@julr/sesame 0.6.0 → 0.7.0

package/build/src/oauth_error.d.ts

@@ -32,24 +32,24 @@ export declare const E_INVALID_REQUEST: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -72,23 +72,23 @@ export declare const E_INVALID_CLIENT: {
          * @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#section-3.2.4
          */
         handle(error: /*elided*/ any, ctx: HttpContext): void;
-        get oauthCode(): string;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -105,24 +105,24 @@ export declare const E_INVALID_GRANT: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -138,24 +138,24 @@ export declare const E_INVALID_SCOPE: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -172,23 +172,23 @@ export declare const E_INVALID_TOKEN: {
         status?: number;
     }): {
         handle(error: /*elided*/ any, ctx: HttpContext): void;
-        get oauthCode(): string;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -204,24 +204,24 @@ export declare const E_UNSUPPORTED_GRANT_TYPE: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -237,24 +237,24 @@ export declare const E_UNSUPPORTED_RESPONSE_TYPE: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -269,24 +269,24 @@ export declare const E_ACCESS_DENIED: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -302,24 +302,24 @@ export declare const E_INVALID_CLIENT_METADATA: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -335,24 +335,24 @@ export declare const E_SERVER_ERROR: {
         code?: string;
         status?: number;
     }): {
-        get oauthCode(): string;
-        handle(error: /*elided*/ any, ctx: HttpContext): void;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
+        handle(error: /*elided*/ any, ctx: HttpContext): void;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;
@@ -368,23 +368,23 @@ export declare const E_INSUFFICIENT_SCOPE: {
     new (missingScopes: string[], message?: string): {
         missingScopes: string[];
         handle(error: /*elided*/ any, ctx: HttpContext): void;
-        get oauthCode(): string;
+        message: string;
+        stack?: string;
+        cause?: unknown;
         name: string;
         help?: string;
         code?: string;
         status: number;
-        toString(): string;
         get [Symbol.toStringTag](): string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
+        toString(): string;
+        get oauthCode(): string;
     };
     readonly status: number;
     readonly code: string;
     readonly message: string;
     readonly oauthCode: string;
-    help?: string;
     isError(error: unknown): error is Error;
+    help?: string;
     captureStackTrace(targetObject: object, constructorOpt?: Function): void;
     prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
     stackTraceLimit: number;

package/build/src/services/client_service.d.ts

@@ -1,4 +1,5 @@
-import { OAuthClient } from '../models/oauth_client.ts';
+import type { SesameManager } from '../sesame_manager.ts';
+import type { OAuthClientRecord } from '../storage/types.ts';
 /**
  * Extracted client credentials from a request.
  */
@@ -20,6 +21,8 @@ export interface ClientCredentials {
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-2.3
  */
 export declare class ClientService {
+    #private;
+    constructor(manager?: SesameManager);
     /**
      * Parse an HTTP Basic Authorization header into client credentials.
      * Follows RFC 6749 §2.3.1 — the client_id and client_secret are
@@ -47,7 +50,7 @@ export declare class ClientService {
         authorizationHeader?: string;
         bodyClientId?: string;
         bodyClientSecret?: string;
-    }): Promise<OAuthClient>;
+    }): Promise<OAuthClientRecord>;
     /**
      * Validate that requested scopes are within the client's
      * allowed scopes. Throws `E_INVALID_SCOPE` if any scope

