@julr/sesame 0.5.1 → 0.7.0

package/build/index.js

@@ -1,13 +1,27 @@
-import { configure } from "./configure.js";
-import { a as OAuthRefreshToken, i as OAuthAuthorizationCode, r as OAuthConsent, t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
-import "./decorate-BKZEjPRg.js";
-import { t as OAuthAccessToken } from "./oauth_access_token-bsoM5KeU.js";
-import { a as E_INVALID_GRANT, c as E_INVALID_TOKEN, d as E_UNSUPPORTED_RESPONSE_TYPE, f as OAuthError, i as E_INVALID_CLIENT_METADATA, l as E_SERVER_ERROR, n as E_INSUFFICIENT_SCOPE, o as E_INVALID_REQUEST, r as E_INVALID_CLIENT, s as E_INVALID_SCOPE, t as E_ACCESS_DENIED, u as E_UNSUPPORTED_GRANT_TYPE } from "./oauth_error-CnJ3L8tf.js";
-import { t as OAuthClient } from "./oauth_client-BIoY5jBR.js";
-import "./token_service-fhoA4slP.js";
-import { i as OAuthGuard, n as oauthUserProvider, r as OAuthLucidUserProvider, t as oauthGuard } from "./main-EbeMS5S9.js";
+import { t as configure } from "./configure-t9q3KonY.js";
+import { t as SesameManager } from "./sesame_manager-CeEmlzba.js";
+import { n as OAuthGuard, t as oauthGuard } from "./main-Dx9kZv07.js";
+import { InvalidArgumentsException } from "@adonisjs/core/exceptions";
+import { configProvider } from "@adonisjs/core";
+//#region src/define_config.ts
+/**
+* Resolve user-supplied `SesameConfig` into a `ResolvedSesameConfig`
+* by applying sensible defaults for all optional fields.
+*
+* Defaults:
+* - `scopes`: `{}`
+* - `defaultScopes`: `[]`
+* - `grantTypes`: `['authorization_code', 'refresh_token']`
+* - `accessTokenTtl`: `'1h'`
+* - `refreshTokenTtl`: `'30d'`
+* - `authorizationCodeTtl`: `'10m'`
+* - `allowDynamicRegistration`: `false`
+* - `allowPublicRegistration`: `false`
+*/
 function defineConfig(config) {
+	if (!config.store) throw new InvalidArgumentsException("Missing \"store\" in Sesame config");
 	return {
+		store: config.store,
 		issuer: config.issuer,
 		scopes: config.scopes ?? {},
 		defaultScopes: config.defaultScopes ?? [],
@@ -15,12 +29,47 @@ function defineConfig(config) {
 		accessTokenTtl: config.accessTokenTtl ?? "1h",
 		clientCredentialsAccessTokenTtl: config.clientCredentialsAccessTokenTtl ?? config.accessTokenTtl ?? "1h",
 		refreshTokenTtl: config.refreshTokenTtl ?? "30d",
+		refreshTokenRotationGracePeriod: config.refreshTokenRotationGracePeriod ?? 120,
 		authorizationCodeTtl: config.authorizationCodeTtl ?? "10m",
 		authorizationRequestTtl: config.authorizationRequestTtl ?? config.authorizationCodeTtl ?? "10m",
 		loginPage: config.loginPage,
 		consentPage: config.consentPage,
 		allowDynamicRegistration: config.allowDynamicRegistration ?? false,
-		allowPublicRegistration: config.allowPublicRegistration ?? false
+		allowPublicRegistration: config.allowPublicRegistration ?? false,
+		jwk: config.jwk,
+		oidcProvider: config.oidcProvider,
+		idTokenTtl: config.idTokenTtl ?? "1h"
 	};
 }
-export { E_ACCESS_DENIED, E_INSUFFICIENT_SCOPE, E_INVALID_CLIENT, E_INVALID_CLIENT_METADATA, E_INVALID_GRANT, E_INVALID_REQUEST, E_INVALID_SCOPE, E_INVALID_TOKEN, E_SERVER_ERROR, E_UNSUPPORTED_GRANT_TYPE, E_UNSUPPORTED_RESPONSE_TYPE, OAuthAccessToken, OAuthAuthorizationCode, OAuthClient, OAuthConsent, OAuthError, OAuthGuard, OAuthLucidUserProvider, OAuthRefreshToken, SesameManager, configure, defineConfig, oauthGuard, oauthUserProvider };
+//#endregion
+//#region src/stores.ts
+/**
+* Store driver factories resolved by the AdonisJS service provider.
+*/
+const stores = {
+	/**
+	* Use the application's Lucid connection for OAuth persistence.
+	*/
+	lucid() {
+		return configProvider.create(async (app) => {
+			await app.container.make("lucid.db");
+			const { lucidStore } = await import("./src/storage/drivers/lucid.js");
+			return lucidStore();
+		});
+	},
+	/**
+	* Use an existing Kysely connection for OAuth persistence.
+	*/
+	kysely(options) {
+		return configProvider.create(async (app) => {
+			const connection = typeof options.connection === "function" ? await options.connection(app) : options.connection;
+			const { kyselyStore } = await import("./src/storage/drivers/kysely.js");
+			return kyselyStore({
+				db: connection,
+				dialect: options.dialect
+			});
+		});
+	}
+};
+//#endregion
+export { OAuthGuard, SesameManager, configure, defineConfig, oauthGuard, stores };

