@nathapp/nestjs-oauth-prisma 1.0.0

package/README.md

@@ -0,0 +1,249 @@
+# @nathapp/nestjs-oauth-prisma
+
+Prisma adapter for `@nathapp/nestjs-oauth`. Binds the core package's repository
+tokens to `AbstractPrismaRepository`-based implementations, plus the default
+`SIGNING_KEY_PROVIDER`.
+
+## Install
+
+```shell
+npm i @nathapp/nestjs-oauth-prisma
+npm i -D prisma && npx prisma init
+```
+
+## Schema
+
+Append the 13 models from the packaged fragment
+`node_modules/@nathapp/nestjs-oauth-prisma/prisma/oauth.prisma` to your app's
+`schema.prisma`. The fragment carries no `datasource` or `generator` block — it
+is models only. Every `DateTime` in it uses `@db.Timestamptz(6)` (PostgreSQL
+`timestamptz`); bare `DateTime` is not supported — token
+expiry comparisons misfire when the database server timezone is not UTC.
+
+**PostgreSQL and MySQL.** The fragment is authored for PostgreSQL 16 and also
+supports MySQL 8.0. For MySQL, assemble it with `@db.Timestamptz(6)` rewritten
+to `@db.DateTime(6)` (the only change; see the `@nathapp/nestjs-iam-prisma`
+README, "Schema assembly and database support") and keep the MySQL server and
+sessions on UTC (`time_zone = '+00:00'`), because `DATETIME(6)` stores no
+timezone. Upgrading a MySQL database built from an earlier fragment: apply
+`prisma/sql/long-text-columns.mysql.sql` first (PostgreSQL needs nothing); on
+MySQL the signing-key PEM columns did not fit before it, so no key could be
+created. Each packaged migration has a `migration.mysql.sql` twin next to its
+`migration.sql`; on MySQL the one-active-signing-key guard is a functional unique
+index. Signing keys are per tenant (`tenant_id` NULL is the global key), so the
+guard is one active key per tenant: apply
+`20261004_oauth_signing_keys_one_active_per_tenant`, which replaces the global
+index from `20260608_oauth_signing_keys_one_active`. On a multi-tenant database
+with the old global index only one tenant could ever hold an active key. `oauth_scopes.code` compares case-insensitively under MySQL's default
+collation, so `Read` and `read` collide there; keep scope codes lower-case.
+
+`prisma/migrations/` in this package holds six incremental patches
+(`oauth_signing_keys_one_active`, `oauth_client_advanced_auth_fields`,
+`oauth_resource_indicator`, `oauth_token_exchange_actor`, `oauth_access_token_mtls_binding`,
+`oauth_signing_keys_one_active_per_tenant`). They are deltas
+against a database already built from the fragment, not a complete initial
+migration set, and Prisma will not apply them for you — the consumer's migration
+history lives in the consumer's own project. Apply them by hand when upgrading
+an existing database, after `prisma migrate dev` has produced your own migration
+from the fragment.
+
+## Register
+
+```ts
+import { Module } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
+import { ClockModule, IdGeneratorModule } from '@nathapp/nestjs-common';
+import { PrismaModule } from '@nathapp/nestjs-prisma';
+import { OAuthPrismaModule } from '@nathapp/nestjs-oauth-prisma';
+
+@Module({
+  imports: [
+    PrismaModule.forRoot({ client: PrismaClient, transaction: true }),
+    ClockModule.register(),        // provides CLOCK, required by PrismaSigningKeyProvider
+    IdGeneratorModule.register(),  // provides ID_GENERATOR, same requirement
+    OAuthPrismaModule.register(),
+  ],
+})
+export class AppModule {}
+```
+
+`ClockModule.register()` and `IdGeneratorModule.register()` are not optional for
+this adapter. `PrismaSigningKeyProvider` injects `CLOCK` and `ID_GENERATOR`
+non-optionally, and the `{ provide: SIGNING_KEY_PROVIDER, useExisting:
+PrismaSigningKeyProvider }` binding that pulls it in is unconditional — not behind
+any option flag. Omit either module and Nest reports `Nest can't resolve
+dependencies of the PrismaSigningKeyProvider (Symbol(OAUTH_SIGNING_KEY_REPOSITORY),
+Symbol(TRANSACTION_MANAGER), ?, Symbol(CLOCK))`. Please make sure that the argument
+Symbol(ID_GENERATOR) at index [2] is available in the OAuthPrismaModule module.
+This applies to the bare-class import form too: `imports: [OAuthPrismaModule]`
