines": {
     "node": ">=24.0.0"
   },
-  "packageManager": "pnpm@10.26.2",
+  "packageManager": "pnpm@10.34.5",
   "type": "module",
   "files": [
     "build",
@@ -15,9 +15,14 @@
   "main": "build/index.js",
   "exports": {
     ".": "./build/index.js",
+    "./exceptions": "./build/src/oauth_error.js",
     "./types": "./build/src/types.js",
+    "./storage/types": "./build/src/storage/types.js",
+    "./drivers/lucid": "./build/src/storage/drivers/lucid.js",
+    "./drivers/kysely": "./build/src/storage/drivers/kysely.js",
     "./sesame_provider": "./build/providers/sesame_provider.js",
     "./guard": "./build/src/guard/main.js",
+    "./guard/lucid": "./build/src/guard/lucid.js",
     "./scope_middleware": "./build/src/middleware/scope_middleware.js",
     "./any_scope_middleware": "./build/src/middleware/any_scope_middleware.js",
     "./services/main": "./build/services/main.js",
@@ -25,21 +30,16 @@
     "./commands": "./build/commands/main.js"
   },
   "scripts": {
-    "copy:templates": "copyfiles \"stubs/**/*.stub\" build",
-    "typecheck": "tsc --noEmit",
-    "lint": "oxlint .",
-    "format": "oxfmt --write .",
+    "check": "vp check",
+    "format": "vp fmt --write .",
     "quick:test": "node --import=@poppinss/ts-exec --enable-source-maps bin/test.ts",
-    "pretest": "npm run lint",
+    "test:sql": "bash bin/test_sql_dialects.sh",
     "test": "c8 npm run quick:test",
-    "precompile": "npm run lint",
-    "index:commands": "adonis-kit index build/commands",
-    "compile": "tsdown && tsc --emitDeclarationOnly --declaration",
-    "postcompile": "npm run copy:templates && npm run index:commands",
-    "build": "npm run compile",
+    "build": "vp pack && tsc --emitDeclarationOnly --declaration && adonis-kit index build/commands",
     "release": "release-it",
     "version": "npm run build",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "prepare": "vp config"
   },
   "repository": {
     "type": "git",
@@ -49,70 +49,70 @@
     "url": "https://github.com/Julien-R44/sesame/issues"
   },
   "homepage": "https://github.com/Julien-R44/sesame#readme",
-  "keywords": [],
+  "keywords": [
+    "adonisjs",
+    "adonis",
+    "oauth",
+    "oauth2.1",
+    "oidc",
+    "openid-connect",
+    "authorization-server",
+    "mcp",
+    "pkce"
+  ],
   "author": "Julien Ripouteau",
   "license": "MIT",
   "devDependencies": {
-    "@adonisjs/assembler": "^8.0.0",
-    "@adonisjs/auth": "^10.0.0",
-    "@adonisjs/core": "^7.0.0",
-    "@adonisjs/lucid": "^22.0.0",
-    "@adonisjs/prettier-config": "^1.4.5",
+    "@adonisjs/assembler": "^8.5.2",
+    "@adonisjs/auth": "^10.1.0",
+    "@adonisjs/core": "^7.5.2",
+    "@adonisjs/lucid": "^22.4.2",
     "@adonisjs/tsconfig": "^2.0.0",
+    "@japa/api-client": "^3.2.1",
     "@japa/assert": "^4.2.0",
     "@japa/expect-type": "^2.0.4",
     "@japa/runner": "^5.3.0",
     "@poppinss/ts-exec": "^1.4.4",
-    "@release-it/conventional-changelog": "^10.0.5",
-    "@types/luxon": "^3.7.1",
-    "@types/node": "^25.3.3",
-    "@vinejs/vine": "^4.3.0",
-    "better-sqlite3": "^12.6.2",
-    "c8": "^11.0.0",
-    "copyfiles": "^2.4.1",
+    "@release-it/conventional-changelog": "^12.0.2",
+    "@types/better-sqlite3": "^9.6.0",
+    "@types/luxon": "^3.7.5",
+    "@types/node": "^26.6.2",
+    "@types/pg": "^8.23.1",
+    "@vinejs/vine": "^4.4.0",
+    "better-sqlite3": "^13.0.3",
+    "c8": "^12.0.0",
     "cross-env": "^10.1.0",
-    "oxfmt": "^0.36.0",
-    "oxlint": "^1.51.0",
-    "release-it": "^19.2.4",
-    "tsdown": "^0.20.3",
-    "typescript": "^5.9.3"
+    "kysely": "^0.29.6",
+    "mysql2": "^3.24.4",
+    "node-gyp": "^13.0.2",
+    "pg": "^8.23.0",
+    "release-it": "^21.1.0",
+    "taze": "^21.1.0",
+    "typescript": "^7.0.2",
+    "vite-plus": "catalog:"
   },
   "peerDependencies": {
     "@adonisjs/assembler": "^8.0.0",
     "@adonisjs/auth": "^10.0.0",
     "@adonisjs/core": "^7.0.0",
-    "@adonisjs/lucid": "^21.0.0",
-    "@vinejs/vine": "^4.0.0"
+    "@adonisjs/lucid": "^21.0.0 || ^22.0.0",
+    "@vinejs/vine": "^4.0.0",
+    "kysely": "^0.29.0"
   },
   "peerDependenciesMeta": {
     "@adonisjs/assembler": {
       "optional": true
+    },
+    "@adonisjs/lucid": {
+      "optional": true
+    },
+    "kysely": {
+      "optional": true
     }
   },
   "publishConfig": {
     "access": "public"
   },
-  "tsdown": {
-    "entry": [
-      "./index.ts",
-      "./configure.ts",
-      "./providers/sesame_provider.ts",
-      "./services/main.ts",
-      "./src/guard/main.ts",
-      "./commands/sesame_purge.ts",
-      "./src/middleware/scope_middleware.ts",
-      "./src/middleware/any_scope_middleware.ts"
-    ],
-    "outDir": "./build",
-    "clean": true,
-    "format": "esm",
-    "minify": "dce-only",
-    "fixedExtension": false,
-    "dts": false,
-    "treeshake": false,
-    "sourcemaps": false,
-    "target": "esnext"
-  },
   "release-it": {
     "git": {
       "requireCleanWorkingDir": true,
@@ -147,6 +147,7 @@
     ]
   },
   "dependencies": {
+    "jose": "^6.2.12",
     "luxon": "^3.7.2"
   }
 }