package/build/{introspect_controller-6bRt9sZt.js → introspect_controller-LVYGWhMj.js}

@@ -1,15 +1,26 @@
-import { a as OAuthRefreshToken, t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
-import "./decorate-BKZEjPRg.js";
-import { t as OAuthAccessToken } from "./oauth_access_token-bsoM5KeU.js";
-import "./oauth_error-CnJ3L8tf.js";
-import "./oauth_client-BIoY5jBR.js";
-import { t as TokenService } from "./token_service-fhoA4slP.js";
-import { t as ClientService } from "./client_service-WTNMqWzY.js";
+import { n as ClientService, t as SesameManager } from "./sesame_manager-CeEmlzba.js";
+import { t as TokenService } from "./token_service-DDQ3Dxaj.js";
+//#region src/controllers/introspect_controller.ts
 const INACTIVE = { active: false };
+/**
+* Handles the OAuth 2.0 Token Introspection Endpoint (RFC 7662).
+*
+* Allows an authenticated client to determine the active state and
+* metadata of a token (access token or refresh token). The response
+* always includes at least `{ active: boolean }`.
+*
+* Supports the `token_type_hint` parameter to optimize lookup order.
+* Both access tokens and refresh tokens are opaque values looked up
+* by their SHA-256 hash in the database.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc7662
+*/
 var IntrospectController = class {
 	async handle(ctx) {
 		const manager = await ctx.containerResolver.make(SesameManager);
-		const client = await new ClientService().authenticateClient({
+		const clientService = new ClientService(manager);
+		const store = manager.store;
+		const client = await clientService.authenticateClient({
 			authorizationHeader: ctx.request.header("authorization"),
 			bodyClientId: ctx.request.body().client_id,
 			bodyClientSecret: ctx.request.body().client_secret
@@ -19,7 +30,10 @@ var IntrospectController = class {
 		const tokenTypeHint = ctx.request.body().token_type_hint;
 		const hashed = new TokenService(manager).hashToken(token);
 		if (!tokenTypeHint || tokenTypeHint === "access_token") {
-			const record = await OAuthAccessToken.query().where("tokenHash", hashed).where("clientId", client.clientId).first();
+			const record = await store.findAccessToken({
+				hash: hashed,
+				clientId: client.clientId
+			});
 			if (record && !record.revokedAt && record.expiresAt.toJSDate() >= /* @__PURE__ */ new Date()) return {
 				active: true,
 				token_type: "Bearer",
@@ -33,7 +47,10 @@ var IntrospectController = class {
 			if (tokenTypeHint === "access_token") return INACTIVE;
 		}
 		if (!tokenTypeHint || tokenTypeHint === "refresh_token") {
-			const refreshToken = await OAuthRefreshToken.query().where("token", hashed).where("clientId", client.clientId).first();
+			const refreshToken = await store.findRefreshToken({
+				hash: hashed,
+				clientId: client.clientId
+			});
 			if (!refreshToken) return INACTIVE;
 			if (refreshToken.revokedAt) return INACTIVE;
 			if (refreshToken.expiresAt.toJSDate() < /* @__PURE__ */ new Date()) return INACTIVE;
@@ -51,4 +68,5 @@ var IntrospectController = class {
 		return INACTIVE;
 	}
 };
+//#endregion
 export { IntrospectController as default };