+constructs the same provider and needs both modules.
+
+`register()` takes an optional options object:
+
+| Option | Type | Default | Meaning |
+|---|---|---|---|
+| `global` | `boolean` | `true` | Register as a global module so the repository tokens resolve anywhere. |
+
+`register()` was added alongside the bare-class form, not in place of it. There is no
+`registerAsync`.
+
+### Both import forms
+
+This adapter is unusual: unlike the other four Prisma adapters, it supports two
+import forms.
+
+```ts
+imports: [OAuthPrismaModule]              // still supported, non-global
+imports: [OAuthPrismaModule.register()]   // global by default
+```
+
+`OAuthPrismaModule` carries a `@Module({ providers, exports })` decorator as well
+as the `register()` factory, so the bare class is a valid import. It was
+historically the only form, and existing consumers and tests use it that way.
+The bare class is **not** global: modules that inject these tokens must import it
+themselves.
+
+Prefer `OAuthPrismaModule.register()`. It is global by default, so the OAuth
+tokens resolve anywhere without a per-module import, and it leaves room for the
+`global` option. Migrating from the bare class to `register()` is a one-line
+change per module and does not require touching token wiring.
+
+> **Do not use both forms in one `imports` array.**
+>
+> ```ts
+> imports: [OAuthPrismaModule, OAuthPrismaModule.register()]  // two instances
+> ```
+>
+> The dynamic-module token hash differs from the static class token, so Nest
+> treats them as two separate modules and every repository is instantiated
+> twice. Nothing warns about it. Pick one form per application.
+
+### If you already wrap this adapter in `@Global()`
+
+Pass `global: false`. Otherwise the adapter's own global exports are injected
+**in addition to** your override, and last-registration-wins silently decides
+which implementation is used:
+
+```ts
+import { Global, Module } from '@nestjs/common';
+import { ClockModule, IdGeneratorModule } from '@nathapp/nestjs-common';
+import { OAUTH_CLIENT_REPOSITORY } from '@nathapp/nestjs-oauth';
+import { OAuthPrismaModule } from '@nathapp/nestjs-oauth-prisma';
+import { AuditedOAuthClientRepository } from './audited-oauth-client.repository';
+
+@Global()
+@Module({
+  imports: [
+    ClockModule.register(),        // required by PrismaSigningKeyProvider
+    IdGeneratorModule.register(),  // required by PrismaSigningKeyProvider
+    OAuthPrismaModule.register({ global: false }),
+  ],
+  providers: [{ provide: OAUTH_CLIENT_REPOSITORY, useClass: AuditedOAuthClientRepository }],
+  exports: [OAUTH_CLIENT_REPOSITORY],
+})
+export class PrismaOverridesModule {}
+```
+
+`global: false` only helps if the adapter is registered once. A second, global
+`register()` elsewhere in the app keeps its global exports, and `global: false`
+here does not remove them — so the collision this section exists to prevent is
+still there. Register the adapter in exactly one place.
+
+The `global` option carries no documentation in the published type definitions
+(`removeComments: true` strips the JSDoc from the emitted `.d.ts`), so this README
+is where it is described. The options object is typed as `PrismaAdapterModuleOptions`,
+which is exported from this package if you need to name the type.
+
+## Transactions
+
+Multi-write flows need `PrismaModule.forRoot({ client: PrismaClient, transaction: true })`.
+Every repository resolves its client per operation from the `TRANSACTION_MANAGER`
+token, and the two `PrismaModule` registration paths fail differently when
+`transaction` is omitted:
+
+- `PrismaModule.forRoot()` binds `TRANSACTION_MANAGER` only when `transaction: true`
+  is set. Without it nothing is bound, the repositories cannot resolve their
+  dependency, and Nest fails at boot.
+- `PrismaModule.forRootAsync()` always binds the token, but with a manager whose
+  `run()` and `getClient()` throw and whose `isInTransaction()` returns `false`, so
+  the app boots and fails on first use instead.
+
