@noodleseed/one 0.63.1 → 0.65.0

package/node_modules/@noodle-borg/service/dist/oauth/service-bootstrap.js

@@ -0,0 +1,157 @@
+import { createJwtVerifier } from '@noodle-borg/auth';
+import { noopLogger } from '@noodle-borg/transport-http';
+import { createCustomerVerifierFactory } from '../customer-verifier.js';
+import { geminiEnterpriseDefaultResourceForClient } from '../gemini-enterprise-oauth.js';
+import { normalizeOAuthResource } from '../http-util.js';
+import { ensurePersonalWorkspace } from '../personal-workspace.js';
+import { PlatformPrincipalResolver } from '../platform-identity.js';
+import { PostgresPlatformIdentityStore } from '../platform-identity-postgres.js';
+import { allowedMcpBaseDomains, bridgeAuthForResource, managedSecretForResource, sealCustomerCredential, } from '../serve-resource-auth.js';
+import { createDeveloperGrantAuthorizer, resolveDeveloperGrantStore, } from './developer-grant-bootstrap.js';
+import { guardPlatformAccessTokenVerifier } from './platform-principal-guard.js';
+/** Build the co-hosted authorization server and its durable upstream-human dependencies. */
+export async function resolveServiceOAuthBootstrap(input) {
+    const { options } = input;
+    let authServerApp;
+    let resolvedVerifyOwnerToken = options.verifyOwnerToken;
+    let resolvedAuthServerIssuer = options.authServerIssuer;
+    let oauthStore;
+    let developerGrantStore = options.developerGrantStore;
+    let delegatedExchange;
+    const allowedMcpDomains = allowedMcpBaseDomains(options);
+    const rawCustomerVerifierFactory = createCustomerVerifierFactory({
+        allowInsecureLocalhost: options.customerVerifierAllowInsecureLocalhost === true,
+        ...(options.customerVerifierFirebaseJwks !== undefined
+            ? { firebaseJwks: options.customerVerifierFirebaseJwks }
+            : {}),
+        ...(options.customerVerifierFirebaseJwksUri !== undefined
+            ? { firebaseJwksUri: options.customerVerifierFirebaseJwksUri }
+            : {}),
+    });
+    if (options.oauth) {
+        if (input.pool) {
+            const { PostgresOAuthStore } = await import('./store-postgres.js');
+            const postgresOAuth = new PostgresOAuthStore(input.pool, {
+                enforcePlatformPrincipalSuspension: input.platformIdentityStore instanceof PostgresPlatformIdentityStore,
+            });
+            await postgresOAuth.ensureSchema();
+            oauthStore = postgresOAuth;
+        }
+        else {
+            const { InMemoryOAuthStore } = await import('./store.js');
+            oauthStore = new InMemoryOAuthStore();
+        }
+        developerGrantStore = await resolveDeveloperGrantStore({
+            ...(input.pool === undefined ? {} : { pool: input.pool }),
+            ...(options.developerGrantStore === undefined ? {} : { store: options.developerGrantStore }),
+        });
+        const [{ NoodleOAuthProvider }, { createOAuthApp }, { createConfiguredWorkOSHumanAuthenticator },] = await Promise.all([import('./provider.js'), import('./app.js'), import('./workos.js')]);
+        // Normalize once so the token `iss`, the verifier's expected issuer, and the PRM `authorization_servers`
+        // entry are byte-identical (a trailing-slash `PUBLIC_BASE_URL` would otherwise desync them).
+        const oauthIssuer = options.oauth.issuer.replace(/\/+$/, '');
+        const workosAuthenticator = createConfiguredWorkOSHumanAuthenticator(oauthIssuer, options.oauth.workos);
+        if (options.oauth.google === undefined && workosAuthenticator === undefined) {
+            throw new Error('self-hosted OAuth requires at least one upstream human authenticator');
+        }
+        const { reconcileConfiguredConsoleOAuthClient } = await import('./first-party-client.js');
+        await reconcileConfiguredConsoleOAuthClient(oauthStore, options.oauth.consoleClient, normalizeOAuthResource(options.publicBaseUrl ?? oauthIssuer));
+        // The same issuer/signer pair backs delegated token-exchange assertions (ADR 0152) so customer
+        // token endpoints verify them against the already-published platform JWKS.