package/build/issue_authorization_code-Dr4-bbMp.js

@@ -0,0 +1,39 @@
+import { t as TokenService } from "./token_service-DDQ3Dxaj.js";
+import { DateTime } from "luxon";
+import string from "@adonisjs/core/helpers/string";
+//#region src/actions/issue_authorization_code.ts
+/**
+* Create and persist an authorization code in the database.
+* Returns the raw (unhashed) code to be sent to the client.
+*
+* Shared between the authorize and consent flows to avoid
+* duplicating the code-issuance logic.
+*/
+var IssueAuthorizationCodeAction = class {
+	/**
+	* Generate an opaque authorization code, store its SHA-256
+	* hash in the database, and return the raw value for the
+	* client redirect.
+	*/
+	async execute(manager, input) {
+		const tokenService = new TokenService(manager);
+		const raw = tokenService.generateOpaqueToken();
+		const hashed = tokenService.hashToken(raw);
+		const ttl = string.seconds.parse(manager.config.authorizationCodeTtl);
+		await manager.store.createAuthorizationCode({
+			id: crypto.randomUUID(),
+			code: hashed,
+			clientId: input.client.clientId,
+			userId: input.userId,
+			scopes: input.scopes,
+			redirectUri: input.redirectUri,
+			codeChallenge: input.codeChallenge ?? null,
+			codeChallengeMethod: input.codeChallengeMethod ?? null,
+			nonce: input.nonce ?? null,
+			expiresAt: DateTime.now().plus({ seconds: ttl })
+		});
+		return raw;
+	}
+};
+//#endregion
+export { IssueAuthorizationCodeAction as t };

package/build/jwks_controller-4HUVS_HC.js

@@ -0,0 +1,22 @@
+import { t as SesameManager } from "./sesame_manager-CeEmlzba.js";
+//#region src/controllers/jwks_controller.ts
+/**
+* Serves the JSON Web Key Set (JWKS) containing public keys
+* used to verify ID token signatures.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc7517
+*/
+var JwksController = class {
+	async handle(ctx) {
+		const manager = await ctx.containerResolver.make(SesameManager);
+		if (!manager.isOidcEnabled) {
+			ctx.response.status(404);
+			return { error: "OIDC is not configured" };
+		}
+		ctx.response.header("Cache-Control", "public, max-age=900");
+		ctx.response.header("Content-Type", "application/jwk-set+json");
+		return manager.keyService.getPublicJwks();
+	}
+};
+//#endregion
+export { JwksController as default };

