@nubisco/openbridge 1.4.2 → 1.5.2

package/dist/access.d.ts

@@ -0,0 +1,148 @@
+/**
+ * Who may use the MCP endpoint: personal tokens and OAuth grants.
+ *
+ * OpenBridge has no database, so this is one JSON file, `access.json` in the
+ * state directory, written atomically with mode 600. Only hashes of secrets are
+ * stored. The file is re-read whenever it changes on disk, so a token made with
+ * `openbridge token create` on the host works without restarting the daemon.
+ *
+ * Two scopes, and they are the whole permission model of the endpoint:
+ *
+ *   - `openbridge:read` sees devices, history, events, observations and logs.
+ *   - `openbridge:control` also runs device controls and writes HomeKit
+ *     characteristics, which move physical things (a gate, a heat pump).
+ *
+ * Control implies read. Nothing here reaches plugin installs, config, the
+ * shell or updates: those stay behind the dashboard.
+ *
+ * The OAuth half follows Tally's (tally/apps/api/src/services/oauth.service.ts):
+ * public clients only, S256 PKCE only, exact redirect matching, codes single
+ * use for five minutes, access tokens for an hour, refresh tokens rotating on
+ * every use.
+ */
+export declare const READ_SCOPE = "openbridge:read";
+export declare const CONTROL_SCOPE = "openbridge:control";
+export declare const SCOPES: readonly ["openbridge:read", "openbridge:control"];
+export type Scope = (typeof SCOPES)[number];
+export type Access = 'read' | 'control';
+/** Every OpenBridge credential starts with this, so a leaked one is recognisable on sight. */
+export declare const TOKEN_PREFIX = "obt_";
+/** The most never-approved clients held at once. Registration is unauthenticated by design. */
+export declare const MAX_UNUSED_CLIENTS = 100;
+export declare function scopesFor(access: Access): Scope[];
+export declare function accessOf(scopes: readonly string[]): Access;
+export declare function hashToken(raw: string): string;
+/** PKCE: base64url(SHA-256(verifier)), unpadded, per RFC 7636. */
+export declare function s256Challenge(verifier: string): string;
+/** https for the world, plain http only for loopback tooling (Claude Code listens on localhost). */
+export declare function acceptableRedirect(uri: string): boolean;
+/** Who made a token or approved a connector: the signed-in person, or `local` when sign-in is off. */
+export interface Owner {
+    id: string;
+    email: string | null;
+}
+/** What a credential resolves to. The MCP endpoint needs nothing else. */
+export interface Credential {
+    kind: 'personal' | 'oauth';
+    name: string;
+    scopes: Scope[];
+    owner: Owner;
+    /** Stable across refreshes, so a retried write op is recognised as the same caller. */
+    id: string;
+}
+export interface TokenPair {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    refresh_token: string;
+    scope: string;
+}
+export type TokenResult = {
+    ok: true;
+    pair: TokenPair;
+} | {
+    ok: false;
+    error: string;
+};
+export declare class AccessStore {
+    private readonly path;
+    private data;
+    private mtimeMs;
+    constructor(path: string);
+    /** Re-reads the file when it changed on disk, which is how the CLI's writes arrive. */
+    private load;
+    /** Read, change, write. The file is replaced by rename, so a reader never sees half of it. */
+    private mutate;
+    private prune;
+    /** Creates a token and returns the raw value, the only time it exists outside the caller. */
+    createToken(name: string, access: Access, owner: Owner): {
+        id: string;
+        token: string;
+    };
+    /**
+     * Every token on this bridge. A bridge is one household's: whoever can sign in
+     * to the dashboard can already open its shell, so nobody's tokens are hidden
+     * from another person who manages it.