package/build/authorize_controller-YUfAy-R2.js

@@ -1,138 +0,0 @@
-import { i as OAuthAuthorizationCode, n as OAuthPendingAuthorizationRequest, r as OAuthConsent, t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
-import "./decorate-BKZEjPRg.js";
-import "./oauth_access_token-bsoM5KeU.js";
-import { d as E_UNSUPPORTED_RESPONSE_TYPE, o as E_INVALID_REQUEST, r as E_INVALID_CLIENT } from "./oauth_error-CnJ3L8tf.js";
-import { t as OAuthClient } from "./oauth_client-BIoY5jBR.js";
-import { t as TokenService } from "./token_service-fhoA4slP.js";
-import { t as ClientService } from "./client_service-WTNMqWzY.js";
-import { DateTime } from "luxon";
-import string from "@adonisjs/core/helpers/string";
-import vine from "@vinejs/vine";
-var AuthorizeController = class AuthorizeController {
-	static validator = vine.create({
-		client_id: vine.string(),
-		response_type: vine.string(),
-		redirect_uri: vine.string(),
-		scope: vine.string().optional(),
-		state: vine.string().optional(),
-		code_challenge: vine.string().optional(),
-		code_challenge_method: vine.string().optional()
-	});
-	#redirectWithError(ctx, manager, redirectUri, error, description, state) {
-		const url = new URL(redirectUri);
-		url.searchParams.set("error", error);
-		url.searchParams.set("error_description", description);
-		if (state) url.searchParams.set("state", state);
-		url.searchParams.set("iss", manager.config.issuer);
-		return ctx.response.redirect().toPath(url.toString());
-	}
-	async #buildAuthorizationRequestParams(manager, options) {
-		const tokenService = new TokenService(manager);
-		const rawRequestToken = tokenService.generateOpaqueToken();
-		const ttl = string.seconds.parse(manager.config.authorizationRequestTtl);
-		await OAuthPendingAuthorizationRequest.create({
-			id: crypto.randomUUID(),
-			token: tokenService.hashToken(rawRequestToken),
-			userId: options.userId,
-			clientId: options.clientId,
-			redirectUri: options.redirectUri,
-			scopes: options.scopes,
-			state: options.state ?? null,
-			codeChallenge: options.codeChallenge ?? null,
-			codeChallengeMethod: options.codeChallengeMethod ?? null,
-			expiresAt: DateTime.now().plus({ seconds: ttl })
-		});
-		const params = new URLSearchParams();
-		params.set("auth_token", rawRequestToken);
-		return params;
-	}
-	#copyAuthorizeDisplayParams(params, query) {
-		for (const [key, value] of Object.entries(query)) {
-			if (key === "auth_token") continue;
-			if (value != null) params.set(key, String(value));
-		}
-	}
-	#resolvePageUrl(page, ctx, params) {
-		if (typeof page === "function") return page(ctx, params);
-		return `${page}?${params.toString()}`;
-	}
-	async #issueAuthorizationCode(ctx, manager, options) {
-		const tokenService = new TokenService(manager);
-		const raw = tokenService.generateOpaqueToken();
-		const hashed = tokenService.hashToken(raw);
-		const ttl = string.seconds.parse(manager.config.authorizationCodeTtl);
-		await OAuthAuthorizationCode.create({
-			id: crypto.randomUUID(),
-			code: hashed,
-			clientId: options.client.clientId,
-			userId: options.userId,
-			scopes: options.scopes,
-			redirectUri: options.redirectUri,
-			codeChallenge: options.codeChallenge ?? null,
-			codeChallengeMethod: options.codeChallengeMethod ?? null,
-			expiresAt: DateTime.now().plus({ seconds: ttl })
-		});
-		const url = new URL(options.redirectUri);
-		url.searchParams.set("code", raw);
-		if (options.state) url.searchParams.set("state", options.state);
-		url.searchParams.set("iss", manager.config.issuer);