package/build/{main-EbeMS5S9.js → main-Dx9kZv07.js}

@@ -1,9 +1,14 @@
-import { t as OAuthAccessToken } from "./oauth_access_token-bsoM5KeU.js";
-import { t as OAuthClient } from "./oauth_client-BIoY5jBR.js";
-import { t as TokenService } from "./token_service-fhoA4slP.js";
+import { t as TokenService } from "./token_service-DDQ3Dxaj.js";
 import { DateTime } from "luxon";
-import { RuntimeException } from "@adonisjs/core/exceptions";
 import { errors } from "@adonisjs/auth";
+//#region src/guard/guard.ts
+/**
+* OAuth 2.0 guard for `@adonisjs/auth`.
+*
+* Verifies opaque Bearer tokens against the database,
+* checks revocation and expiry, loads the real User model
+* via the provider, and exposes OAuth-specific data (scopes, clientId).
+*/
 var OAuthGuard = class {
 	driverName = "oauth";
 	authenticationAttempted = false;
@@ -58,7 +63,7 @@ var OAuthGuard = class {
 		const tokenService = new TokenService(this.#manager);
 		const includeError = { includeError: true };
 		const hashed = tokenService.hashToken(rawToken);
-		const record = await OAuthAccessToken.query().where("tokenHash", hashed).first();
+		const record = await this.#manager.store.findAccessToken({ hash: hashed });
 		if (!record) throw this.#authenticationFailed("Invalid or expired token", includeError);
 		if (record.revokedAt) throw this.#authenticationFailed("Invalid or expired token", includeError);
 		if (record.expiresAt.toJSDate() < /* @__PURE__ */ new Date()) throw this.#authenticationFailed("Invalid or expired token", includeError);
@@ -91,22 +96,36 @@ var OAuthGuard = class {
 	hasAnyScope(...scopes) {
 		return scopes.some((s) => this.scopes.includes(s));
 	}
+	/**
+	* Used internally by Japa's `loginAs` helper during testing.
+	* Creates a test client and access token in DB, then returns
+	* the authorization headers for the test HTTP client to use.
+	*
+	* @see https://docs.adonisjs.com/guides/auth/custom-auth-guard#implementing-the-guard
+	*/
 	async authenticateAsClient(user) {
 		const tokenService = new TokenService(this.#manager);
 		const defaultScopes = this.#manager.config.defaultScopes;
-		const testClient = await OAuthClient.firstOrCreate({ clientId: "__test_client__" }, {
+		const store = this.#manager.store;
+		let testClient = await store.findClient("__test_client__");
+		if (!testClient) testClient = await store.createClient({
 			id: crypto.randomUUID(),
 			clientId: "__test_client__",
+			clientSecret: null,
 			name: "Test Client",
 			redirectUris: ["http://localhost/callback"],
 			grantTypes: ["authorization_code"],
 			scopes: defaultScopes,
 			isPublic: true,
-			requirePkce: false
+			isDisabled: false,
+			requirePkce: false,
+			type: "public",
+			metadata: null,
+			userId: null
 		});
 		const userId = String(user.id ?? user.getId?.() ?? "test-user");
 		const { raw, hash, expiresAt } = tokenService.createAccessToken();
-		await OAuthAccessToken.create({
+		await store.createAccessToken({
 			id: crypto.randomUUID(),
 			tokenHash: hash,
 			clientId: testClient.clientId,
@@ -117,45 +136,18 @@ var OAuthGuard = class {
 		return { headers: { authorization: `Bearer ${raw}` } };
 	}
 };
-var OAuthLucidUserProvider = class {
-	#model;
-	#options;
-	constructor(options) {
-		this.#options = options;
-	}
-	async #getModel() {
-		if (this.#model && !("hot" in import.meta)) return this.#model;
-		this.#model = (await this.#options.model()).default;
-		return this.#model;
-	}
-	async createUserForGuard(user) {
-		const model = await this.#getModel();
-		if (user instanceof model === false) throw new RuntimeException(`Invalid user object. It must be an instance of the "${model.name}" model`);
-		return {
-			getId() {
-				if (!user.$primaryKeyValue) throw new RuntimeException(`Cannot use "${model.name}" model for authentication. The value of column "${model.primaryKey}" is undefined or null`);
-				return user.$primaryKeyValue;
-			},
-			getOriginal() {
-				return user;
-			}
-		};
-	}
-	async findById(identifier) {
-		const user = await (await this.#getModel()).find(identifier);
-		if (!user) return null;
-		return this.createUserForGuard(user);
-	}
-};
+//#endregion
+//#region src/guard/main.ts
+/**
+* Configure the OAuth guard for `@adonisjs/auth`.
+*/
 function oauthGuard(config) {
 	return { async resolver(name, app) {
 		const emitter = await app.container.make("emitter");
-		const { SesameManager } = await import("./sesame_manager-Bu4MHqZV.js");
+		const { SesameManager } = await import("./sesame_manager-DQxvsTEq.js");
 		const manager = await app.container.make(SesameManager);
 		return (ctx) => new OAuthGuard(name, ctx, emitter, config.provider, manager, config.resource);
 	} };
 }
-function oauthUserProvider(options) {
-	return new OAuthLucidUserProvider(options);
-}
-export { OAuthGuard as i, oauthUserProvider as n, OAuthLucidUserProvider as r, oauthGuard as t };
+//#endregion
+export { OAuthGuard as n, oauthGuard as t };

package/build/{metadata_controller-DeaMRnUr.js → metadata_controller-hwfmxlF7.js}