+     */
+    listTokens(): {
+        id: string;
+        name: string;
+        access: Access;
+        owner: string | null;
+        createdAt: string;
+        lastUsedAt: string | null;
+    }[];
+    /** Deleted outright: a personal token has no refresh to refuse later. */
+    revokeToken(id: string): boolean;
+    verify(raw: string): Credential | null;
+    private touch;
+    registerClient(body: {
+        redirect_uris?: unknown;
+        client_name?: unknown;
+    }): {
+        ok: true;
+        id: string;
+        name: string;
+        uris: string[];
+    } | {
+        ok: false;
+        error: string;
+        description: string;
+    };
+    /**
+     * The client, when this exact redirect is one it registered. Exact match,
+     * never a prefix: "starts with" is the classic open redirect.
+     */
+    client(clientId: string, redirectUri: string): {
+        id: string;
+        name: string;
+    } | null;
+    issueCode(p: {
+        clientId: string;
+        redirectUri: string;
+        codeChallenge: string;
+        access: Access;
+    }, owner: Owner): string;
+    private pair;
+    /** grant_type=authorization_code. Every check here fails open if omitted. */
+    exchangeCode(get: (k: string) => string): TokenResult;
+    /** grant_type=refresh_token. Rotates, so the presented token dies here. */
+    refresh(get: (k: string) => string): TokenResult;
+    /**
+     * One row per client rather than per grant: authorising Claude twice makes
+     * two grants for what the person thinks of as one connection, and a revoke
+     * that left the sibling alive would be a revoke that did not work.
+     */
+    listConnections(): {
+        clientId: string;
+        name: string;
+        access: Access;
+        owners: string[];
+        connectedAt: string;
+        lastUsedAt: string | null;
+    }[];
+    /** Revokes every live grant of one client, including its refresh tokens. */
+    revokeConnection(clientId: string): boolean;
+}
+export declare function extractBearer(header: string | undefined): string | null;
+//# sourceMappingURL=access.d.ts.map

package/dist/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,eAAO,MAAM,UAAU,oBAAoB,CAAA;AAC3C,eAAO,MAAM,aAAa,uBAAuB,CAAA;AACjD,eAAO,MAAM,MAAM,oDAAuC,CAAA;AAC1D,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,CAAA;AAC3C,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;AAEvC,8FAA8F;AAC9F,eAAO,MAAM,YAAY,SAAS,CAAA;AAWlC,+FAA+F;AAC/F,eAAO,MAAM,kBAAkB,MAAM,CAAA;AAIrC,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,CAEjD;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAE1D;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7C;AAMD,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,oGAAoG;AACpG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQvD;AAED,sGAAsG;AACtG,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAoDD,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,GAAG,OAAO,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,KAAK,EAAE,KAAK,CAAA;IACZ,uFAAuF;IACvF,EAAE,EAAE,MAAM,CAAA;CACX;AAED,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,QAAQ,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,MAAM,WAAW,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAMtF,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,IAAI,CAAsB;IAClC,OAAO,CAAC,OAAO,CAAK;gBAES,IAAI,EAAE,MAAM;IAEzC,uFAAuF;IACvF,OAAO,CAAC,IAAI;IAsBZ,8FAA8F;IAC9F,OAAO,CAAC,MAAM;IAmBd,OAAO,CAAC,KAAK;IAWb,6FAA6F;IAC7F,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAiBtF;;;;OAIG;IACH,UAAU;;;;;;;;IAWV,yEAAyE;IACzE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAWhC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IA0BtC,OAAO,CAAC,KAAK;IAUb,cAAc,CAAC,IAAI,EAAE;QACnB,aAAa,CAAC,EAAE,OAAO,CAAA;QACvB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE;IA2B9G;;;OAGG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAQlF,SAAS,CAAC,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,KAAK,EAAE,KAAK,GAAG,MAAM;IAoBpH,OAAO,CAAC,IAAI;IAgBZ,6EAA6E;IAC7E,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,WAAW;IAgCrD,2EAA2E;IAC3E,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,WAAW;IAiBhD;;;;OAIG;IACH,eAAe;;;;;;;;IA0Cf,4EAA4E;IAC5E,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAa5C;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIvE"}

package/dist/access.js

@@ -0,0 +1,401 @@
+/**
+ * Who may use the MCP endpoint: personal tokens and OAuth grants.