-		return ctx.response.redirect().toPath(url.toString());
-	}
-	async handle(ctx) {
-		const manager = await ctx.containerResolver.make(SesameManager);
-		const clientService = new ClientService();
-		const [error, query] = await AuthorizeController.validator.tryValidate(ctx.request.qs());
-		if (error) throw new E_INVALID_REQUEST("Invalid authorization request parameters");
-		if (query.response_type !== "code") throw new E_UNSUPPORTED_RESPONSE_TYPE("Only \"code\" is supported");
-		const client = await OAuthClient.query().where("clientId", query.client_id).first();
-		if (!client) throw new E_INVALID_CLIENT("Client not found");
-		if (client.isDisabled) throw new E_INVALID_CLIENT("Client is disabled");
-		if (!client.redirectUris.includes(query.redirect_uri)) throw new E_INVALID_REQUEST("Invalid redirect_uri");
-		if (!client.grantTypes.includes("authorization_code")) return this.#redirectWithError(ctx, manager, query.redirect_uri, "unauthorized_client", "Client is not allowed to use the authorization_code grant", query.state);
-		const requestedScopes = query.scope ? query.scope.split(" ") : manager.config.defaultScopes;
-		const invalidScopes = manager.validateScopes(requestedScopes);
-		if (invalidScopes.length > 0) return this.#redirectWithError(ctx, manager, query.redirect_uri, "invalid_scope", `Invalid scopes: ${invalidScopes.join(", ")}`, query.state);
-		try {
-			clientService.validateClientScopes(requestedScopes, client.scopes);
-		} catch (error) {
-			return this.#redirectWithError(ctx, manager, query.redirect_uri, "invalid_scope", error.message, query.state);
-		}
-		if (!query.code_challenge) return this.#redirectWithError(ctx, manager, query.redirect_uri, "invalid_request", "PKCE code_challenge is required", query.state);
-		if (query.code_challenge_method !== "S256") return this.#redirectWithError(ctx, manager, query.redirect_uri, "invalid_request", "Only S256 code_challenge_method is supported", query.state);
-		await ctx.auth.check();
-		const user = ctx.auth.user;
-		if (!user) {
-			const params = new URLSearchParams();
-			this.#copyAuthorizeDisplayParams(params, ctx.request.qs());
-			const loginPage = this.#resolvePageUrl(manager.config.loginPage, ctx, params);
-			return ctx.response.redirect().toPath(loginPage);
-		}
-		const existingConsent = await OAuthConsent.query().where("clientId", client.clientId).where("userId", String(user.id)).first();
-		if (existingConsent) {
-			const consentedSet = new Set(existingConsent.scopes);
-			if (requestedScopes.every((s) => consentedSet.has(s))) return this.#issueAuthorizationCode(ctx, manager, {
-				client,
-				userId: String(user.id),
-				scopes: requestedScopes,
-				redirectUri: query.redirect_uri,
-				codeChallenge: query.code_challenge,
-				codeChallengeMethod: query.code_challenge_method,
-				state: query.state
-			});
-		}
-		const params = await this.#buildAuthorizationRequestParams(manager, {
-			userId: String(user.id),
-			clientId: client.clientId,
-			redirectUri: query.redirect_uri,
-			scopes: requestedScopes,
-			state: query.state,
-			codeChallenge: query.code_challenge,
-			codeChallengeMethod: query.code_challenge_method
-		});
-		this.#copyAuthorizeDisplayParams(params, ctx.request.qs());
-		params.set("scope", requestedScopes.join(" "));
-		const consentPage = this.#resolvePageUrl(manager.config.consentPage, ctx, params);
-		return ctx.response.redirect().toPath(consentPage);
-	}
-};
-export { AuthorizeController as default };