@@ -1,7 +1,7 @@
-import { o as BUILTIN_SCOPES, t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
-import "./decorate-BKZEjPRg.js";
-import "./oauth_access_token-bsoM5KeU.js";
-import { l as E_SERVER_ERROR } from "./oauth_error-CnJ3L8tf.js";
+import { t as BUILTIN_SCOPES } from "./types-DEtn2Zdb.js";
+import { l as E_SERVER_ERROR } from "./oauth_error-CvxtZvjp.js";
+import { t as SesameManager } from "./sesame_manager-CeEmlzba.js";
+//#region src/controllers/metadata_controller.ts
 const DISCOVERY_ROUTE_NAMES = {
 	authorization_endpoint: "sesame.authorize",
 	token_endpoint: "sesame.token",
@@ -9,6 +9,22 @@ const DISCOVERY_ROUTE_NAMES = {
 	introspection_endpoint: "sesame.introspect",
 	revocation_endpoint: "sesame.revoke"
 };
+const OIDC_DISCOVERY_ROUTE_NAMES = {
+	userinfo_endpoint: "sesame.userinfo",
+	jwks_uri: "sesame.jwks"
+};
+/**
+* Serves OAuth 2.0 discovery metadata documents.
+*
+* Exposes three well-known endpoints:
+* - `authServer()` — OAuth Authorization Server Metadata (RFC 8414)
+* - `oidc()` — OpenID Connect Discovery 1.0 (extends authServer metadata)
+* - `protectedResource()` — OAuth Protected Resource Metadata (RFC 9728)
+*
+* @see https://datatracker.ietf.org/doc/html/rfc8414
+* @see https://datatracker.ietf.org/doc/html/rfc9728
+* @see https://openid.net/specs/openid-connect-discovery-1_0.html
+*/
 var MetadataController = class {
 	#assertDiscoveryRoutes(router, options) {
 		const requiredRoutes = [
@@ -21,6 +37,19 @@ var MetadataController = class {
 		const missingRoutes = requiredRoutes.filter((routeName) => !router.has(routeName));
 		if (missingRoutes.length > 0) throw new E_SERVER_ERROR(`OAuth discovery is misconfigured. Missing named route(s): ${missingRoutes.join(", ")}. Register OAuth routes with sesame.registerRoutes(router) before exposing well-known metadata.`);
 	}
+	#assertOidcDiscoveryRoutes(router) {
+		const missingRoutes = Object.values(OIDC_DISCOVERY_ROUTE_NAMES).filter((routeName) => !router.has(routeName));
+		if (missingRoutes.length > 0) throw new E_SERVER_ERROR(`OIDC discovery is misconfigured. Missing named route(s): ${missingRoutes.join(", ")}. Register OAuth routes with sesame.registerRoutes(router) and sesame.registerWellKnownRoutes(router) before exposing OpenID discovery.`);
+	}
+	/**
+	* OAuth 2.0 Authorization Server Metadata (RFC 8414).
+	*
+	* Returns a JSON document describing the server's endpoints,
+	* supported grant types, response types, authentication methods,
+	* and PKCE support.
+	*
+	* @see https://datatracker.ietf.org/doc/html/rfc8414#section-2
+	*/
 	async authServer(ctx) {
 		const manager = await ctx.containerResolver.make(SesameManager);
 		const router = await ctx.containerResolver.make("router");
@@ -57,15 +86,60 @@ var MetadataController = class {
 			authorization_response_iss_parameter_supported: true
 		};
 	}
+	/**
+	* OpenID Connect Discovery 1.0 metadata.
+	*
+	* Extends the authorization server metadata with OIDC-specific
+	* fields like `subject_types_supported` and
+	* `id_token_signing_alg_values_supported`.
+	*
+	* @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
+	*/
 	async oidc(ctx) {
-		const base = await this.authServer(ctx);
 		const manager = await ctx.containerResolver.make(SesameManager);
+		if (!manager.isOidcEnabled) {
+			ctx.response.status(404);
+			return { error: "OIDC is not configured" };
+		}
+		const base = await this.authServer(ctx);
+		const router = await ctx.containerResolver.make("router");
+		const prefixUrl = manager.config.issuer;
+		this.#assertOidcDiscoveryRoutes(router);
 		return {
 			...base,
+			userinfo_endpoint: router.makeUrl("sesame.userinfo", {}, { prefixUrl }),
+			jwks_uri: router.makeUrl("sesame.jwks", {}, { prefixUrl }),
 			subject_types_supported: ["public"],
-			scopes_supported: [...Object.keys(manager.config.scopes), ...BUILTIN_SCOPES]
+			id_token_signing_alg_values_supported: ["RS256"],
+			scopes_supported: [.../* @__PURE__ */ new Set([
+				"openid",
+				"profile",
+				"email",
+				...Object.keys(manager.config.scopes),
+				...BUILTIN_SCOPES
+			])],
+			claims_supported: [
+				"sub",
+				"iss",
+				"aud",
+				"exp",
+				"iat",
+				"nonce",
+				"at_hash"
+			],
+			response_types_supported: ["code"]
 		};
 	}
+	/**
+	* OAuth 2.0 Protected Resource Metadata (RFC 9728).
+	*
+	* Returns a JSON document that tells clients which authorization
+	* servers protect this resource, which scopes are available, and
+	* how to present bearer tokens. Used by MCP clients to discover
+	* the authorization server.
+	*
+	* @see https://datatracker.ietf.org/doc/html/rfc9728
+	*/
 	async protectedResource(ctx) {
 		const manager = await ctx.containerResolver.make(SesameManager);
 		const issuer = manager.config.issuer;
@@ -78,4 +152,5 @@ var MetadataController = class {
 		};
 	}
 };
+//#endregion
 export { MetadataController as default };