+ *
+ * OpenBridge has no database, so this is one JSON file, `access.json` in the
+ * state directory, written atomically with mode 600. Only hashes of secrets are
+ * stored. The file is re-read whenever it changes on disk, so a token made with
+ * `openbridge token create` on the host works without restarting the daemon.
+ *
+ * Two scopes, and they are the whole permission model of the endpoint:
+ *
+ *   - `openbridge:read` sees devices, history, events, observations and logs.
+ *   - `openbridge:control` also runs device controls and writes HomeKit
+ *     characteristics, which move physical things (a gate, a heat pump).
+ *
+ * Control implies read. Nothing here reaches plugin installs, config, the
+ * shell or updates: those stay behind the dashboard.
+ *
+ * The OAuth half follows Tally's (tally/apps/api/src/services/oauth.service.ts):
+ * public clients only, S256 PKCE only, exact redirect matching, codes single
+ * use for five minutes, access tokens for an hour, refresh tokens rotating on
+ * every use.
+ */
+import { createHash, randomBytes, randomUUID } from 'crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'fs';
+import { dirname } from 'path';
+export const READ_SCOPE = 'openbridge:read';
+export const CONTROL_SCOPE = 'openbridge:control';
+export const SCOPES = [READ_SCOPE, CONTROL_SCOPE];
+/** Every OpenBridge credential starts with this, so a leaked one is recognisable on sight. */
+export const TOKEN_PREFIX = 'obt_';
+const PERSONAL_PREFIX = `${TOKEN_PREFIX}pat_`;
+const ACCESS_PREFIX = `${TOKEN_PREFIX}mcp_`;
+const REFRESH_PREFIX = `${TOKEN_PREFIX}ref_`;
+const CODE_PREFIX = `${TOKEN_PREFIX}code_`;
+const CODE_TTL_MS = 5 * 60 * 1000;
+const ACCESS_TTL_MS = 60 * 60 * 1000;
+const REFRESH_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/** A client that registered and was never approved is dropped after this. */
+const UNUSED_CLIENT_TTL_MS = 3 * 24 * 60 * 60 * 1000;
+/** The most never-approved clients held at once. Registration is unauthenticated by design. */
+export const MAX_UNUSED_CLIENTS = 100;
+/** lastUsedAt is written at most this often, so a busy agent does not rewrite the file per call. */
+const LAST_USED_GRANULARITY_MS = 60 * 1000;
+export function scopesFor(access) {
+    return access === 'control' ? [READ_SCOPE, CONTROL_SCOPE] : [READ_SCOPE];
+}
+export function accessOf(scopes) {
+    return scopes.includes(CONTROL_SCOPE) ? 'control' : 'read';
+}
+export function hashToken(raw) {
+    return createHash('sha256').update(raw).digest('hex');
+}
+function randomSecret(prefix) {
+    return `${prefix}${randomBytes(32).toString('base64url')}`;
+}
+/** PKCE: base64url(SHA-256(verifier)), unpadded, per RFC 7636. */
+export function s256Challenge(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+/** https for the world, plain http only for loopback tooling (Claude Code listens on localhost). */
+export function acceptableRedirect(uri) {
+    try {
+        const u = new URL(uri);
+        if (u.protocol === 'https:')
+            return true;
+        return u.protocol === 'http:' && (u.hostname === 'localhost' || u.hostname === '127.0.0.1');
+    }
+    catch {
+        return false;
+    }
+}
+const empty = () => ({ tokens: [], clients: [], codes: [], grants: [] });
+const iso = (ms) => new Date(ms).toISOString();
+const past = (at, now) => at !== null && Date.parse(at) <= now;
+export class AccessStore {
+    path;
+    data = empty();
+    mtimeMs = -1;
+    constructor(path) {
+        this.path = path;
+    }
+    /** Re-reads the file when it changed on disk, which is how the CLI's writes arrive. */
+    load() {
+        let mtime = -1;
+        try {
+            mtime = statSync(this.path).mtimeMs;
+        }
+        catch {
+            this.data = empty();
+            this.mtimeMs = -1;
+            return this.data;
+        }
+        if (mtime !== this.mtimeMs) {
+            try {
+                const parsed = JSON.parse(readFileSync(this.path, 'utf8'));
+                this.data = { ...empty(), ...parsed };
+            }
+            catch {
+                // A torn or hand-broken file grants nothing rather than crashing the daemon.