+        delegatedExchange = { issuer: oauthIssuer, signer: options.oauth.signer };
+        const provider = new NoodleOAuthProvider({
+            issuer: oauthIssuer,
+            store: oauthStore,
+            signer: options.oauth.signer,
+            ...(options.oauth.google === undefined ? {} : { google: options.oauth.google }),
+            ...(workosAuthenticator === undefined
+                ? {}
+                : { upstreamAuthenticators: { workos: workosAuthenticator } }),
+            ...(input.platformIdentityStore === undefined
+                ? {}
+                : {
+                    platformPrincipalResolver: new PlatformPrincipalResolver(input.platformIdentityStore),
+                }),
+            customerBridgeAuthForResource: async (resource) => {
+                const registry = input.registry();
+                return registry === undefined
+                    ? undefined
+                    : bridgeAuthForResource(registry, resource, allowedMcpDomains);
+            },
+            managedSecretForResource: async (resource, name) => {
+                const registry = input.registry();
+                return registry === undefined
+                    ? undefined
+                    : managedSecretForResource(registry, resource, name, allowedMcpDomains);
+            },
+            verifyCustomerBridgeToken: async (auth, token) => {
+                const identity = await rawCustomerVerifierFactory(auth)(token, auth.projectId ?? '');
+                return identity === null ? null : { ...identity, scopes: identity.scopes ?? [] };
+            },
+            sealCustomerCredential: (credential) => sealCustomerCredential(input.secretBox, credential),
+            signupAuthorizer: input.controlPlaneStore,
+            signupMode: options.controlPlaneSignupMode ?? 'restricted',
+            deniedSignupDomains: options.deniedSignupDomains ?? [],
+            deniedSignupSubjects: options.deniedSignupSubjects ?? [],
+            ...(input.platformIdentityStore === undefined ||
+                (options.controlPlaneSignupMode ?? 'restricted') !== 'public'
+                ? {}
+                : {
+                    provisionPlatformPrincipal: async (identity) => {
+                        await ensurePersonalWorkspace(input.controlPlaneStore, {
+                            ...identity,
+                            superAdmin: false,
+                        });
+                    },
+                }),
+            developerGrantAuthorizer: createDeveloperGrantAuthorizer({
+                controlPlane: input.controlPlaneStore,
+                grants: developerGrantStore,
+                registry: input.registry,
+            }),
+            logger: options.logger ?? noopLogger,
+            defaultResourceForClient: (client) => geminiEnterpriseDefaultResourceForClient(client, oauthIssuer),
+            ...(options.oauth.allowedEmailDomain !== undefined
+                ? { allowedEmailDomain: options.oauth.allowedEmailDomain }
+                : {}),
+            ...(options.oauth.refreshTokenGraceSeconds !== undefined
+                ? { refreshTokenGraceSeconds: options.oauth.refreshTokenGraceSeconds }
+                : {}),
+            ...(options.oauth.refreshTokenRecoverySeconds !== undefined
+                ? { refreshTokenRecoverySeconds: options.oauth.refreshTokenRecoverySeconds }
+                : {}),
+            ...(input.platformAuth.rolloutStore === undefined
+                ? {}
+                : { upstreamRolloutStore: input.platformAuth.rolloutStore }),
+        });
+        authServerApp = createOAuthApp(provider, {
+            trustProxy: options.tls?.trustProxy === true,
+        });
+        resolvedAuthServerIssuer = resolvedAuthServerIssuer ?? oauthIssuer;
+        // Resource-server verification uses the AS signing key directly (co-hosted, same process), so an
+        // owner-only endpoint validates tokens without an HTTP JWKS fetch. Multi-instance-safe because the key is
+        // shared via env.
+        resolvedVerifyOwnerToken =
+            resolvedVerifyOwnerToken ??
+                createJwtVerifier({
+                    issuer: oauthIssuer,
+                    keyResolver: await options.oauth.signer.verifierKey(),
+                });
+    }
+    if (resolvedVerifyOwnerToken !== undefined && input.platformIdentityStore !== undefined) {
+        resolvedVerifyOwnerToken = guardPlatformAccessTokenVerifier(resolvedVerifyOwnerToken, new PlatformPrincipalResolver(input.platformIdentityStore));
+    }
+    return {
+        rawCustomerVerifierFactory,
+        ...(authServerApp === undefined ? {} : { authServerApp }),
+        ...(resolvedVerifyOwnerToken === undefined
+            ? {}
+            : { verifyOwnerToken: resolvedVerifyOwnerToken }),
+        ...(resolvedAuthServerIssuer === undefined
+            ? {}
+            : { authServerIssuer: resolvedAuthServerIssuer }),
+        ...(oauthStore === undefined ? {} : { oauthStore }),
+        ...(developerGrantStore === undefined ? {} : { developerGrantStore }),
+        ...(delegatedExchange === undefined ? {} : { delegatedExchange }),
+    };
+}
+//# sourceMappingURL=service-bootstrap.js.map

package/node_modules/@noodle-borg/service/dist/oauth/service-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-bootstrap.js","sourceRoot":"","sources":["../../src/oauth/service-bootstrap.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAA2B,MAAM,mBAAmB,CAAC;AAE/E,OAAO,EAAE,UAAU,EAA2B,MAAM,6BAA6B,CAAC;AAElF,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAA8B,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAGjF,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AAajF,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAQlD;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IAAI,aAAgF,CAAC;IACrF,IAAI,wBAAwB,GAAmC,OAAO,CAAC,gBAAgB,CAAC;IACxF,IAAI,wBAAwB,GAAuB,OAAO,CAAC,gBAAgB,CAAC;IAC5E,IAAI,UAAkC,CAAC;IACvC,IAAI,mBAAmB,GAAoC,OAAO,CAAC,mBAAmB,CAAC;IACvF,IAAI,iBAA6E,CAAC;IAClF,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,0BAA0B,GAAG,6BAA6B,CAAC;QAC/D,sBAAsB,EAAE,OAAO,CAAC,sCAAsC,KAAK,IAAI;QAC/E,GAAG,CAAC,OAAO,CAAC,4BAA4B,KAAK,SAAS;YACpD,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,4BAA4B,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,+BAA+B,KAAK,SAAS;YACvD,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,+BAA+B,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACnE,MAAM,aAAa,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE;gBACvD,kCAAkC,EAChC,KAAK,CAAC,qBAAqB,YAAY,6