package/build/oauth_error-CvxtZvjp.js

@@ -0,0 +1,189 @@
+import { Exception } from "@adonisjs/core/exceptions";
+//#region src/oauth_error.ts
+/**
+* OAuth 2.0 error classes following the error codes defined in
+* RFC 6749 §5.2 (https://datatracker.ietf.org/doc/html/rfc6749#section-5.2)
+* and RFC 7591 §3.2.2 (https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2).
+*
+* Each error class extends AdonisJS Exception and self-renders via
+* the `handle()` method, producing a standard OAuth JSON error response.
+*/
+/**
+* Base class for all OAuth errors. Extends AdonisJS Exception
+* and renders the standard OAuth error response format:
+* `{ error: "<oauth_code>", error_description: "<message>" }`.
+*
+* Subclasses declare a static `oauthCode` matching the `error` field
+* defined by the OAuth 2.0 spec (e.g. `invalid_request`, `invalid_client`).
+*/
+var OAuthError = class extends Exception {
+	static oauthCode;
+	get oauthCode() {
+		return this.constructor.oauthCode;
+	}
+	handle(error, ctx) {
+		ctx.response.status(error.status).json({
+			error: error.oauthCode,
+			error_description: error.message
+		});
+	}
+};
+/**
+* The request is missing a required parameter, includes an unsupported
+* parameter value, repeats a parameter, or is otherwise malformed.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+*/
+const E_INVALID_REQUEST = class extends OAuthError {
+	static status = 400;
+	static code = "E_INVALID_REQUEST";
+	static message = "Invalid request";
+	static oauthCode = "invalid_request";
+};
+/**
+* Client authentication failed (e.g. unknown client, no client
+* authentication included, or unsupported authentication method).
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+*/
+const E_INVALID_CLIENT = class extends OAuthError {
+	static status = 401;
+	static code = "E_INVALID_CLIENT";
+	static message = "Invalid client";
+	static oauthCode = "invalid_client";
+	/**
+	* If the client attempted to authenticate via the Authorization header
+	* (Basic auth), the server MUST include WWW-Authenticate: Basic.
+	*
+	* @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#section-3.2.4
+	*/
+	handle(error, ctx) {
+		if (ctx.request.header("authorization")?.startsWith("Basic ")) ctx.response.header("WWW-Authenticate", "Basic");
+		super.handle(error, ctx);
+	}
+};
+/**
+* The provided authorization grant (authorization code, refresh token,
+* resource owner credentials) is invalid, expired, revoked, or does
+* not match the redirection URI used in the authorization request.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+*/
+const E_INVALID_GRANT = class extends OAuthError {
+	static status = 400;
+	static code = "E_INVALID_GRANT";
+	static message = "Invalid grant";
+	static oauthCode = "invalid_grant";
+};
+/**
+* The requested scope is invalid, unknown, malformed, or exceeds
+* the scope granted by the resource owner.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+*/
+const E_INVALID_SCOPE = class extends OAuthError {
+	static status = 400;
+	static code = "E_INVALID_SCOPE";
+	static message = "Invalid scope";
+	static oauthCode = "invalid_scope";
+};
+/**
+* The access token provided is expired, revoked, malformed,
+* or invalid for other reasons.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6750#section-3.1
+*/
+const E_INVALID_TOKEN = class extends OAuthError {
+	static status = 401;
+	static code = "E_INVALID_TOKEN";
+	static message = "Invalid token";
+	static oauthCode = "invalid_token";
+	handle(error, ctx) {