+                this.data = empty();
+            }
+            this.mtimeMs = mtime;
+        }
+        return this.data;
+    }
+    /** Read, change, write. The file is replaced by rename, so a reader never sees half of it. */
+    mutate(fn) {
+        const d = this.load();
+        const now = Date.now();
+        const out = fn(d, now);
+        this.prune(d, now);
+        const dir = dirname(this.path);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        const tmp = `${this.path}.${process.pid}.tmp`;
+        writeFileSync(tmp, JSON.stringify(d, null, 2), { mode: 0o600 });
+        try {
+            chmodSync(tmp, 0o600);
+        }
+        catch {
+            // best effort: chmod fails on non-POSIX volumes
+        }
+        renameSync(tmp, this.path);
+        this.mtimeMs = statSync(this.path).mtimeMs;
+        return out;
+    }
+    prune(d, now) {
+        d.codes = d.codes.filter((c) => !c.usedAt && !past(c.expiresAt, now));
+        d.grants = d.grants.filter((g) => !g.revokedAt && !past(g.refreshExpiresAt, now));
+        const live = new Set([...d.codes.map((c) => c.clientId), ...d.grants.map((g) => g.clientId)]);
+        d.clients = d.clients.filter((c) => c.usedAt !== null || live.has(c.id) || now - Date.parse(c.createdAt) < UNUSED_CLIENT_TTL_MS);
+    }
+    // ── Personal tokens ────────────────────────────────────────────────────────
+    /** Creates a token and returns the raw value, the only time it exists outside the caller. */
+    createToken(name, access, owner) {
+        const token = randomSecret(PERSONAL_PREFIX);
+        const id = randomUUID();
+        this.mutate((d, now) => {
+            d.tokens.push({
+                id,
+                name: name.trim().slice(0, 120) || 'Unnamed token',
+                hash: hashToken(token),
+                scopes: scopesFor(access),
+                owner,
+                createdAt: iso(now),
+                lastUsedAt: null,
+            });
+        });
+        return { id, token };
+    }
+    /**
+     * Every token on this bridge. A bridge is one household's: whoever can sign in
+     * to the dashboard can already open its shell, so nobody's tokens are hidden
+     * from another person who manages it.