BAA6B;aACvE,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,YAAY,EAAE,CAAC;YACnC,UAAU,GAAG,aAAa,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1D,UAAU,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACxC,CAAC;QACD,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;YACrD,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACzD,GAAG,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;SAC7F,CAAC,CAAC;QACH,MAAM,CACJ,EAAE,mBAAmB,EAAE,EACvB,EAAE,cAAc,EAAE,EAClB,EAAE,wCAAwC,EAAE,EAC7C,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC5F,yGAAyG;QACzG,6FAA6F;QAC7F,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,mBAAmB,GAAG,wCAAwC,CAClE,WAAW,EACX,OAAO,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC;QACF,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,EAAE,qCAAqC,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC1F,MAAM,qCAAqC,CACzC,UAAU,EACV,OAAO,CAAC,KAAK,CAAC,aAAa,EAC3B,sBAAsB,CAAC,OAAO,CAAC,aAAa,IAAI,WAAW,CAAC,CAC7D,CAAC;QACF,+FAA+F;QAC/F,2EAA2E;QAC3E,iBAAiB,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC;YACvC,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC5B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/E,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,sBAAsB,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC;YAChE,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,yBAAyB,EAAE,IAAI,yBAAyB,CAAC,KAAK,CAAC,qBAAqB,CAAC;iBACtF,CAAC;YACN,6BAA6B,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAClC,OAAO,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;YACnE,CAAC;YACD,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAClC,OAAO,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAC5E,CAAC;YACD,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC/C,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;gBACrF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACnF,CAAC;YACD,sBAAsB,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC;YAC3F,gBAAgB,EAAE,KAAK,CAAC,iBAAiB;YACzC,UAAU,EAAE,OAAO,CAAC,sBAAsB,IAAI,YAAY;YAC1D,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,EAAE;YACtD,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,EAAE;YACxD,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS;gBAC7C,CAAC,OAAO,CAAC,sBAAsB,IAAI,YAAY,CAAC,KAAK,QAAQ;gBAC3D,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,0BAA0B,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;wBAC7C,MAAM,uBAAuB,CAAC,KAAK,CAAC,iBAAiB,EAAE;4BACrD,GAAG,QAAQ;4BACX,UAAU,EAAE,KAAK;yBAClB,CAAC,CAAC;oBACL,CAAC;iBACF,CAAC;YACN,wBAAwB,EAAE,8BAA8B,CAAC;gBACvD,YAAY,EAAE,KAAK,CAAC,iBAAiB;gBACrC,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC;YACF,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,UAAU;YACpC,wBAAwB,EAAE,CAAC,MAAM,EAAE,EAAE,CACnC,wCAAwC,CAAC,MAAM,EAAE,WAAW,CAAC;YAC/D,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;gBAChD,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;gBAC1D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,KAAK,SAAS;gBACtD,CAAC,CAAC,EAAE,wBAAwB,EAAE,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBACtE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,KAAK,SAAS;gBACzD,CAAC,CAAC,EAAE,2BAA2B,EAAE,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC5E,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,aAAa,GAAG,cAAc,CAAC,QAAQ,EAAE;YACvC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,KAAK,IAAI;SAC7C,CAAwD,CAAC;QAC1D,wBAAwB,GAAG,wBAAwB,IAAI,WAAW,CAAC;QACnE,iGAAiG;QACjG,0GAA0G;QAC1G,kBAAkB;QAClB,wBAAwB;YACtB,wBAAwB;gBACxB,iBAAiB,CAAC;oBAChB,MAAM,EAAE,WAAW;oBACnB,WAAW,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;iBACtD,CAAC,CAAC;IACP,CAAC;IAED,IAAI,wBAAwB,KAAK,SAAS,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACxF,wBAAwB,GAAG,gCAAgC,CACzD,wBAAwB,EACxB,IAAI,yBAAyB,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAC3D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,0BAA0B;QAC1B,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;QACzD,GAAG,CAAC,wBAAwB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;QACnD,GAAG,CAAC,wBAAwB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;QACnD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QACnD,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;QACrE,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/store-postgres-schema.d.ts

@@ -0,0 +1,4 @@
+import type { Pool } from 'pg';
+/** Creates and additively upgrades the shared OAuth authorization-server tables. */
+export declare function ensureOAuthStoreSchema(pool: Pool, enforcePlatformPrincipalSuspension: boolean): Promise<void>;
+//# sourceMappingURL=store-postgres-schema.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/store-postgres-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-postgres-schema.d.ts","sourceRoot":"","sources":["../../src/oauth/store-postgres-schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAK/B,oFAAoF;AACpF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,IAAI,EACV,kCAAkC,EAAE,OAAO,GAC1C,OAAO,CAAC,IAAI,CAAC,CA8Hf"}

package/node_modules/@noodle-borg/service/dist/oauth/store-postgres-schema.js

@@ -0,0 +1,110 @@
+import { installPlatformAuthInventorySourceFenceTriggers } from '../platform-auth-inventory-source-fence-postgres.js';
+import { ensureDeviceAuthorizationSchema } from './device-store-postgres-schema.js';
+import { ensurePlatformPrincipalSuspensionRefreshTrigger } from './platform-principal-postgres.js';
+/** Creates and additively upgrades the shared OAuth authorization-server tables. */
+export async function ensureOAuthStoreSchema(pool, enforcePlatformPrincipalSuspension) {
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_clients (
+      client_id  text PRIMARY KEY,
+      client     jsonb NOT NULL,
+      first_party_owner text,
+      created_at timestamptz NOT NULL DEFAULT now()
+    )
+  `);
+    await pool.query('ALTER TABLE oauth_clients ADD COLUMN IF NOT EXISTS first_party_owner text');
+    await pool.query(`
+    ALTER TABLE oauth_clients DROP CONSTRAINT IF EXISTS oauth_clients_first_party_owner_check;
+    ALTER TABLE oauth_clients ADD CONSTRAINT oauth_clients_first_party_owner_check
+      CHECK (first_party_owner IS NULL OR first_party_owner = 'console')
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_pending_authorizations (
+      state          text PRIMARY KEY,
+      client_id      text NOT NULL,
+      redirect_uri   text NOT NULL,
+      code_challenge text NOT NULL,
+      client_state   text,
+      resource       text NOT NULL,
+      scope          text,
+      upstream_provider text NOT NULL DEFAULT 'google',