+Neither path is a silent passthrough: a real transaction manager either joins the
+transaction already in scope or opens a Prisma interactive transaction.
+
+Both of those are `PrismaModule` from `@nathapp/nestjs-prisma`. These adapters
+expose only the synchronous `register()`; they have no `registerAsync`.
+
+The refresh grant is the case that matters most: it revokes the old refresh token,
+issues a replacement, and issues an access token inside a single `run()`. If that
+is not one real transaction, a failure midway leaves the client with no usable
+token and a revoked grant.
+
+## Tokens bound
+
+This package does **not** re-export `@nathapp/nestjs-oauth`. Import the tokens
+themselves from `@nathapp/nestjs-oauth`, and only the implementations and the
+module from this package.
+
+| Token | Implementation |
+|---|---|
+| `OAUTH_CLIENT_REPOSITORY` | `PrismaOAuthClientRepository` |
+| `OAUTH_SCOPE_REPOSITORY` | `PrismaOAuthScopeRepository` |
+| `OAUTH_AUTH_CODE_REPOSITORY` | `PrismaOAuthAuthorizationCodeRepository` |
+| `OAUTH_ACCESS_TOKEN_REPOSITORY` | `PrismaOAuthAccessTokenRepository` |
+| `OAUTH_REFRESH_TOKEN_REPOSITORY` | `PrismaOAuthRefreshTokenRepository` |
+| `OAUTH_CONSENT_REPOSITORY` | `PrismaOAuthConsentRepository` |
+| `OAUTH_SIGNING_KEY_REPOSITORY` | `PrismaOAuthSigningKeyRepository` |
+| `OAUTH_DEVICE_CODE_REPOSITORY` | `PrismaOAuthDeviceCodeRepository` |
+| `OAUTH_PUSHED_REQUEST_REPOSITORY` | `PrismaOAuthPushedRequestRepository` |
+| `SIGNING_KEY_PROVIDER` | `PrismaSigningKeyProvider` |
+
+`PrismaSigningKeyProvider` reads the active `OAuthSigningKey` row on every call —
+it holds no cache. `rotate()` marks the current key `retiring` with a 7-day grace
+window and mints a new RSA/RS256 keypair in one `run()`; `getVerificationKeys()`
+publishes the `active` and `retiring` keys in the JWKS. An initial key is minted
+lazily on first use, so pre-seed a key or call `rotate()` at deploy to avoid a race
+between concurrent first calls. Private keys are stored as PEM: override
+`encryptPrivateKey()` / `decryptPrivateKey()` for KMS or Vault. The defaults
+refuse plaintext storage in production unless
+`OAUTH_ALLOW_PLAINTEXT_SIGNING_KEYS=true` is set.
+
+The module also provides and exports the class
+`PrismaConsentLogoutTargetResolver`, without binding it to anything. To use it as
+your `LOGOUT_TARGET_RESOLVER`, bind the token yourself:
+
+```ts
+import { Module } from '@nestjs/common';
+import { ClockModule, IdGeneratorModule } from '@nathapp/nestjs-common';
+import { LOGOUT_TARGET_RESOLVER } from '@nathapp/nestjs-oauth';
+import { OAuthPrismaModule, PrismaConsentLogoutTargetResolver } from '@nathapp/nestjs-oauth-prisma';
+
+@Module({
+  imports: [
+    ClockModule.register(),        // required by PrismaSigningKeyProvider
+    IdGeneratorModule.register(),  // required by PrismaSigningKeyProvider
+    OAuthPrismaModule.register(),
+  ],
+  providers: [{ provide: LOGOUT_TARGET_RESOLVER, useExisting: PrismaConsentLogoutTargetResolver }],
+})
+export class LogoutTargetModule {}
+```
+
+## Upgrade: mTLS access token bindings
+
+Add `OAuthAccessToken.cnfX5tS256` from the schema fragment to your app's schema.
+The packaged SQL patch
+`prisma/migrations/20261003_oauth_access_token_mtls_binding/migration.sql`
+adds the nullable `oauth_access_tokens.cnf_x5t_s256` column. Incorporate this
+change into your own migration history, apply it before deploying the updated
+adapter, and regenerate your Prisma client.
+
+Earlier adapters discarded the certificate thumbprint when writing access
+tokens, so existing rows cannot be backfilled reliably. Revoke existing access
+tokens belonging to mTLS clients and require fresh issuance at cutover.
+A null column remains valid for clients that do not use certificate binding.
+
+Consent, device-code and pushed-request domain models continue to expose the
+public OAuth `clientId`; the adapter resolves that identifier through the client
+relation when writing the internal database foreign key. Access/refresh tokens
+and authorization codes continue to use the internal client row id.