package/build/src/sesame_manager.d.ts

@@ -1,7 +1,7 @@
 import type { Router } from '@adonisjs/core/http';
 import { type CreateClientOptions, type CreateClientResult, type ResolvedSesameConfig, type Scope, type UpdateClientOptions } from './types.ts';
 import { KeyService } from './services/key_service.ts';
-import { OAuthClient } from './models/oauth_client.ts';
+import type { OAuthClientRecord, SesameStore } from './storage/types.ts';
 export interface PurgeResult {
     accessTokens: number;
     refreshTokens: number;
@@ -16,8 +16,9 @@ export interface PurgeResult {
  */
 export declare class SesameManager {
     #private;
-    constructor(config: ResolvedSesameConfig, router: Router);
+    constructor(config: ResolvedSesameConfig, router: Router, store: SesameStore);
     get config(): ResolvedSesameConfig;
+    get store(): SesameStore;
     get keyService(): KeyService;
     get isOidcEnabled(): boolean;
     /**
@@ -79,18 +80,18 @@ export declare class SesameManager {
     /**
      * Find a client by its public client_id.
      */
-    findClient(clientId: string): Promise<OAuthClient | null>;
+    findClient(clientId: string): Promise<OAuthClientRecord | null>;
     /**
      * List all clients, optionally filtered by userId.
      */
     listClients(options?: {
         userId?: string;
-    }): Promise<OAuthClient[]>;
+    }): Promise<OAuthClientRecord[]>;
     /**
      * Update an existing client by its public client_id.
      * Returns the updated client, or null if not found.
      */
-    updateClient(clientId: string, options: UpdateClientOptions): Promise<OAuthClient | null>;
+    updateClient(clientId: string, options: UpdateClientOptions): Promise<OAuthClientRecord | null>;
     /**
      * Delete a client and all its associated tokens, codes, and consents.
      * Returns true if the client was found and deleted.

package/build/src/storage/consent_retry.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Retry consent writes after uniqueness, serialization, or lock conflicts.
+ */
+export declare function retryConsentConflict<T>(operation: () => Promise<T>): Promise<T>;

