@julr/sesame 0.5.1 → 0.7.0

package/build/src/oauth_error.d.ts

@@ -32,24 +32,24 @@ export declare const E_INVALID_REQUEST: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -72,23 +72,23 @@ export declare const E_INVALID_CLIENT: {
          * @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#section-3.2.4
          */
         handle(error: /*elided*/ any, ctx: HttpContext): void;
-        get oauthCode(): string;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -105,24 +105,24 @@ export declare const E_INVALID_GRANT: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -138,24 +138,24 @@ export declare const E_INVALID_SCOPE: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -171,24 +171,24 @@ export declare const E_INVALID_TOKEN: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
         handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -204,24 +204,24 @@ export declare const E_UNSUPPORTED_GRANT_TYPE: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -237,24 +237,24 @@ export declare const E_UNSUPPORTED_RESPONSE_TYPE: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -269,24 +269,24 @@ export declare const E_ACCESS_DENIED: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -302,24 +302,24 @@ export declare const E_INVALID_CLIENT_METADATA: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -335,24 +335,24 @@ export declare const E_SERVER_ERROR: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -368,23 +368,23 @@ export declare const E_INSUFFICIENT_SCOPE: {
     new (missingScopes: string[], message?: string): {
         missingScopes: string[];
         handle(error: /*elided*/ any, ctx: HttpContext): void;
-        get oauthCode(): string;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;

package/build/src/routes.d.ts

@@ -26,4 +26,6 @@ export declare function registerOAuthRoutes(router: Router): void;
  * - `GET /.well-known/openid-configuration` — OpenID Connect discovery
  * - `GET /.well-known/oauth-protected-resource` — Protected resource metadata (RFC 9728)
  */
-export declare function registerWellKnownRoutes(router: Router): void;
+export declare function registerWellKnownRoutes(router: Router, options?: {
+    jwksPath?: string;
+}): void;

package/build/src/services/client_service.d.ts

@@ -1,4 +1,5 @@
-import { OAuthClient } from '../models/oauth_client.ts';
+import type { SesameManager } from '../sesame_manager.ts';
+import type { OAuthClientRecord } from '../storage/types.ts';
 /**
  * Extracted client credentials from a request.
  */
@@ -20,6 +21,8 @@ export interface ClientCredentials {
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-2.3
  */
 export declare class ClientService {
+    #private;
+    constructor(manager?: SesameManager);
     /**
      * Parse an HTTP Basic Authorization header into client credentials.
      * Follows RFC 6749 §2.3.1 — the client_id and client_secret are
@@ -47,7 +50,7 @@ export declare class ClientService {
         authorizationHeader?: string;
         bodyClientId?: string;
         bodyClientSecret?: string;
-    }): Promise<OAuthClient>;
+    }): Promise<OAuthClientRecord>;
     /**
      * Validate that requested scopes are within the client's
      * allowed scopes. Throws `E_INVALID_SCOPE` if any scope

package/build/src/services/id_token_service.d.ts

@@ -0,0 +1,30 @@
+import type { SesameManager } from '../sesame_manager.ts';
+/**
+ * Builds and signs OIDC `id_token` JWTs.
+ */
+export declare class IdTokenService {
+    #private;
+    constructor(manager: SesameManager);
+    /**
+     * Compute `at_hash` — left half of SHA-256 hash of the access token, base64url-encoded.
+     * @see OIDC Core §3.1.3.6
+     */
+    static computeAtHash(accessToken: string): string;
+    /**
+     * Filter out reserved claims that the server owns.
+     */
+    static filterReservedClaims(claims: Record<string, unknown>): Record<string, unknown>;
+    /**
+     * Resolve user OIDC claims by calling `getOidcClaims` if present,
+     * then filtering out reserved protocol claims.
+     */
+    static resolveUserClaims(user: unknown, scopes: string[]): Promise<Record<string, unknown>>;
+    sign(options: {
+        sub: string;
+        clientId: string;
+        scopes: string[];
+        accessToken: string;
+        user: unknown;
+        nonce?: string;
+    }): Promise<string>;
+}