package/dist/abstract-prisma-public-client.repository.d.ts

@@ -0,0 +1,20 @@
+import { AbstractPrismaRepository } from '@nathapp/nestjs-prisma';
+import { type IPageOption } from '@nathapp/nestjs-common';
+import type { IPageResult } from '@nathapp/nestjs-data';
+import type { PrismaClientLike } from '@nathapp/nestjs-prisma';
+import { type OAuthPrismaDelegate } from './oauth-prisma.types';
+export declare abstract class AbstractPrismaPublicClientRepository<T extends {
+    clientId: string;
+}, TModel extends object> extends AbstractPrismaRepository<T, TModel, string> {
+    protected abstract readonly prismaModelName: string;
+    protected abstract modelDelegate(client: PrismaClientLike): OAuthPrismaDelegate<TModel>;
+    protected get oauthModel(): OAuthPrismaDelegate<TModel>;
+    protected get relationIncludes(): Record<string, unknown>;
+    protected toPersistenceCriteria(criteria: Partial<T>): Record<string, unknown>;
+    create(input: T): Promise<T>;
+    findById(id: string): Promise<T | null>;
+    findOne(criteria: Partial<T>): Promise<T | null>;
+    findAll(page: IPageOption): Promise<IPageResult<T>>;
+    count(criteria?: Partial<T>): Promise<number>;
+    update(id: string, patch: Partial<T>): Promise<T>;
+}

package/dist/abstract-prisma-public-client.repository.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AbstractPrismaPublicClientRepository = void 0;
+const nestjs_prisma_1 = require("@nathapp/nestjs-prisma");
+const nestjs_common_1 = require("@nathapp/nestjs-common");
+class AbstractPrismaPublicClientRepository extends nestjs_prisma_1.AbstractPrismaRepository {
+    get oauthModel() {
+        return this.modelDelegate(this.tx.getClient());
+    }
+    get relationIncludes() {
+        return { client: { select: { clientId: true } } };
+    }
+    toPersistenceCriteria(criteria) {
+        return {
+            ...this.toPersistenceUpdate(criteria),
+            ...(criteria.clientId !== undefined ? { client: { clientId: criteria.clientId } } : {}),
+        };
+    }
+    async create(input) {
+        const row = await this.oauthModel.create({
+            data: this.toPersistenceCreate(input), include: this.relationIncludes,
+        });
+        return this.toDomain(row);
+    }
+    async findById(id) {
+        const row = await this.oauthModel.findUnique({ where: { id }, include: this.relationIncludes });
+        return row ? this.toDomain(row) : null;
+    }
+    async findOne(criteria) {
+        const row = await this.oauthModel.findFirst({
+            where: this.toPersistenceCriteria(criteria), include: this.relationIncludes,
+        });
+        return row ? this.toDomain(row) : null;
+    }
+    async findAll(page) {
+        const { skip, take } = (0, nestjs_common_1.resolvePageOption)(page);
+        const [rows, total] = await Promise.all([
+            this.oauthModel.findMany({ skip, take, include: this.relationIncludes }),
+            this.oauthModel.count({ where: undefined }),
+        ]);
+        return new nestjs_common_1.Page(page, total, rows.map((row) => this.toDomain(row)));
+    }
+    async count(criteria) {
+        return this.oauthModel.count(criteria ? { where: this.toPersistenceCriteria(criteria) } : {});
+    }
+    async update(id, patch) {
+        const row = await this.oauthModel.update({
+            where: { id }, data: this.toPersistenceUpdate(patch), include: this.relationIncludes,
+        });
+        return this.toDomain(row);
+    }
+}
+exports.AbstractPrismaPublicClientRepository = AbstractPrismaPublicClientRepository;
+//# sourceMappingURL=abstract-prisma-public-client.repository.js.map

package/dist/abstract-prisma-public-client.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abstract-prisma-public-client.repository.js","sourceRoot":"","sources":["../lib/abstract-prisma-public-client.repository.ts"],"names":[],"mappings":";;;AAAA,0DAAkE;AAClE,0DAAmF;AAYnF,MAAsB,oCACpB,SAAQ,wCAA2C;IAMnD,IAAc,UAAU;QACtB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAoB,CAAC,CAAC;IACnE,CAAC;IAED,IAAc,gBAAgB;QAC5B,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAES,qBAAqB,CAAC,QAAoB;QAClD,OAAO;YACL,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YACrC,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,MAAM,CAAC,KAAQ;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YACvC,IAAI,EAAE,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,gBAAgB;SACtE,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAEQ,KAAK,CAAC,QAAQ,CAAC,EAAU;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAChG,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,OAAO,CAAC,QAAoB;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAC1C,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,gBAAgB;SAC5E,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,OAAO,CAAC,IAAiB;QACtC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAA,iCAAiB,EAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,OAAO,IAAI,oBAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAEQ,KAAK,CAAC,KAAK,CAAC,QAAqB;QACxC,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IAEQ,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAAiB;QACjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YACvC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,gBAAgB;SACrF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;CACF;AA5DD,oFA4DC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export * from './prisma-oauth-client.repository';
+export * from './prisma-oauth-scope.repository';
+export * from './prisma-oauth-authorization-code.repository';
+export * from './prisma-oauth-access-token.repository';
+export * from './prisma-oauth-refresh-token.repository';
+export * from './prisma-oauth-consent.repository';
+export * from './prisma-oauth-signing-key.repository';
+export * from './prisma-oauth-device-code.repository';
+export * from './prisma-oauth-pushed-request.repository';
+export * from './prisma-consent-logout-target.resolver';
+export * from './prisma-signing-key.provider';
+export * from './oauth-prisma.module';