package/build/src/storage/drivers/kysely.d.ts

@@ -0,0 +1,166 @@
+import { type Kysely, type Transaction } from 'kysely';
+import { DateTime } from 'luxon';
+import type { CreateAccessTokenRecord, CreateAuthorizationCodeRecord, CreateClientRecord, CreatePendingAuthorizationRequestRecord, ExchangeAuthorizationCodeOptions, IssueTokenPairOptions, OAuthAccessTokenRecord, OAuthAuthorizationCodeRecord, OAuthClientRecord, OAuthConsentRecord, OAuthPendingAuthorizationRequestRecord, OAuthRefreshTokenRecord, PurgeTokensOptions, RotateRefreshTokenOptions, SesamePurgeResult, SesameStore, UpdateClientRecord } from '../types.js';
+export type KyselyDialect = 'sqlite' | 'postgres' | 'mysql';
+export interface KyselyStoreOptions<DB> {
+    db: Kysely<DB>;
+    /**
+     * Required only when a custom Kysely adapter cannot be identified.
+     */
+    dialect?: KyselyDialect;
+}
+type DatabaseConnection = Kysely<any> | Transaction<any>;
+/**
+ * OAuth persistence backed by a Kysely connection.
+ */
+export declare class KyselyStore implements SesameStore {
+    #private;
+    /**
+     * Bind the store to a Kysely connection or an active transaction.
+     */
+    constructor(db: DatabaseConnection, dialect: KyselyDialect, inTransaction?: boolean);
+    /**
+     * Return the client registered under a public client ID.
+     */
+    findClient(clientId: string): Promise<OAuthClientRecord | null>;
+    /**
+     * List clients in descending creation order, optionally for one user.
+     */
+    listClients(options?: {
+        userId?: string;
+    }): Promise<OAuthClientRecord[]>;
+    /**
+     * Insert a new OAuth client and return its persisted representation.
+     */
+    createClient(data: CreateClientRecord): Promise<OAuthClientRecord>;
+    /**
+     * Update the mutable metadata of one OAuth client.
+     */
+    updateClient(options: {
+        id: string;
+        data: UpdateClientRecord;
+    }): Promise<void>;
+    /**
+     * Replace a confidential client's hashed secret.
+     */
+    updateClientSecret(options: {
+        id: string;
+        secret: string;
+    }): Promise<void>;
+    /**
+     * Delete a client and all OAuth records that refer to it.
+     */
+    deleteClient(clientId: string): Promise<boolean>;
+    /**
+     * Find an access token by its hash, optionally restricted to a client.
+     */
+    findAccessToken(options: {
+        hash: string;
+        clientId?: string;
+    }): Promise<OAuthAccessTokenRecord | null>;
+    /**
+     * Persist a hashed access token.
+     */
+    createAccessToken(data: CreateAccessTokenRecord): Promise<void>;
+    /**
+     * Conditionally revoke an active access token owned by a client.
+     */
+    revokeAccessToken(options: {
+        hash: string;
+        clientId: string;
+        now: DateTime;
+    }): Promise<boolean>;
+    /**
+     * Find a refresh token by its hash and owning client.
+     */
+    findRefreshToken(options: {
+        hash: string;
+        clientId: string;
+    }): Promise<OAuthRefreshTokenRecord | null>;
+    /**
+     * Revoke a refresh token and the access token paired with it atomically.
+     */
+    revokeRefreshToken(options: {
+        hash: string;
+        clientId: string;
+        now: DateTime;
+    }): Promise<void>;
+    /**
+     * Delete refresh tokens and revoke access tokens after replay detection.
+     */
+    revokeTokenFamily(options: {
+        clientId: string;
+        userId: string;
+        now: DateTime;
+    }): Promise<void>;
+    /**
+     * Find an authorization code by its hash and owning client.
+     */
+    findAuthorizationCode(options: {
+        code: string;
+        clientId: string;
+    }): Promise<OAuthAuthorizationCodeRecord | null>;
+    /**
+     * Persist a hashed, short-lived authorization code.
+     */
+    createAuthorizationCode(data: CreateAuthorizationCodeRecord): Promise<void>;
+    /**
+     * Remove an invalid or expired authorization code.
+     */
+    deleteAuthorizationCode(id: string): Promise<void>;
+    /**
+     * Consume a code once and issue its token pair in one transaction.
+     */
+    exchangeAuthorizationCode(options: ExchangeAuthorizationCodeOptions): Promise<boolean>;
+    /**
+     * Find scopes consented to by a user for a client.
+     */
+    findConsent(options: {
+        clientId: string;
+        userId: string;
+    }): Promise<OAuthConsentRecord | null>;
+    /**
+     * Merge newly granted scopes into the user's existing consent.
+     */
+    grantConsent(options: {
+        clientId: string;
+        userId: string;
+        scopes: string[];
+    }): Promise<void>;
+    /**
+     * Persist the authorization context for the consent redirect.
+     */
+    createPendingAuthorizationRequest(data: CreatePendingAuthorizationRequestRecord): Promise<void>;
+    /**
+     * Delete and return an unexpired pending request exactly once.
+     */
+    consumePendingAuthorizationRequest(options: {
+        token: string;
+        userId: string;
+        now: DateTime;
+    }): Promise<OAuthPendingAuthorizationRequestRecord | null>;
+    /**
+     * Issue an access and refresh token together for grace-period reuse.
+     */
+    issueTokenPair(options: IssueTokenPairOptions): Promise<void>;
+    /**
+     * Conditionally rotate a refresh token and replace its access token.
+     */
+    rotateRefreshToken(options: RotateRefreshTokenOptions): Promise<boolean>;
+    /**
+     * Revoke tokens and discard codes and consents for a deleted user.
+     */
+    revokeAllForUser(options: {
+        userId: string;
+        now: DateTime;
+    }): Promise<void>;
+    /**
+     * Purge revoked and expired records, returning deleted row counts.
+     */
+    purgeTokens(options: PurgeTokensOptions): Promise<SesamePurgeResult>;
+}
+/**
+ * Create a Sesame persistence store backed by an existing Kysely connection.
+ */
+export declare function kyselyStore<DB>(options: KyselyStoreOptions<DB>): SesameStore;
+export {};