+      expires_at     timestamptz NOT NULL
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_authorization_codes (
+      code           text PRIMARY KEY,
+      client_id      text NOT NULL,
+      code_challenge text NOT NULL,
+      redirect_uri   text NOT NULL,
+      resource       text NOT NULL,
+      owner_subject  text NOT NULL,
+      owner_email    text,
+      owner_locale   text,
+      owner_time_zone text,
+      scope          text,
+      identity_kind  text,
+      identity_provider text,
+      developer_grant_id text,
+      expires_at     timestamptz NOT NULL
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
+      token         text PRIMARY KEY,
+      client_id     text NOT NULL,
+      owner_subject text NOT NULL,
+      owner_email   text,
+      owner_locale  text,
+      owner_time_zone text,
+      resource      text NOT NULL,
+      scope         text,
+      identity_kind text,
+      identity_provider text,
+      developer_grant_id text,
+      expires_at    timestamptz NOT NULL,
+      family_id     text,
+      rotated_at    timestamptz,
+      superseded_by text
+    )
+  `);
+    if (enforcePlatformPrincipalSuspension) {
+        await ensurePlatformPrincipalSuspensionRefreshTrigger(pool);
+    }
+    await pool.query("ALTER TABLE oauth_pending_authorizations ADD COLUMN IF NOT EXISTS upstream_provider text NOT NULL DEFAULT 'google'");
+    await pool.query('ALTER TABLE oauth_authorization_codes ADD COLUMN IF NOT EXISTS identity_kind text');
+    await pool.query('ALTER TABLE oauth_authorization_codes ADD COLUMN IF NOT EXISTS owner_locale text');
+    await pool.query('ALTER TABLE oauth_authorization_codes ADD COLUMN IF NOT EXISTS owner_time_zone text');
+    await pool.query('ALTER TABLE oauth_authorization_codes ADD COLUMN IF NOT EXISTS identity_provider text');
+    await pool.query('ALTER TABLE oauth_authorization_codes ADD COLUMN IF NOT EXISTS developer_grant_id text');
+    await pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS identity_kind text');
+    await pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS owner_locale text');
+    await pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS owner_time_zone text');
+    await pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS identity_provider text');
+    await pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS developer_grant_id text');
+    await pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS family_id text');
+    await pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS rotated_at timestamptz');
+    await pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS superseded_by text');
+    await pool.query('CREATE INDEX IF NOT EXISTS oauth_refresh_tokens_family_id_idx ON oauth_refresh_tokens (family_id)');
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_consent_grants (
+      client_id     text NOT NULL,
+      owner_subject text NOT NULL,
+      resource      text NOT NULL,
+      granted_at    timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (client_id, owner_subject, resource)
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_delegated_credentials (
+      resource   text NOT NULL,
+      provider   text NOT NULL,
+      subject    text NOT NULL,
+      credential jsonb NOT NULL,
+      updated_at timestamptz NOT NULL,
+      PRIMARY KEY (resource, provider, subject)
+    )
+  `);
+    await ensureDeviceAuthorizationSchema(pool);
+    await installPlatformAuthInventorySourceFenceTriggers(pool);
+}
+//# sourceMappingURL=store-postgres-schema.js.map

package/node_modules/@noodle-borg/service/dist/oauth/store-postgres-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-postgres-schema.js","sourceRoot":"","sources":["../../src/oauth/store-postgres-schema.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+CAA+C,EAAE,MAAM,qDAAqD,CAAC;AACtH,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,+CAA+C,EAAE,MAAM,kCAAkC,CAAC;AAEnG,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAU,EACV,kCAA2C;IAE3C,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;GAOhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC9F,MAAM,IAAI,CAAC,KAAK,CAAC;;;;GAIhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;GAYhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;GAiBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;GAkBhB,CAAC,CAAC;IACH,IAAI,kCAAkC,EAAE,CAAC;QACvC,MAAM,+CAA+C,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,CAAC,KAAK,CACd,oHAAoH,CACrH,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,mFAAmF,CACpF,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,kFAAkF,CACnF,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,qFAAqF,CACtF,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,uFAAuF,CACxF,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,wFAAwF,CACzF,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;IACjG,MAAM,IAAI,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAChG,MAAM,IAAI,CAAC,KAAK,CACd,gFAAgF,CACjF,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,kFAAkF,CACnF,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CACd,mFAAmF,CACpF,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC7F,MAAM,IAAI,CAAC,KAAK,CACd,kFAAkF,CACnF,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;IACjG,MAAM,IAAI,CAAC,KAAK,CACd,mGAAmG,CACpG,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;GAQhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;GAShB,CAAC,CAAC;IACH,MAAM,+BAA+B,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,+CAA+C,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/store-postgres.d.ts

@@ -2,8 +2,7 @@ import type { OAuthClientInformationFull } from '@modelcontextprotocol/sdk/share
 import type { Pool } from 'pg';
 import type { DeviceAuthorizationIdentity, DeviceAuthorizationPoll, DeviceAuthorizationRecord, DeviceBrowserSessionRecord } from './device-store.js';
 import type { AuthorizationCodeRecord, ConsentGrantRecord, DelegatedCredentialLookup, DelegatedCredentialRecord, OAuthStore, PendingAuthorizationRecord, RefreshRotation, RefreshRotationInput, RefreshTokenRecord } from './store.js';
-/**
- * Relational {@link OAuthStore} for the self-hosted authorization server (OA-2,
+/** Relational {@link OAuthStore} for the self-hosted authorization server (OA-2,
  * [ADR 0042](../../../../docs/decisions/0042-self-hosted-oauth-authorization-server.md)). Shares the injected
  * `pg.Pool` with {@link PostgresArtifactStore} so the AS state lives in the same strongly-consistent store
  * that backs deployments — any Cloud Run instance can complete a flow another started.