package/dist/index.js

@@ -0,0 +1,29 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./prisma-oauth-client.repository"), exports);
+__exportStar(require("./prisma-oauth-scope.repository"), exports);
+__exportStar(require("./prisma-oauth-authorization-code.repository"), exports);
+__exportStar(require("./prisma-oauth-access-token.repository"), exports);
+__exportStar(require("./prisma-oauth-refresh-token.repository"), exports);
+__exportStar(require("./prisma-oauth-consent.repository"), exports);
+__exportStar(require("./prisma-oauth-signing-key.repository"), exports);
+__exportStar(require("./prisma-oauth-device-code.repository"), exports);
+__exportStar(require("./prisma-oauth-pushed-request.repository"), exports);
+__exportStar(require("./prisma-consent-logout-target.resolver"), exports);
+__exportStar(require("./prisma-signing-key.provider"), exports);
+__exportStar(require("./oauth-prisma.module"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mEAAiD;AACjD,kEAAgD;AAChD,+EAA6D;AAC7D,yEAAuD;AACvD,0EAAwD;AACxD,oEAAkD;AAClD,wEAAsD;AACtD,wEAAsD;AACtD,2EAAyD;AACzD,0EAAwD;AACxD,gEAA8C;AAC9C,wDAAsC"}

package/dist/oauth-prisma.module.d.ts

@@ -0,0 +1,7 @@
+import { DynamicModule } from '@nestjs/common';
+export interface PrismaAdapterModuleOptions {
+    global?: boolean;
+}
+export declare class OAuthPrismaModule {
+    static register(options?: PrismaAdapterModuleOptions): DynamicModule;
+}