package/build/client_service-WTNMqWzY.js

@@ -1,65 +0,0 @@
-import { o as BUILTIN_SCOPES } from "./sesame_manager-DwDZy5Vy.js";
-import { o as E_INVALID_REQUEST, r as E_INVALID_CLIENT, s as E_INVALID_SCOPE } from "./oauth_error-CnJ3L8tf.js";
-import { t as OAuthClient } from "./oauth_client-BIoY5jBR.js";
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-var ClientService = class {
-	parseBasicAuth(header) {
-		if (!header.startsWith("Basic ")) return null;
-		try {
-			const decoded = Buffer.from(header.slice(6), "base64").toString("utf-8");
-			const colonIndex = decoded.indexOf(":");
-			if (colonIndex === -1) return null;
-			return {
-				clientId: decodeURIComponent(decoded.slice(0, colonIndex)),
-				clientSecret: decodeURIComponent(decoded.slice(colonIndex + 1))
-			};
-		} catch {
-			return null;
-		}
-	}
-	extractCredentials(options) {
-		const basic = options.authorizationHeader ? this.parseBasicAuth(options.authorizationHeader) : null;
-		if (basic && options.bodyClientId) throw new E_INVALID_REQUEST("Multiple client authentication methods are not allowed");
-		if (basic) return basic;
-		if (options.bodyClientId) return {
-			clientId: options.bodyClientId,
-			clientSecret: options.bodyClientSecret
-		};
-		return null;
-	}
-	async authenticateClient(options) {
-		const credentials = this.extractCredentials(options);
-		if (!credentials) throw new E_INVALID_CLIENT("Client authentication failed");
-		const client = await OAuthClient.query().where("clientId", credentials.clientId).first();
-		if (!client || client.isDisabled) throw new E_INVALID_CLIENT("Client authentication failed");
-		if (!client.isPublic) {
-			if (!credentials.clientSecret || !this.verifySecret(credentials.clientSecret, client.clientSecret)) throw new E_INVALID_CLIENT("Client authentication failed");
-		}
-		return client;
-	}
-	validateClientScopes(requestedScopes, clientScopes) {
-		const nonBuiltinScopes = requestedScopes.filter((s) => !BUILTIN_SCOPES.has(s));
-		if (clientScopes.length === 0 && nonBuiltinScopes.length > 0) throw new E_INVALID_SCOPE(`Scope not allowed: ${nonBuiltinScopes.join(", ")}`);
-		const allowedSet = new Set(clientScopes);
-		const invalid = nonBuiltinScopes.filter((s) => !allowedSet.has(s));
-		if (invalid.length > 0) throw new E_INVALID_SCOPE(`Scope not allowed: ${invalid.join(", ")}`);
-	}
-	hashSecret(secret) {
-		return createHash("sha256").update(secret).digest("base64url");
-	}
-	verifySecret(secret, storedHash) {
-		const hash = this.hashSecret(secret);
-		try {
-			return timingSafeEqual(Buffer.from(hash), Buffer.from(storedHash));
-		} catch {
-			return false;
-		}
-	}
-	generateClientId() {
-		return randomBytes(16).toString("hex");
-	}
-	generateClientSecret() {
-		return randomBytes(32).toString("base64url");
-	}
-};
-export { ClientService as t };