@@ -14,13 +13,16 @@ import type { AuthorizationCodeRecord, ConsentGrantRecord, DelegatedCredentialLo
  */
 export declare class PostgresOAuthStore implements OAuthStore {
     #private;
-    constructor(pool: Pool);
+    constructor(pool: Pool, options?: {
+        readonly enforcePlatformPrincipalSuspension?: boolean;
+    });
     /** Create the OAuth tables if absent (idempotent). Run once at startup before serving AS endpoints. */
     ensureSchema(): Promise<void>;
     getClient(clientId: string): Promise<OAuthClientInformationFull | undefined>;
     putClient(client: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
+    putFirstPartyClient(owner: 'console', client: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
     createPendingAuthorization(record: PendingAuthorizationRecord): Promise<void>;
-    consumePendingAuthorization(state: string): Promise<PendingAuthorizationRecord | undefined>;
+    consumePendingAuthorization(state: string, expectedUpstreamProvider: PendingAuthorizationRecord['upstreamProvider']): Promise<PendingAuthorizationRecord | undefined>;
     createAuthorizationCode(record: AuthorizationCodeRecord): Promise<void>;
     getAuthorizationCode(code: string): Promise<AuthorizationCodeRecord | undefined>;
     redeemAuthorizationCode(code: string): Promise<AuthorizationCodeRecord | undefined>;
@@ -38,6 +40,7 @@ export declare class PostgresOAuthStore implements OAuthStore {
     }): Promise<DeviceAuthorizationPoll>;
     completeDeviceTokenIssuance(deviceCode: string, clientId: string): Promise<boolean>;
     createRefreshToken(record: RefreshTokenRecord): Promise<void>;
+    getRefreshToken(token: string): Promise<RefreshTokenRecord | undefined>;
     consumeRefreshToken(token: string): Promise<RefreshTokenRecord | undefined>;
     createConsentGrant(grant: ConsentGrantRecord): Promise<void>;
     hasConsentGrant(clientId: string, ownerSubject: string, resource: string): Promise<boolean>;

package/node_modules/@noodle-borg/service/dist/oauth/store-postgres.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-postgres.d.ts","sourceRoot":"","sources":["../../src/oauth/store-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAC3C,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EACV,uBAAuB,EACvB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,0BAA0B,EAE1B,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,UAAU;;gBAGvC,IAAI,EAAE,IAAI;IAItB,uGAAuG;IACjG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IA0H7B,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAQ5E,SAAS,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC;IASlF,0BAA0B,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB7E,2BAA2B,CAC/B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAmB5C,uBAAuB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BvE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAShF,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAUnF,yBAAyB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB3E,gCAAgC,CACpC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC;IAS3C,0BAA0B,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB7E,2BAA2B,CAC/B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAU5C,0BAA0B,CAC9B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,2BAA2B,GACpC,OAAO,CAAC,OAAO,CAAC;IAqBb,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS7D,uBAAuB,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA8D9B,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASnF,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB7D,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAU3E,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5D,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IASb,sBAAsB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxE,sBAAsB,CAC1B,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC;IAkBjD;;;;OAIG;IACG,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;CAkHhF"}
+{"version":3,"file":"store-postgres.d.ts","sourceRoot":"","sources":["../../src/oauth/store-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAC3C,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,mBAAmB,CAAC;AAS3B,OAAO,KAAK,EACV,uBAAuB,EACvB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,0BAA0B,EAE1B,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAGpB;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,YAAW,UAAU;;gBAIvC,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE;QAAE,QAAQ,CAAC,kCAAkC,CAAC,EAAE,OAAO,CAAA;KAAO;IAK/F,uGAAuG;IACjG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAQ5E,SAAS,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAclF,mBAAmB,CACvB,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC;IAehC,0BAA0B,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB7E,2BAA2B,CAC/B,KAAK,EAAE,MAAM,EACb,wBAAwB,EAAE,0BAA0B,CAAC,kBAAkB,CAAC,GACvE,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAsB5C,uBAAuB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BvE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAShF,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAUnF,yBAAyB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB3E,gCAAgC,CACpC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC;IAS3C,0BAA0B,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB7E,2BAA2B,CAC/B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAU5C,0BAA0B,CAC9B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,2BAA2B,GACpC,OAAO,CAAC,OAAO,CAAC;IAqBb,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS7D,uBAAuB,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA8D9B,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASnF,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB7D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAUvE,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAU3E,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5D,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IASb,sBAAsB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxE,sBAAsB,CAC1B,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC;IAkBjD;;;;OAIG;IACG,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;CA2HhF"}

package/node_modules/@noodle-borg/service/dist/oauth/store-postgres.js

@@ -1,7 +1,8 @@
-import { ensureDeviceAuthorizationSchema } from './device-store-postgres-schema.js';
 import { deviceBrowserRowToRecord, deviceRowToRecord, } from './device-store-postgres-types.js';
-/**
- * Relational {@link OAuthStore} for the self-hosted authorization server (OA-2,
+import { lockAndAssertPlatformRefreshPrincipal } from './platform-principal-postgres.js';
+import { postgresEpochSeconds, postgresTimestampIsLive } from './postgres-time.js';
+import { ensureOAuthStoreSchema } from './store-postgres-schema.js';
+/** Relational {@link OAuthStore} for the self-hosted authorization server (OA-2,
  * [ADR 0042](../../../../docs/decisions/0042-self-hosted-oauth-authorization-server.md)). Shares the injected
  * `pg.Pool` with {@link PostgresArtifactStore} so the AS state lives in the same strongly-consistent store
  * that backs deployments — any Cloud Run instance can complete a flow another started.