+     */
+    listTokens() {
+        return this.load().tokens.map((t) => ({
+            id: t.id,
+            name: t.name,
+            access: accessOf(t.scopes),
+            owner: t.owner.email,
+            createdAt: t.createdAt,
+            lastUsedAt: t.lastUsedAt,
+        }));
+    }
+    /** Deleted outright: a personal token has no refresh to refuse later. */
+    revokeToken(id) {
+        if (!this.load().tokens.some((t) => t.id === id))
+            return false;
+        return this.mutate((d) => {
+            const before = d.tokens.length;
+            d.tokens = d.tokens.filter((t) => t.id !== id);
+            return d.tokens.length < before;
+        });
+    }
+    // ── Resolving a bearer ─────────────────────────────────────────────────────
+    verify(raw) {
+        if (!raw.startsWith(TOKEN_PREFIX))
+            return null;
+        const hash = hashToken(raw);
+        const d = this.load();
+        const now = Date.now();
+        const token = d.tokens.find((t) => t.hash === hash);
+        if (token) {
+            this.touch('tokens', token.id, token.lastUsedAt, now);
+            return { kind: 'personal', name: token.name, scopes: token.scopes, owner: token.owner, id: `token:${token.id}` };
+        }
+        if (!raw.startsWith(ACCESS_PREFIX))
+            return null;
+        const grant = d.grants.find((g) => g.accessHash === hash);
+        if (!grant || grant.revokedAt || past(grant.accessExpiresAt, now))
+            return null;
+        this.touch('grants', grant.id, grant.lastUsedAt, now);
+        const client = d.clients.find((c) => c.id === grant.clientId);
+        return {
+            kind: 'oauth',
+            name: client?.name ?? 'Connector',
+            scopes: grant.scopes,
+            owner: grant.owner,
+            id: `oauth:${grant.id}`,
+        };
+    }
+    touch(kind, id, last, now) {
+        if (last && now - Date.parse(last) < LAST_USED_GRANULARITY_MS)
+            return;
+        this.mutate((d) => {
+            const row = d[kind].find((r) => r.id === id);
+            if (row)
+                row.lastUsedAt = iso(now);
+        });
+    }
+    // ── OAuth: registration ────────────────────────────────────────────────────
+    registerClient(body) {
+        const uris = Array.isArray(body.redirect_uris)
+            ? body.redirect_uris.filter((u) => typeof u === 'string')
+            : [];
+        if (uris.length === 0 || !uris.every(acceptableRedirect)) {
+            return {
+                ok: false,
+                error: 'invalid_redirect_uri',
+                description: 'redirect_uris must be https URLs, or http on localhost',
+            };
+        }
+        const name = ((typeof body.client_name === 'string' && body.client_name.trim()) || 'Unnamed client').slice(0, 120);
+        return this.mutate((d, now) => {
+            this.prune(d, now);
+            if (d.clients.filter((c) => c.usedAt === null).length >= MAX_UNUSED_CLIENTS) {
+                return {
+                    ok: false,
+                    error: 'temporarily_unavailable',
+                    description: 'Registration is paused. Try again later.',
+                };
+            }
+            const id = randomUUID();
+            d.clients.push({ id, name, redirectUris: uris, createdAt: iso(now), usedAt: null });
+            return { ok: true, id, name, uris };
+        });
+    }
+    /**
+     * The client, when this exact redirect is one it registered. Exact match,
+     * never a prefix: "starts with" is the classic open redirect.
+     */
+    client(clientId, redirectUri) {
+        const c = this.load().clients.find((x) => x.id === clientId);
+        if (!c || !c.redirectUris.includes(redirectUri))
+            return null;
+        return { id: c.id, name: c.name };
+    }
+    // ── OAuth: code and token ──────────────────────────────────────────────────
+    issueCode(p, owner) {
+        const code = randomSecret(CODE_PREFIX);
+        this.mutate((d, now) => {
+            d.codes.push({
+                hash: hashToken(code),
+                clientId: p.clientId,
+                owner,
+                redirectUri: p.redirectUri,
+                challenge: p.codeChallenge,
+                scopes: scopesFor(p.access),
+                expiresAt: iso(now + CODE_TTL_MS),
+                usedAt: null,
+            });
+            // A person approved this client, so it is in use and is never pruned.