+		ctx.response.header("WWW-Authenticate", `Bearer error="invalid_token", error_description="${error.message}"`);
+		super.handle(error, ctx);
+	}
+};
+/**
+* The authorization grant type is not supported by the
+* authorization server.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+*/
+const E_UNSUPPORTED_GRANT_TYPE = class extends OAuthError {
+	static status = 400;
+	static code = "E_UNSUPPORTED_GRANT_TYPE";
+	static message = "Unsupported grant type";
+	static oauthCode = "unsupported_grant_type";
+};
+/**
+* The authorization server does not support obtaining an
+* authorization code using this response type.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
+*/
+const E_UNSUPPORTED_RESPONSE_TYPE = class extends OAuthError {
+	static status = 400;
+	static code = "E_UNSUPPORTED_RESPONSE_TYPE";
+	static message = "Unsupported response type";
+	static oauthCode = "unsupported_response_type";
+};
+/**
+* The resource owner or authorization server denied the request.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
+*/
+const E_ACCESS_DENIED = class extends OAuthError {
+	static status = 403;
+	static code = "E_ACCESS_DENIED";
+	static message = "Access denied";
+	static oauthCode = "access_denied";
+};
+/**
+* The client metadata value is invalid, as defined in the dynamic
+* client registration protocol.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2
+*/
+const E_INVALID_CLIENT_METADATA = class extends OAuthError {
+	static status = 400;
+	static code = "E_INVALID_CLIENT_METADATA";
+	static message = "Invalid client metadata";
+	static oauthCode = "invalid_client_metadata";
+};
+/**
+* The authorization server encountered an unexpected condition
+* that prevented it from fulfilling the request.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
+*/
+const E_SERVER_ERROR = class extends OAuthError {
+	static status = 500;
+	static code = "E_SERVER_ERROR";
+	static message = "Server error";
+	static oauthCode = "server_error";
+};
+/**
+* The access token does not have the required scope(s) to access
+* the protected resource. Returns 403 with a WWW-Authenticate header
+* per RFC 6750 §3.1.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6750#section-3.1
+*/
+const E_INSUFFICIENT_SCOPE = class extends OAuthError {
+	static status = 403;
+	static code = "E_INSUFFICIENT_SCOPE";
+	static message = "Insufficient scope";
+	static oauthCode = "insufficient_scope";
+	missingScopes;
+	constructor(missingScopes, message) {
+		super(message ?? "The token does not have the required scope(s)");
+		this.missingScopes = missingScopes;
+	}
+	handle(error, ctx) {
+		const scope = error.missingScopes.join(" ");
+		ctx.response.header("WWW-Authenticate", `Bearer error="insufficient_scope", error_description="${error.message}", scope="${scope}"`);
+		super.handle(error, ctx);
+	}
+};
+//#endregion
+export { E_INVALID_GRANT as a, E_INVALID_TOKEN as c, E_UNSUPPORTED_RESPONSE_TYPE as d, E_INVALID_CLIENT_METADATA as i, E_SERVER_ERROR as l, E_INSUFFICIENT_SCOPE as n, E_INVALID_REQUEST as o, E_INVALID_CLIENT as r, E_INVALID_SCOPE as s, E_ACCESS_DENIED as t, E_UNSUPPORTED_GRANT_TYPE as u };

package/build/providers/sesame_provider.d.ts

@@ -3,7 +3,7 @@ import type { ApplicationService } from '@adonisjs/core/types';
  * AdonisJS service provider for the Sésame OAuth 2.1 server.
  */
 export default class SesameProvider {
-    protected app: ApplicationService;
+    #private;
     constructor(app: ApplicationService);
     /**
      * Register `SesameManager` as a singleton binding.