@@ -12,116 +13,44 @@ import { deviceBrowserRowToRecord, deviceRowToRecord, } from './device-store-pos
  */
 export class PostgresOAuthStore {
     #pool;
-    constructor(pool) {
+    #enforcePlatformPrincipalSuspension;
+    constructor(pool, options = {}) {
         this.#pool = pool;
+        this.#enforcePlatformPrincipalSuspension = options.enforcePlatformPrincipalSuspension === true;
     }
     /** Create the OAuth tables if absent (idempotent). Run once at startup before serving AS endpoints. */
     async ensureSchema() {
-        await this.#pool.query(`
-      CREATE TABLE IF NOT EXISTS oauth_clients (
-        client_id  text PRIMARY KEY,
-        client     jsonb NOT NULL,
-        created_at timestamptz NOT NULL DEFAULT now()
-      )
-    `);
-        await this.#pool.query(`
-      CREATE TABLE IF NOT EXISTS oauth_pending_authorizations (
-        state          text PRIMARY KEY,
-        client_id      text NOT NULL,
-        redirect_uri   text NOT NULL,
-        code_challenge text NOT NULL,
-        client_state   text,
-        resource       text NOT NULL,
-        scope          text,
-        expires_at     timestamptz NOT NULL
-      )
-    `);
-        await this.#pool.query(`
-      CREATE TABLE IF NOT EXISTS oauth_authorization_codes (
-        code           text PRIMARY KEY,
-        client_id      text NOT NULL,
-        code_challenge text NOT NULL,
-        redirect_uri   text NOT NULL,
-        resource       text NOT NULL,
-        owner_subject  text NOT NULL,
-        owner_email    text,
-        owner_locale   text,
-        owner_time_zone text,
-        scope          text,
-        identity_kind  text,
-        identity_provider text,
-        developer_grant_id text,
-        expires_at     timestamptz NOT NULL
-      )
-    `);
-        await this.#pool.query(`
-      CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
-        token         text PRIMARY KEY,
-        client_id     text NOT NULL,
-        owner_subject text NOT NULL,
-        owner_email   text,
-        owner_locale  text,
-        owner_time_zone text,
-        resource      text NOT NULL,
-        scope         text,
-        identity_kind text,
-        identity_provider text,
-        developer_grant_id text,
-        expires_at    timestamptz NOT NULL,
-        family_id     text,
-        rotated_at    timestamptz,
-        superseded_by text
-      )
-    `);
-        await this.#pool.query('ALTER TABLE oauth_authorization_codes ADD COLUMN IF NOT EXISTS identity_kind text');
-        await this.#pool.query('ALTER TABLE oauth_authorization_codes ADD COLUMN IF NOT EXISTS owner_locale text');
-        await this.#pool.query('ALTER TABLE oauth_authorization_codes ADD COLUMN IF NOT EXISTS owner_time_zone text');
-        await this.#pool.query('ALTER TABLE oauth_authorization_codes ADD COLUMN IF NOT EXISTS identity_provider text');
-        await this.#pool.query('ALTER TABLE oauth_authorization_codes ADD COLUMN IF NOT EXISTS developer_grant_id text');
-        await this.#pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS identity_kind text');
-        await this.#pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS owner_locale text');
-        await this.#pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS owner_time_zone text');
-        await this.#pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS identity_provider text');
-        await this.#pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS developer_grant_id text');
-        // Rotation hardening columns + family index (idempotent; covers tables created before this change).