+            const client = d.clients.find((c) => c.id === p.clientId);
+            if (client && !client.usedAt)
+                client.usedAt = iso(now);
+        });
+        return code;
+    }
+    pair(scopes) {
+        const access = randomSecret(ACCESS_PREFIX);
+        const refresh = randomSecret(REFRESH_PREFIX);
+        return {
+            access,
+            refresh,
+            pair: {
+                access_token: access,
+                token_type: 'Bearer',
+                expires_in: Math.floor(ACCESS_TTL_MS / 1000),
+                refresh_token: refresh,
+                scope: scopes.join(' '),
+            },
+        };
+    }
+    /** grant_type=authorization_code. Every check here fails open if omitted. */
+    exchangeCode(get) {
+        const hash = hashToken(get('code'));
+        return this.mutate((d, now) => {
+            const row = d.codes.find((c) => c.hash === hash);
+            if (!row || row.usedAt || past(row.expiresAt, now))
+                return { ok: false, error: 'invalid_grant' };
+            if (row.clientId !== get('client_id'))
+                return { ok: false, error: 'invalid_grant' };
+            // Repeated here so a code minted for one target cannot be redeemed while claiming another.
+            if (row.redirectUri !== get('redirect_uri'))
+                return { ok: false, error: 'invalid_grant' };
+            // The proof. Without it the code alone is enough, which is why PKCE exists for public clients.
+            if (s256Challenge(get('code_verifier')) !== row.challenge)
+                return { ok: false, error: 'invalid_grant' };
+            // Single use. The whole read-change-write runs synchronously, so two
+            // requests racing with one code cannot both get past this line.
+            row.usedAt = iso(now);
+            const { access, refresh, pair } = this.pair(row.scopes);
+            d.grants.push({
+                id: randomUUID(),
+                clientId: row.clientId,
+                owner: row.owner,
+                accessHash: hashToken(access),
+                refreshHash: hashToken(refresh),
+                scopes: row.scopes,
+                accessExpiresAt: iso(now + ACCESS_TTL_MS),
+                refreshExpiresAt: iso(now + REFRESH_TTL_MS),
+                createdAt: iso(now),
+                lastUsedAt: null,
+                revokedAt: null,
+            });
+            return { ok: true, pair };
+        });
+    }
+    /** grant_type=refresh_token. Rotates, so the presented token dies here. */
+    refresh(get) {
+        const hash = hashToken(get('refresh_token'));
+        return this.mutate((d, now) => {
+            const row = d.grants.find((g) => g.refreshHash === hash);
+            if (!row || row.revokedAt || past(row.refreshExpiresAt, now))
+                return { ok: false, error: 'invalid_grant' };
+            if (get('client_id') && get('client_id') !== row.clientId)
+                return { ok: false, error: 'invalid_grant' };
+            const { access, refresh, pair } = this.pair(row.scopes);
+            row.accessHash = hashToken(access);
+            row.refreshHash = hashToken(refresh);
+            row.accessExpiresAt = iso(now + ACCESS_TTL_MS);
+            row.refreshExpiresAt = iso(now + REFRESH_TTL_MS);
+            return { ok: true, pair };
+        });
+    }
+    // ── Connected applications ─────────────────────────────────────────────────
+    /**
+     * One row per client rather than per grant: authorising Claude twice makes
+     * two grants for what the person thinks of as one connection, and a revoke
+     * that left the sibling alive would be a revoke that did not work.