package/build/src/services/key_service.d.ts

@@ -0,0 +1,20 @@
+import { type JWK } from 'jose';
+/**
+ * Manages the RSA key pair used to sign ID tokens.
+ * Accepts a JWK from config, caches the imported private key
+ * and public JWK for JWKS export.
+ */
+export declare class KeyService {
+    #private;
+    constructor(jwk: JWK);
+    /**
+     * Compute a `kid` from public key components (SHA-256, base64url).
+     * Same approach as node-oidc-provider.
+     */
+    static computeKid(jwk: JWK): string;
+    sign(payload: Record<string, unknown>): Promise<string>;
+    getPublicJwks(): {
+        keys: JWK[];
+    };
+    get kid(): string;
+}

package/build/src/sesame_manager.d.ts

@@ -1,5 +1,7 @@
 import type { Router } from '@adonisjs/core/http';
-import { type ResolvedSesameConfig, type Scope } from './types.ts';
+import { type CreateClientOptions, type CreateClientResult, type ResolvedSesameConfig, type Scope, type UpdateClientOptions } from './types.ts';
+import { KeyService } from './services/key_service.ts';
+import type { OAuthClientRecord, SesameStore } from './storage/types.ts';
 export interface PurgeResult {
     accessTokens: number;
     refreshTokens: number;
@@ -14,14 +16,26 @@ export interface PurgeResult {
  */
 export declare class SesameManager {
     #private;
-    constructor(config: ResolvedSesameConfig, router: Router);
+    constructor(config: ResolvedSesameConfig, router: Router, store: SesameStore);
     get config(): ResolvedSesameConfig;
+    get store(): SesameStore;
+    get keyService(): KeyService;
+    get isOidcEnabled(): boolean;
+    /**
+     * Load a user by ID using the configured user provider.
+     * Returns the original user model instance, or null if not found.
+     */
+    findUserById(userId: string): Promise<unknown | null>;
     /**
      * Check if a scope is registered in the server configuration.
      *
      * @see https://datatracker.ietf.org/doc/html/rfc6749#section-3.3
      */
     hasScope(scope: Scope): boolean;
+    /**
+     * Check if the requested scope list uses any OIDC-specific scopes.
+     */
+    usesOidcScopes(scopes: Scope[]): boolean;
     /**
      * Return the list of scopes that are not registered in the
      * server configuration. When no scopes are configured, all
@@ -58,6 +72,36 @@ export declare class SesameManager {
         expiredOnly?: boolean;
         retentionHours?: number;
     }): Promise<PurgeResult>;
+    /**
+     * Create a new OAuth client programmatically.
+     * Returns the client and the raw secret (only available at creation time).
+     */
+    createClient(options: CreateClientOptions): Promise<CreateClientResult>;
+    /**
+     * Find a client by its public client_id.
+     */
+    findClient(clientId: string): Promise<OAuthClientRecord | null>;
+    /**
+     * List all clients, optionally filtered by userId.
+     */
+    listClients(options?: {
+        userId?: string;
+    }): Promise<OAuthClientRecord[]>;
+    /**
+     * Update an existing client by its public client_id.
+     * Returns the updated client, or null if not found.
+     */
+    updateClient(clientId: string, options: UpdateClientOptions): Promise<OAuthClientRecord | null>;
+    /**
+     * Delete a client and all its associated tokens, codes, and consents.
+     * Returns true if the client was found and deleted.
+     */
+    deleteClient(clientId: string): Promise<boolean>;
+    /**
+     * Rotate the secret of a confidential client.
+     * Returns the new raw secret, or null if the client is public or not found.
+     */
+    rotateClientSecret(clientId: string): Promise<string | null>;
     /**
      * Register OAuth 2.1 endpoint routes (token, authorize, consent, etc.).
      *
@@ -77,12 +121,20 @@ export declare class SesameManager {
      */
     registerRoutes(): void;
     /**
-     * Register well-known discovery routes at the root level.
+     * Register discovery routes at the root level.
      *
      * Must be called outside any prefix group so endpoints
      * remain at `/.well-known/...`.
      */
-    registerWellKnownRoutes(): void;
+    registerDiscoveryRoutes(options?: {
+        jwksPath?: string;
+    }): void;
+    /**
+     * @deprecated Use `registerDiscoveryRoutes()` instead.
+     */
+    registerWellKnownRoutes(options?: {
+        jwksPath?: string;
+    }): void;
     /**
      * Register a `/.well-known/oauth-protected-resource` endpoint
      * for a specific resource path (RFC 9728). Useful for MCP

package/build/src/storage/consent_retry.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Retry consent writes after uniqueness, serialization, or lock conflicts.
+ */
+export declare function retryConsentConflict<T>(operation: () => Promise<T>): Promise<T>;