package/build/consent_controller-Dprwd1ed.js

@@ -1,85 +0,0 @@
-import { i as OAuthAuthorizationCode, n as OAuthPendingAuthorizationRequest, r as OAuthConsent, t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
-import "./decorate-BKZEjPRg.js";
-import "./oauth_access_token-bsoM5KeU.js";
-import { a as E_INVALID_GRANT, o as E_INVALID_REQUEST, r as E_INVALID_CLIENT } from "./oauth_error-CnJ3L8tf.js";
-import { t as OAuthClient } from "./oauth_client-BIoY5jBR.js";
-import { t as TokenService } from "./token_service-fhoA4slP.js";
-import { DateTime } from "luxon";
-import string from "@adonisjs/core/helpers/string";
-import vine from "@vinejs/vine";
-var ConsentController = class ConsentController {
-	static validator = vine.create({ auth_token: vine.string() });
-	async #consumePendingRequest(hashedToken, userId) {
-		const row = await OAuthPendingAuthorizationRequest.query().where("token", hashedToken).where("userId", userId).where("expiresAt", ">", DateTime.now().toSQL()).first();
-		if (!row) return null;
-		const deleted = await OAuthPendingAuthorizationRequest.query().where("id", row.id).delete();
-		if ((Array.isArray(deleted) ? Number(deleted[0]) : Number(deleted)) === 0) return null;
-		return row;
-	}
-	async #issueAuthorizationCode(ctx, manager, options) {
-		const tokenService = new TokenService(manager);
-		const raw = tokenService.generateOpaqueToken();
-		const hashed = tokenService.hashToken(raw);
-		const ttl = string.seconds.parse(manager.config.authorizationCodeTtl);
-		await OAuthAuthorizationCode.create({
-			id: crypto.randomUUID(),
-			code: hashed,
-			clientId: options.client.clientId,
-			userId: options.userId,
-			scopes: options.scopes,
-			redirectUri: options.redirectUri,
-			codeChallenge: options.codeChallenge ?? null,
-			codeChallengeMethod: options.codeChallengeMethod ?? null,
-			expiresAt: DateTime.now().plus({ seconds: ttl })
-		});
-		const url = new URL(options.redirectUri);
-		url.searchParams.set("code", raw);
-		if (options.state) url.searchParams.set("state", options.state);
-		url.searchParams.set("iss", manager.config.issuer);
-		return ctx.response.redirect().toPath(url.toString());
-	}
-	async handle(ctx) {
-		const manager = await ctx.containerResolver.make(SesameManager);
-		await ctx.auth.check();
-		const user = ctx.auth.user;
-		if (!user) throw new E_INVALID_REQUEST("User must be authenticated");
-		const [error, body] = await ConsentController.validator.tryValidate(ctx.request.body());
-		if (error) throw new E_INVALID_REQUEST("Missing required parameter: auth_token");
-		const accept = ctx.request.body().accept;
-		const hashedToken = new TokenService(manager).hashToken(body.auth_token);
-		const pendingRequest = await this.#consumePendingRequest(hashedToken, String(user.id));
-		if (!pendingRequest) throw new E_INVALID_GRANT("Authorization request not found or expired");
-		const client = await OAuthClient.query().where("clientId", pendingRequest.clientId).first();
-		if (!client) throw new E_INVALID_CLIENT("Client not found");
-		if (client.isDisabled) throw new E_INVALID_CLIENT("Client is disabled");
-		if (!client.redirectUris.includes(pendingRequest.redirectUri)) throw new E_INVALID_REQUEST("Invalid redirect_uri");
-		if (!accept) {
-			const url = new URL(pendingRequest.redirectUri);
-			url.searchParams.set("error", "access_denied");
-			url.searchParams.set("error_description", "The user denied the authorization request");
-			if (pendingRequest.state) url.searchParams.set("state", pendingRequest.state);
-			url.searchParams.set("iss", manager.config.issuer);
-			return ctx.response.redirect().toPath(url.toString());
-		}
-		const existingConsent = await OAuthConsent.query().where("clientId", client.clientId).where("userId", String(user.id)).first();
-		if (existingConsent) {
-			existingConsent.scopes = [...new Set([...existingConsent.scopes, ...pendingRequest.scopes])];
-			await existingConsent.save();
-		} else await OAuthConsent.create({
-			id: crypto.randomUUID(),
-			clientId: client.clientId,
-			userId: String(user.id),
-			scopes: pendingRequest.scopes
-		});
-		return this.#issueAuthorizationCode(ctx, manager, {
-			client,
-			userId: String(user.id),
-			scopes: pendingRequest.scopes,
-			redirectUri: pendingRequest.redirectUri,
-			codeChallenge: pendingRequest.codeChallenge ?? void 0,
-			codeChallengeMethod: pendingRequest.codeChallengeMethod ?? void 0,
-			state: pendingRequest.state ?? void 0
-		});
-	}
-};
-export { ConsentController as default };