package/dist/oauth-prisma.module.js

@@ -0,0 +1,75 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var OAuthPrismaModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthPrismaModule = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_oauth_1 = require("@nathapp/nestjs-oauth");
+const prisma_oauth_client_repository_1 = require("./prisma-oauth-client.repository");
+const prisma_oauth_scope_repository_1 = require("./prisma-oauth-scope.repository");
+const prisma_oauth_authorization_code_repository_1 = require("./prisma-oauth-authorization-code.repository");
+const prisma_oauth_access_token_repository_1 = require("./prisma-oauth-access-token.repository");
+const prisma_oauth_refresh_token_repository_1 = require("./prisma-oauth-refresh-token.repository");
+const prisma_oauth_consent_repository_1 = require("./prisma-oauth-consent.repository");
+const prisma_oauth_signing_key_repository_1 = require("./prisma-oauth-signing-key.repository");
+const prisma_oauth_device_code_repository_1 = require("./prisma-oauth-device-code.repository");
+const prisma_oauth_pushed_request_repository_1 = require("./prisma-oauth-pushed-request.repository");
+const prisma_consent_logout_target_resolver_1 = require("./prisma-consent-logout-target.resolver");
+const prisma_signing_key_provider_1 = require("./prisma-signing-key.provider");
+const OAUTH_PRISMA_PROVIDERS = [
+    prisma_oauth_client_repository_1.PrismaOAuthClientRepository,
+    { provide: nestjs_oauth_1.OAUTH_CLIENT_REPOSITORY, useExisting: prisma_oauth_client_repository_1.PrismaOAuthClientRepository },
+    prisma_oauth_scope_repository_1.PrismaOAuthScopeRepository,
+    { provide: nestjs_oauth_1.OAUTH_SCOPE_REPOSITORY, useExisting: prisma_oauth_scope_repository_1.PrismaOAuthScopeRepository },
+    prisma_oauth_authorization_code_repository_1.PrismaOAuthAuthorizationCodeRepository,
+    { provide: nestjs_oauth_1.OAUTH_AUTH_CODE_REPOSITORY, useExisting: prisma_oauth_authorization_code_repository_1.PrismaOAuthAuthorizationCodeRepository },
+    prisma_oauth_access_token_repository_1.PrismaOAuthAccessTokenRepository,
+    { provide: nestjs_oauth_1.OAUTH_ACCESS_TOKEN_REPOSITORY, useExisting: prisma_oauth_access_token_repository_1.PrismaOAuthAccessTokenRepository },
+    prisma_oauth_refresh_token_repository_1.PrismaOAuthRefreshTokenRepository,
+    { provide: nestjs_oauth_1.OAUTH_REFRESH_TOKEN_REPOSITORY, useExisting: prisma_oauth_refresh_token_repository_1.PrismaOAuthRefreshTokenRepository },
+    prisma_oauth_consent_repository_1.PrismaOAuthConsentRepository,
+    { provide: nestjs_oauth_1.OAUTH_CONSENT_REPOSITORY, useExisting: prisma_oauth_consent_repository_1.PrismaOAuthConsentRepository },
+    prisma_oauth_signing_key_repository_1.PrismaOAuthSigningKeyRepository,
+    { provide: nestjs_oauth_1.OAUTH_SIGNING_KEY_REPOSITORY, useExisting: prisma_oauth_signing_key_repository_1.PrismaOAuthSigningKeyRepository },
+    prisma_oauth_device_code_repository_1.PrismaOAuthDeviceCodeRepository,
+    { provide: nestjs_oauth_1.OAUTH_DEVICE_CODE_REPOSITORY, useExisting: prisma_oauth_device_code_repository_1.PrismaOAuthDeviceCodeRepository },
+    prisma_oauth_pushed_request_repository_1.PrismaOAuthPushedRequestRepository,
+    { provide: nestjs_oauth_1.OAUTH_PUSHED_REQUEST_REPOSITORY, useExisting: prisma_oauth_pushed_request_repository_1.PrismaOAuthPushedRequestRepository },
+    prisma_signing_key_provider_1.PrismaSigningKeyProvider,
+    { provide: nestjs_oauth_1.SIGNING_KEY_PROVIDER, useExisting: prisma_signing_key_provider_1.PrismaSigningKeyProvider },
+    prisma_consent_logout_target_resolver_1.PrismaConsentLogoutTargetResolver,
+];
+const OAUTH_PRISMA_EXPORTS = [
+    nestjs_oauth_1.OAUTH_CLIENT_REPOSITORY,
+    nestjs_oauth_1.OAUTH_SCOPE_REPOSITORY,
+    nestjs_oauth_1.OAUTH_AUTH_CODE_REPOSITORY,
+    nestjs_oauth_1.OAUTH_ACCESS_TOKEN_REPOSITORY,
+    nestjs_oauth_1.OAUTH_REFRESH_TOKEN_REPOSITORY,
+    nestjs_oauth_1.OAUTH_CONSENT_REPOSITORY,
+    nestjs_oauth_1.OAUTH_SIGNING_KEY_REPOSITORY,
+    nestjs_oauth_1.OAUTH_DEVICE_CODE_REPOSITORY,
+    nestjs_oauth_1.OAUTH_PUSHED_REQUEST_REPOSITORY,
+    nestjs_oauth_1.SIGNING_KEY_PROVIDER,
+    prisma_consent_logout_target_resolver_1.PrismaConsentLogoutTargetResolver,
+];
+let OAuthPrismaModule = OAuthPrismaModule_1 = class OAuthPrismaModule {
+    static register(options) {
+        var _a;
+        return {
+            module: OAuthPrismaModule_1,
+            global: (_a = options === null || options === void 0 ? void 0 : options.global) !== null && _a !== void 0 ? _a : true,
+            providers: OAUTH_PRISMA_PROVIDERS,
+            exports: OAUTH_PRISMA_EXPORTS,
+        };
+    }
+};
+exports.OAuthPrismaModule = OAuthPrismaModule;
+exports.OAuthPrismaModule = OAuthPrismaModule = OAuthPrismaModule_1 = __decorate([
+    (0, common_1.Module)({ providers: OAUTH_PRISMA_PROVIDERS, exports: OAUTH_PRISMA_EXPORTS })
+], OAuthPrismaModule);
+//# sourceMappingURL=oauth-prisma.module.js.map