-        await this.#pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS family_id text');
-        await this.#pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS rotated_at timestamptz');
-        await this.#pool.query('ALTER TABLE oauth_refresh_tokens ADD COLUMN IF NOT EXISTS superseded_by text');
-        await this.#pool.query('CREATE INDEX IF NOT EXISTS oauth_refresh_tokens_family_id_idx ON oauth_refresh_tokens (family_id)');
-        await this.#pool.query(`
-      CREATE TABLE IF NOT EXISTS oauth_consent_grants (
-        client_id     text NOT NULL,
-        owner_subject text NOT NULL,
-        resource      text NOT NULL,
-        granted_at    timestamptz NOT NULL DEFAULT now(),
-        PRIMARY KEY (client_id, owner_subject, resource)
-      )
-    `);
-        await this.#pool.query(`
-      CREATE TABLE IF NOT EXISTS oauth_delegated_credentials (
-        resource   text NOT NULL,
-        provider   text NOT NULL,
-        subject    text NOT NULL,
-        credential jsonb NOT NULL,
-        updated_at timestamptz NOT NULL,
-        PRIMARY KEY (resource, provider, subject)
-      )
-    `);
-        await ensureDeviceAuthorizationSchema(this.#pool);
+        await ensureOAuthStoreSchema(this.#pool, this.#enforcePlatformPrincipalSuspension);
     }
     async getClient(clientId) {
         const { rows } = await this.#pool.query('SELECT client FROM oauth_clients WHERE client_id = $1', [clientId]);
         return rows[0]?.client;
     }
     async putClient(client) {
-        await this.#pool.query(`INSERT INTO oauth_clients (client_id, client) VALUES ($1, $2::jsonb)
-       ON CONFLICT (client_id) DO UPDATE SET client = EXCLUDED.client`, [client.client_id, JSON.stringify(client)]);
+        const result = await this.#pool.query(`INSERT INTO oauth_clients (client_id, client) VALUES ($1, $2::jsonb)
+       ON CONFLICT (client_id) DO UPDATE SET client = EXCLUDED.client
+         WHERE oauth_clients.first_party_owner IS NULL
+       RETURNING client_id`, [client.client_id, JSON.stringify(client)]);
+        if (result.rows[0] === undefined) {
+            throw new Error('OAuth client ID is reserved by a first-party client');
+        }
+        return client;
+    }
+    async putFirstPartyClient(owner, client) {
+        const result = await this.#pool.query(`INSERT INTO oauth_clients (client_id, client, first_party_owner)
+       VALUES ($1, $2::jsonb, $3)
+       ON CONFLICT (client_id) DO UPDATE SET client = EXCLUDED.client
+         WHERE oauth_clients.first_party_owner = EXCLUDED.first_party_owner
+       RETURNING client_id`, [client.client_id, JSON.stringify(client), owner]);
+        if (result.rows[0] === undefined) {
+            throw new Error('OAuth client ID is already registered through DCR');
+        }
         return client;
     }
     async createPendingAuthorization(record) {
         await this.#pool.query(`INSERT INTO oauth_pending_authorizations
-         (state, client_id, redirect_uri, code_challenge, client_state, resource, scope, expires_at)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, to_timestamp($8))`, [
+         (state, client_id, redirect_uri, code_challenge, client_state, resource, scope, upstream_provider, expires_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, to_timestamp($9))`, [
             record.state,
             record.clientId,
             record.redirectUri,
@@ -129,13 +58,16 @@ export class PostgresOAuthStore {
             record.clientState ?? null,
             record.resource,
             record.scope ?? null,
+            record.upstreamProvider,
             record.expiresAt,
         ]);
     }
-    async consumePendingAuthorization(state) {
-        const { rows } = await this.#pool.query('DELETE FROM oauth_pending_authorizations WHERE state = $1 RETURNING *', [state]);
+    async consumePendingAuthorization(state, expectedUpstreamProvider) {
+        const { rows } = await this.#pool.query(`DELETE FROM oauth_pending_authorizations
+        WHERE state = $1 AND upstream_provider = $2
+        RETURNING *`, [state, expectedUpstreamProvider]);
         const row = rows[0];
-        if (!row || !live(row.expires_at))
+        if (!row || !postgresTimestampIsLive(row.expires_at))
             return undefined;
         return {
             state: row.state,
@@ -145,7 +77,8 @@ export class PostgresOAuthStore {
             ...(row.client_state !== null ? { clientState: row.client_state } : {}),
             resource: row.resource,
             ...(row.scope !== null ? { scope: row.scope } : {}),
-            expiresAt: epochSeconds(row.expires_at),
+            upstreamProvider: row.upstream_provider,
+            expiresAt: postgresEpochSeconds(row.expires_at),
         };
     }
     async createAuthorizationCode(record) {
@@ -178,7 +111,7 @@ export class PostgresOAuthStore {
     async redeemAuthorizationCode(code) {
         const { rows } = await this.#pool.query('DELETE FROM oauth_authorization_codes WHERE code = $1 RETURNING *', [code]);
         const row = rows[0];
-        if (!row || !live(row.expires_at))
+        if (!row || !postgresTimestampIsLive(row.expires_at))
             return undefined;
         return authCodeRowToRecord(row);
     }
@@ -218,7 +151,7 @@ export class PostgresOAuthStore {
     async consumeDeviceBrowserSession(state) {
         const { rows } = await this.#pool.query('DELETE FROM oauth_device_browser_sessions WHERE state = $1 RETURNING *', [state]);
         const row = rows[0];
-        if (row === undefined || !live(row.expires_at))