package/build/oauth_access_token-bsoM5KeU.js

@@ -1,18 +0,0 @@
-import { n as json, t as __decorate } from "./decorate-BKZEjPRg.js";
-import { BaseModel, column } from "@adonisjs/lucid/orm";
-var OAuthAccessToken = class extends BaseModel {
-	static table = "oauth_access_tokens";
-};
-__decorate([column({ isPrimary: true })], OAuthAccessToken.prototype, "id", void 0);
-__decorate([column()], OAuthAccessToken.prototype, "tokenHash", void 0);
-__decorate([column()], OAuthAccessToken.prototype, "clientId", void 0);
-__decorate([column()], OAuthAccessToken.prototype, "userId", void 0);
-__decorate([json()], OAuthAccessToken.prototype, "scopes", void 0);
-__decorate([column.dateTime()], OAuthAccessToken.prototype, "expiresAt", void 0);
-__decorate([column.dateTime()], OAuthAccessToken.prototype, "revokedAt", void 0);
-__decorate([column.dateTime({ autoCreate: true })], OAuthAccessToken.prototype, "createdAt", void 0);
-__decorate([column.dateTime({
-	autoCreate: true,
-	autoUpdate: true
-})], OAuthAccessToken.prototype, "updatedAt", void 0);
-export { OAuthAccessToken as t };