package/dist/oauth-prisma.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-prisma.module.js","sourceRoot":"","sources":["../lib/oauth-prisma.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAuE;AACvE,wDAW+B;AAC/B,qFAA+E;AAC/E,mFAA6E;AAC7E,6GAAsG;AACtG,iGAA0F;AAC1F,mGAA4F;AAC5F,uFAAiF;AACjF,+FAAwF;AACxF,+FAAwF;AACxF,qGAA8F;AAC9F,mGAA4F;AAC5F,+EAAyE;AAczE,MAAM,sBAAsB,GAAe;IACzC,4DAA2B;IAC3B,EAAE,OAAO,EAAE,sCAAuB,EAAE,WAAW,EAAE,4DAA2B,EAAE;IAC9E,0DAA0B;IAC1B,EAAE,OAAO,EAAE,qCAAsB,EAAE,WAAW,EAAE,0DAA0B,EAAE;IAC5E,mFAAsC;IACtC,EAAE,OAAO,EAAE,yCAA0B,EAAE,WAAW,EAAE,mFAAsC,EAAE;IAC5F,uEAAgC;IAChC,EAAE,OAAO,EAAE,4CAA6B,EAAE,WAAW,EAAE,uEAAgC,EAAE;IACzF,yEAAiC;IACjC,EAAE,OAAO,EAAE,6CAA8B,EAAE,WAAW,EAAE,yEAAiC,EAAE;IAC3F,8DAA4B;IAC5B,EAAE,OAAO,EAAE,uCAAwB,EAAE,WAAW,EAAE,8DAA4B,EAAE;IAChF,qEAA+B;IAC/B,EAAE,OAAO,EAAE,2CAA4B,EAAE,WAAW,EAAE,qEAA+B,EAAE;IACvF,qEAA+B;IAC/B,EAAE,OAAO,EAAE,2CAA4B,EAAE,WAAW,EAAE,qEAA+B,EAAE;IACvF,2EAAkC;IAClC,EAAE,OAAO,EAAE,8CAA+B,EAAE,WAAW,EAAE,2EAAkC,EAAE;IAC7F,sDAAwB;IACxB,EAAE,OAAO,EAAE,mCAAoB,EAAE,WAAW,EAAE,sDAAwB,EAAE;IACxE,yEAAiC;CAClC,CAAC;AAEF,MAAM,oBAAoB,GAAyB;IACjD,sCAAuB;IACvB,qCAAsB;IACtB,yCAA0B;IAC1B,4CAA6B;IAC7B,6CAA8B;IAC9B,uCAAwB;IACxB,2CAA4B;IAC5B,2CAA4B;IAC5B,8CAA+B;IAC/B,mCAAoB;IACpB,yEAAiC;CAClC,CAAC;AASK,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAC5B,MAAM,CAAC,QAAQ,CAAC,OAAoC;;QAClD,OAAO;YACL,MAAM,EAAE,mBAAiB;YACzB,MAAM,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,IAAI;YAC/B,SAAS,EAAE,sBAAsB;YACjC,OAAO,EAAE,oBAAoB;SAC9B,CAAC;IACJ,CAAC;CACF,CAAA;AATY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,eAAM,EAAC,EAAE,SAAS,EAAE,sBAAsB,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;GAChE,iBAAiB,CAS7B"}