+        if (row === undefined || !postgresTimestampIsLive(row.expires_at))
             return undefined;
         return deviceBrowserRowToRecord(row);
     }
@@ -250,7 +183,7 @@ export class PostgresOAuthStore {
             await client.query('BEGIN');
             const { rows } = await client.query('SELECT * FROM oauth_device_authorizations WHERE device_code = $1 FOR UPDATE', [input.deviceCode]);
             const row = rows[0];
-            if (row === undefined || epochSeconds(row.expires_at) <= input.nowSeconds) {
+            if (row === undefined || postgresEpochSeconds(row.expires_at) <= input.nowSeconds) {
                 if (row !== undefined) {
                     await client.query('DELETE FROM oauth_device_authorizations WHERE device_code = $1', [
                         input.deviceCode,
@@ -275,7 +208,7 @@ export class PostgresOAuthStore {
                     ? { status: 'access_denied' }
                     : { status: 'approved', record: deviceRowToRecord(row) };
             }
-            if (epochSeconds(row.next_poll_at) > input.nowSeconds) {
+            if (postgresEpochSeconds(row.next_poll_at) > input.nowSeconds) {
                 await client.query(`UPDATE oauth_device_authorizations
               SET next_poll_at = next_poll_at + (interval_seconds * interval '1 second')
             WHERE device_code = $1`, [input.deviceCode]);
@@ -321,10 +254,17 @@ export class PostgresOAuthStore {
             record.familyId ?? null,
         ]);
     }
+    async getRefreshToken(token) {
+        const { rows } = await this.#pool.query('SELECT * FROM oauth_refresh_tokens WHERE token = $1', [token]);
+        const row = rows[0];
+        if (!row || !postgresTimestampIsLive(row.expires_at))
+            return undefined;
+        return refreshRowToRecord(row);
+    }
     async consumeRefreshToken(token) {
         const { rows } = await this.#pool.query('DELETE FROM oauth_refresh_tokens WHERE token = $1 RETURNING *', [token]);
         const row = rows[0];
-        if (!row || !live(row.expires_at))
+        if (!row || !postgresTimestampIsLive(row.expires_at))
             return undefined;
         return refreshRowToRecord(row);
     }
@@ -375,7 +315,16 @@ export class PostgresOAuthStore {
         const client = await this.#pool.connect();
         try {
             await client.query('BEGIN');
-            // 1) Atomic claim: succeeds only for a live, not-yet-rotated token owned by this client.
+            if (this.#enforcePlatformPrincipalSuspension) {
+                const status = await lockAndAssertPlatformRefreshPrincipal(client, {
+                    oldTokenHash,
+                    clientId,
+                });
+                if (status !== 'continue') {
+                    await client.query('COMMIT');
+                    return { status };
+                }
+            }
             const claimed = await client.query(`UPDATE oauth_refresh_tokens
             SET rotated_at = to_timestamp($2), superseded_by = $3
           WHERE token = $1 AND client_id = $4 AND rotated_at IS NULL AND expires_at > to_timestamp($5)
@@ -394,12 +343,12 @@ export class PostgresOAuthStore {
                 await client.query('COMMIT');
                 return { status: 'unknown' };
             }
-            if (nowSeconds - epochSeconds(row.rotated_at) <= graceSeconds) {
+            if (nowSeconds - postgresEpochSeconds(row.rotated_at) <= graceSeconds) {
                 await this.#insertSuccessor(client, row, newTokenHash, newExpiresAt, clientId);
                 await client.query('COMMIT');
                 return { status: 'grace', identity: rowIdentity(row) };
             }
-            if (nowSeconds - epochSeconds(row.rotated_at) <= recoverySeconds &&
+            if (nowSeconds - postgresEpochSeconds(row.rotated_at) <= recoverySeconds &&
                 row.superseded_by !== null) {
                 const successor = await client.query(`SELECT * FROM oauth_refresh_tokens
             WHERE token = $1 AND client_id = $2 AND rotated_at IS NULL AND expires_at > to_timestamp($3)
@@ -469,9 +418,9 @@ function refreshRowToRecord(row) {
         ...(row.identity_kind !== null ? { identityKind: row.identity_kind } : {}),
         ...(row.identity_provider !== null ? { identityProvider: row.identity_provider } : {}),
         ...(row.developer_grant_id !== null ? { developerGrantId: row.developer_grant_id } : {}),
-        expiresAt: epochSeconds(row.expires_at),
+        expiresAt: postgresEpochSeconds(row.expires_at),
         ...(row.family_id !== null ? { familyId: row.family_id } : {}),
-        ...(row.rotated_at !== null ? { rotatedAt: epochSeconds(row.rotated_at) } : {}),
+        ...(row.rotated_at !== null ? { rotatedAt: postgresEpochSeconds(row.rotated_at) } : {}),
         ...(row.superseded_by !== null ? { supersededBy: row.superseded_by } : {}),
     };
 }
@@ -509,13 +458,7 @@ function authCodeRowToRecord(row) {
         ...(row.identity_kind !== null ? { identityKind: row.identity_kind } : {}),
         ...(row.identity_provider !== null ? { identityProvider: row.identity_provider } : {}),
         ...(row.developer_grant_id !== null ? { developerGrantId: row.developer_grant_id } : {}),
-        expiresAt: epochSeconds(row.expires_at),
+        expiresAt: postgresEpochSeconds(row.expires_at),
     };
 }
-function epochSeconds(date) {
-    return Math.floor(new Date(date).getTime() / 1000);
-}
-function live(expiresAt) {
-    return new Date(expiresAt).getTime() > Date.now();
-}
 //# sourceMappingURL=store-postgres.js.map