package/build/oauth_client-BIoY5jBR.js

@@ -1,24 +0,0 @@
-import { n as json, t as __decorate } from "./decorate-BKZEjPRg.js";
-import { BaseModel, column } from "@adonisjs/lucid/orm";
-var OAuthClient = class extends BaseModel {
-	static table = "oauth_clients";
-};
-__decorate([column({ isPrimary: true })], OAuthClient.prototype, "id", void 0);
-__decorate([column()], OAuthClient.prototype, "clientId", void 0);
-__decorate([column({ serializeAs: null })], OAuthClient.prototype, "clientSecret", void 0);
-__decorate([column()], OAuthClient.prototype, "name", void 0);
-__decorate([json()], OAuthClient.prototype, "redirectUris", void 0);
-__decorate([json()], OAuthClient.prototype, "scopes", void 0);
-__decorate([json()], OAuthClient.prototype, "grantTypes", void 0);
-__decorate([column()], OAuthClient.prototype, "isPublic", void 0);
-__decorate([column()], OAuthClient.prototype, "isDisabled", void 0);
-__decorate([column()], OAuthClient.prototype, "requirePkce", void 0);
-__decorate([column()], OAuthClient.prototype, "type", void 0);
-__decorate([json()], OAuthClient.prototype, "metadata", void 0);
-__decorate([column()], OAuthClient.prototype, "userId", void 0);
-__decorate([column.dateTime({ autoCreate: true })], OAuthClient.prototype, "createdAt", void 0);
-__decorate([column.dateTime({
-	autoCreate: true,
-	autoUpdate: true
-})], OAuthClient.prototype, "updatedAt", void 0);
-export { OAuthClient as t };

package/build/oauth_error-CnJ3L8tf.js

@@ -1,94 +0,0 @@
-import { Exception } from "@adonisjs/core/exceptions";
-var OAuthError = class extends Exception {
-	static oauthCode;
-	get oauthCode() {
-		return this.constructor.oauthCode;
-	}
-	handle(error, ctx) {
-		ctx.response.status(error.status).json({
-			error: error.oauthCode,
-			error_description: error.message
-		});
-	}
-};
-const E_INVALID_REQUEST = class extends OAuthError {
-	static status = 400;
-	static code = "E_INVALID_REQUEST";
-	static message = "Invalid request";
-	static oauthCode = "invalid_request";
-};
-const E_INVALID_CLIENT = class extends OAuthError {
-	static status = 401;
-	static code = "E_INVALID_CLIENT";
-	static message = "Invalid client";
-	static oauthCode = "invalid_client";
-	handle(error, ctx) {
-		if (ctx.request.header("authorization")?.startsWith("Basic ")) ctx.response.header("WWW-Authenticate", "Basic");
-		super.handle(error, ctx);
-	}
-};
-const E_INVALID_GRANT = class extends OAuthError {
-	static status = 400;
-	static code = "E_INVALID_GRANT";
-	static message = "Invalid grant";
-	static oauthCode = "invalid_grant";
-};
-const E_INVALID_SCOPE = class extends OAuthError {
-	static status = 400;
-	static code = "E_INVALID_SCOPE";
-	static message = "Invalid scope";
-	static oauthCode = "invalid_scope";
-};
-const E_INVALID_TOKEN = class extends OAuthError {
-	static status = 401;
-	static code = "E_INVALID_TOKEN";
-	static message = "Invalid token";
-	static oauthCode = "invalid_token";
-};
-const E_UNSUPPORTED_GRANT_TYPE = class extends OAuthError {
-	static status = 400;
-	static code = "E_UNSUPPORTED_GRANT_TYPE";
-	static message = "Unsupported grant type";
-	static oauthCode = "unsupported_grant_type";
-};
-const E_UNSUPPORTED_RESPONSE_TYPE = class extends OAuthError {
-	static status = 400;
-	static code = "E_UNSUPPORTED_RESPONSE_TYPE";
-	static message = "Unsupported response type";
-	static oauthCode = "unsupported_response_type";
-};
-const E_ACCESS_DENIED = class extends OAuthError {
-	static status = 403;
-	static code = "E_ACCESS_DENIED";
-	static message = "Access denied";
-	static oauthCode = "access_denied";
-};
-const E_INVALID_CLIENT_METADATA = class extends OAuthError {
-	static status = 400;
-	static code = "E_INVALID_CLIENT_METADATA";
-	static message = "Invalid client metadata";
-	static oauthCode = "invalid_client_metadata";
-};
-const E_SERVER_ERROR = class extends OAuthError {
-	static status = 500;
-	static code = "E_SERVER_ERROR";
-	static message = "Server error";
-	static oauthCode = "server_error";
-};
-const E_INSUFFICIENT_SCOPE = class extends OAuthError {
-	static status = 403;
-	static code = "E_INSUFFICIENT_SCOPE";
-	static message = "Insufficient scope";
-	static oauthCode = "insufficient_scope";
-	missingScopes;
-	constructor(missingScopes, message) {
-		super(message ?? "The token does not have the required scope(s)");
-		this.missingScopes = missingScopes;
-	}
-	handle(error, ctx) {
-		const scope = error.missingScopes.join(" ");
-		ctx.response.header("WWW-Authenticate", `Bearer error="insufficient_scope", error_description="${error.message}", scope="${scope}"`);
-		super.handle(error, ctx);
-	}
-};
-export { E_INVALID_GRANT as a, E_INVALID_TOKEN as c, E_UNSUPPORTED_RESPONSE_TYPE as d, OAuthError as f, E_INVALID_CLIENT_METADATA as i, E_SERVER_ERROR as l, E_INSUFFICIENT_SCOPE as n, E_INVALID_REQUEST as o, E_INVALID_CLIENT as r, E_INVALID_SCOPE as s, E_ACCESS_DENIED as t, E_UNSUPPORTED_GRANT_TYPE as u };