package/dist/oauth-prisma.types.d.ts

@@ -0,0 +1,189 @@
+import type { PrismaClientLike, PrismaModelDelegate } from '@nathapp/nestjs-prisma';
+export interface OAuthClientRow {
+    id: string;
+    tenantId: string | null;
+    clientId: string;
+    clientSecretHash: string | null;
+    name: string;
+    description: string | null;
+    clientType: string;
+    redirectUris: string[];
+    postLogoutRedirectUris: string[];
+    grantTypes: string[];
+    responseTypes: string[];
+    accessTokenTtl: number;
+    refreshTokenTtl: number;
+    authCodeTtl: number;
+    pkceRequired: string;
+    requireConsent: boolean;
+    dpopBoundAccessTokens: boolean;
+    backchannelLogoutUri: string | null;
+    backchannelLogoutSessionRequired: boolean | null;
+    frontchannelLogoutUri: string | null;
+    frontchannelLogoutSessionRequired: boolean | null;
+    tokenEndpointAuthMethod: string | null;
+    jwks: unknown;
+    jwksUri: string | null;
+    tlsClientAuthSubjectDn: string | null;
+    tlsClientAuthSanDns: string[] | null;
+    tlsClientAuthSelfSignedThumbprint: string | null;
+    clientSecretHashPrevious: string | null;
+    previousSecretExpiresAt: Date | null;
+    allowedResources: string[];
+    requireResource: boolean;
+    status: number;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface OAuthScopeRelation {
+    scope: {
+        code: string;
+    };
+}
+export interface OAuthClientRelation {
+    client: {
+        clientId: string;
+    };
+}
+export interface OAuthScopesRelation {
+    scopes: OAuthScopeRelation[];
+}
+export interface OAuthAuthorizationCodeRow extends OAuthScopesRelation {
+    id: string;
+    tenantId: string | null;
+    code: string;
+    clientId: string;
+    userId: string;
+    codeChallenge: string | null;
+    codeChallengeMethod: string | null;
+    redirectUri: string;
+    state: string | null;
+    nonce: string | null;
+    expiresAt: Date;
+    usedAt: Date | null;
+    authTime: Date | null;
+    sid: string | null;
+    resource: string | null;
+    createdAt: Date;
+}
+export interface OAuthAccessTokenRow extends OAuthScopesRelation {
+    id: string;
+    tenantId: string | null;
+    tokenHash: string;
+    clientId: string;
+    userId: string | null;
+    refreshTokenId: string | null;
+    tokenType: string;
+    expiresAt: Date;
+    revokedAt: Date | null;
+    cnfJkt: string | null;
+    cnfX5tS256: string | null;
+    resource: string | null;
+    actorClientId: string | null;
+    createdAt: Date;
+}
+export interface OAuthRefreshTokenRow {
+    id: string;
+    tenantId: string | null;
+    tokenHash: string;
+    clientId: string;
+    userId: string;
+    scope: string | null;
+    previousTokenHash: string | null;
+    expiresAt: Date;
+    revokedAt: Date | null;
+    cnfJkt: string | null;
+    lastUsedAt: Date | null;
+    resource: string | null;
+    createdAt: Date;
+}
+export interface OAuthConsentRow extends OAuthClientRelation, OAuthScopesRelation {
+    id: string;
+    tenantId: string | null;
+    userId: string;
+    grantedAt: Date;
+    revokedAt: Date | null;
+}
+export interface OAuthDeviceCodeRow extends OAuthClientRelation {
+    id: string;
+    tenantId: string | null;
+    deviceCodeHash: string;
+    userCodeHash: string;
+    clientId: string;
+    scope: string | null;
+    status: string;
+    userId: string | null;
+    authTime: Date | null;
+    interval: number;
+    lastPolledAt: Date | null;
+    approvedAt: Date | null;
+    consumedAt: Date | null;
+    expiresAt: Date;
+    createdAt: Date;
+}
+export interface OAuthPushedRequestRow extends OAuthClientRelation {
+    id: string;
+    tenantId: string | null;
+    requestUriHash: string;
+    clientId: string;
+    responseType: string;
+    redirectUri: string;
+    scope: string | null;
+    state: string | null;
+    codeChallenge: string | null;
+    codeChallengeMethod: string | null;
+    nonce: string | null;
+    prompt: string | null;
+    maxAge: string | null;
+    consumedAt: Date | null;
+    resource: string | null;
+    expiresAt: Date;
+    createdAt: Date;
+}
+export interface OAuthScopeRow {
+    id: string;
+    code: string;
+    name: string;
+    description: string | null;
+    claims: unknown;
+    isSystem: boolean;
+    status: number;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface OAuthClientScopeRow {
+    clientId: string;
+    scopeId: string;
+    isDefault: boolean;
+    scope: OAuthScopeRow;
+}
+export interface OAuthSigningKeyRow {
+    id: string;
+    kid: string;
+    alg: string;
+    privateKeyPem: string;
+    publicKeyPem: string;
+    status: string;
+    createdAt: Date;
+    expiresAt: Date | null;
+    tenantId: string | null;
+}
+export type OAuthQuery = Record<string, unknown>;
+export interface OAuthPrismaDelegate<Row extends object> extends PrismaModelDelegate<Row, string> {
+    findUnique(args: OAuthQuery): Promise<Row | null>;
+    findFirst(args: OAuthQuery): Promise<Row | null>;
+    findMany<TResult extends object = Row>(args: OAuthQuery): Promise<TResult[]>;
+    create(args: OAuthQuery): Promise<Row>;
+    update(args: OAuthQuery): Promise<Row>;
+    updateMany(args: OAuthQuery): Promise<{
+        count: number;
+    }>;
+    deleteMany(args: OAuthQuery): Promise<{
+        count: number;
+    }>;
+    createMany(args: OAuthQuery): Promise<{
+        count: number;
+    }>;
+}
+export declare function asJsonObject(value: unknown): Record<string, unknown> | undefined;
+export declare function getOAuthPrismaDelegate<Row extends object>(client: PrismaClientLike, modelName: string): OAuthPrismaDelegate<Row>;