package/build/revoke_controller-D6isoQCi.js

@@ -1,41 +0,0 @@
-import { a as OAuthRefreshToken, t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
-import "./decorate-BKZEjPRg.js";
-import { t as OAuthAccessToken } from "./oauth_access_token-bsoM5KeU.js";
-import "./oauth_error-CnJ3L8tf.js";
-import "./oauth_client-BIoY5jBR.js";
-import { t as TokenService } from "./token_service-fhoA4slP.js";
-import { t as ClientService } from "./client_service-WTNMqWzY.js";
-import { DateTime } from "luxon";
-var RevokeController = class {
-	async handle(ctx) {
-		const manager = await ctx.containerResolver.make(SesameManager);
-		const client = await new ClientService().authenticateClient({
-			authorizationHeader: ctx.request.header("authorization"),
-			bodyClientId: ctx.request.body().client_id,
-			bodyClientSecret: ctx.request.body().client_secret
-		});
-		const token = ctx.request.body().token;
-		if (!token) return ctx.response.ok({});
-		const tokenTypeHint = ctx.request.body().token_type_hint;
-		const hashed = new TokenService(manager).hashToken(token);
-		if (!tokenTypeHint || tokenTypeHint === "access_token") {
-			const record = await OAuthAccessToken.query().where("tokenHash", hashed).where("clientId", client.clientId).first();
-			if (record && !record.revokedAt) {
-				record.revokedAt = DateTime.now();
-				await record.save();
-				return ctx.response.ok({});
-			}
-			if (tokenTypeHint === "access_token") return ctx.response.ok({});
-		}
-		if (!tokenTypeHint || tokenTypeHint === "refresh_token") {
-			const refreshToken = await OAuthRefreshToken.query().where("token", hashed).where("clientId", client.clientId).first();
-			if (refreshToken && !refreshToken.revokedAt) {
-				refreshToken.revokedAt = DateTime.now();
-				await refreshToken.save();
-				await OAuthAccessToken.query().where("tokenHash", refreshToken.accessTokenId).whereNull("revokedAt").update({ revokedAt: DateTime.now().toSQL() });
-			}
-		}
-		return ctx.response.ok({});
-	}
-};
-export { RevokeController as default };

package/build/sesame_manager-Bu4MHqZV.js

@@ -1,4 +0,0 @@
-import { t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
-import "./decorate-BKZEjPRg.js";
-import "./oauth_access_token-bsoM5KeU.js";
-export { SesameManager };