+     */
+    listConnections() {
+        const d = this.load();
+        const now = Date.now();
+        const byClient = new Map();
+        for (const g of d.grants) {
+            if (g.revokedAt || past(g.refreshExpiresAt, now))
+                continue;
+            const app = byClient.get(g.clientId) ?? {
+                clientId: g.clientId,
+                name: d.clients.find((c) => c.id === g.clientId)?.name ?? 'Connector',
+                scopes: new Set(),
+                owners: new Set(),
+                connectedAt: g.createdAt,
+                lastUsedAt: null,
+            };
+            for (const s of g.scopes)
+                app.scopes.add(s);
+            if (g.owner.email)
+                app.owners.add(g.owner.email);
+            if (g.createdAt < app.connectedAt)
+                app.connectedAt = g.createdAt;
+            if (g.lastUsedAt && (!app.lastUsedAt || g.lastUsedAt > app.lastUsedAt))
+                app.lastUsedAt = g.lastUsedAt;
+            byClient.set(g.clientId, app);
+        }
+        return [...byClient.values()]
+            .sort((a, b) => b.connectedAt.localeCompare(a.connectedAt))
+            .map((a) => ({
+            clientId: a.clientId,
+            name: a.name,
+            access: accessOf([...a.scopes]),
+            owners: [...a.owners],
+            connectedAt: a.connectedAt,
+            lastUsedAt: a.lastUsedAt,
+        }));
+    }
+    /** Revokes every live grant of one client, including its refresh tokens. */
+    revokeConnection(clientId) {
+        if (!this.load().grants.some((g) => g.clientId === clientId && !g.revokedAt))
+            return false;
+        return this.mutate((d, now) => {
+            let n = 0;
+            for (const g of d.grants) {
+                if (g.clientId === clientId && !g.revokedAt) {
+                    g.revokedAt = iso(now);
+                    n++;
+                }
+            }
+            return n > 0;
+        });
+    }
+}
+export function extractBearer(header) {
+    if (!header)
+        return null;
+    const match = /^Bearer\s+(.+)$/i.exec(header);
+    return match ? match[1].trim() : null;
+}
+//# sourceMappingURL=access.js.map

package/dist/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AACxG,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAE9B,MAAM,CAAC,MAAM,UAAU,GAAG,iBAAiB,CAAA;AAC3C,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAA;AACjD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,UAAU,EAAE,aAAa,CAAU,CAAA;AAI1D,8FAA8F;AAC9F,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAClC,MAAM,eAAe,GAAG,GAAG,YAAY,MAAM,CAAA;AAC7C,MAAM,aAAa,GAAG,GAAG,YAAY,MAAM,CAAA;AAC3C,MAAM,cAAc,GAAG,GAAG,YAAY,MAAM,CAAA;AAC5C,MAAM,WAAW,GAAG,GAAG,YAAY,OAAO,CAAA;AAE1C,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AACjC,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACpC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC/C,6EAA6E;AAC7E,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACpD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAA;AACrC,oGAAoG;AACpG,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAA;AAE1C,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAyB;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAClE,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QACxC,OAAO,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAA;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AA8ED,MAAM,KAAK,GAAG,GAAe,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;AACpF,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACtD,MAAM,IAAI,GAAG,CAAC,EAAiB,EAAE,GAAW,EAAE,EAAE,CAAC,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,GAAG,CAAA;AAErF,MAAM,OAAO,WAAW;IAIO;IAHrB,IAAI,GAAe,KAAK,EAAE,CAAA;IAC1B,OAAO,GAAG,CAAC,CAAC,CAAA;IAEpB,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C,uFAAuF;IAC/E,IAAI;QACV,IAAI,KAAK,GAAG,CAAC,CAAC,CAAA;QACd,IAAI,CAAC;YACH,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAA;YACnB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;YACjB,OAAO,IAAI,CAAC,IAAI,CAAA;QAClB,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAwB,CAAA;gBACjF,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,6EAA6E;gBAC7E,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAA;YACrB,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QACtB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,8FAA8F;IACtF,MAAM,CAAI,EAAqC;QACrD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACtB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAA;QAC7C,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/D,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;QAC1C,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,CAAa,EAAE,GAAW;QACtC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAA;QACrE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAA;QACjF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;QAC7F,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,oBAAoB,CACnG,CAAA;IACH,CAAC;IAED,8EAA8E;IAE9E,6FAA6F;IAC7F,WAAW,CAAC,IAAY,EAAE,MAAc,EAAE,KAAY;QACpD,MAAM,KAAK,GAAG,YAAY,CAAC,eAAe,CAAC,CAAA;QAC3C,MAAM,EAAE,GAAG,UAAU,EAAE,CAAA;QACvB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACrB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;gBACZ,EAAE;gBACF,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,eAAe;gBAClD,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC;gBACtB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC;gBACzB,KAAK;gBACL,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC;gBACnB,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;IACtB,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC,CAAA;IACL,CAAC;IAED,yEAAyE;IACzE,WAAW,CAAC,EAAU;QACpB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YAAE,OAAO,KAAK,CAAA;QAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACvB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;YAC9B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YAC9C,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;QACjC,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,8EAA8E;IAE9E,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAA;QAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEtB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QACnD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;YACrD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,CAAA;QAClH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAA;QACzD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAC9E,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC7D,OAAO;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,WAAW;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE;SACxB,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,IAAyB,EAAE,EAAU,EAAE,IAAmB,EAAE,GAAW;QACnF,IAAI,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB;YAAE,OAAM;QACrE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAChB,MAAM,GAAG,GAAI,CAAC,CAAC,IAAI,CAAsD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YAClG,IAAI,GAAG;gBAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;QACpC,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,8EAA8E;IAE9E,cAAc,CAAC,IAGd;QACC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACtE,CAAC,CAAC,EAAE,CAAA;QACN,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,sBAAsB;gBAC7B,WAAW,EAAE,wDAAwD;aACtE,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClH,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YAClB,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;gBAC5E,OAAO;oBACL,EAAE,EAAE,KAAc;oBAClB,KAAK,EAAE,yBAAyB;oBAChC,WAAW,EAAE,0CAA0C;iBACxD,CAAA;YACH,CAAC;YACD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAA;YACvB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YACnF,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAC9C,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,QAAgB,EAAE,WAAmB;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAA;QAC5D,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAA;QAC5D,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,8EAA8E;IAE9E,SAAS,CAAC,CAAmF,EAAE,KAAY;QACzG,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACrB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC;gBACrB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,KAAK;gBACL,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,SAAS,EAAE,CAAC,CAAC,aAAa;gBAC1B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC3B,SAAS,EAAE,GAAG,CAAC,GAAG,GAAG,WAAW,CAAC;gBACjC,MAAM,EAAE,IAAI;aACb,CAAC,CAAA;YACF,sEAAsE;YACtE,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAA;YACzD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QACF,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,IAAI,CAAC,MAAe;QAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAA;QAC1C,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC,CAAA;QAC5C,OAAO;YACL,MAAM;YACN,OAAO;YACP,IAAI,EAAE;gBACJ,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC5C,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACxB;SACF,CAAA;IACH,CAAC;IAED,6EAA6E;IAC7E,YAAY,CAAC,GAA0B;QACrC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QACnC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAe,EAAE;YACzC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YAChD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;YAChG,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,WAAW,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;YACnF,2FAA2F;YAC3F,IAAI,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,cAAc,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;YACzF,+FAA+F;YAC/F,IAAI,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,KAAK,GAAG,CAAC,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;YACvG,qEAAqE;YACrE,gEAAgE;YAChE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;YAErB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACvD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,UAAU,EAAE;gBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC;gBAC7B,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC;gBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,eAAe,EAAE,GAAG,CAAC,GAAG,GAAG,aAAa,CAAC;gBACzC,gBAAgB,EAAE,GAAG,CAAC,GAAG,GAAG,cAAc,CAAC;gBAC3C,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC;gBACnB,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI;aAChB,CAAC,CAAA;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAC3B,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,2EAA2E;IAC3E,OAAO,CAAC,GAA0B;QAChC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAA;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAe,EAAE;YACzC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAA;YACxD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;YAC1G,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;YACvG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACvD,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;YAClC,GAAG,CAAC,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;YACpC,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,GAAG,GAAG,aAAa,CAAC,CAAA;YAC9C,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC,GAAG,GAAG,cAAc,CAAC,CAAA;YAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAC3B,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,8EAA8E;IAE9E;;;;OAIG;IACH,eAAe;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAUrB,CAAA;QACH,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,GAAG,CAAC;gBAAE,SAAQ;YAC1D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACtC,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,WAAW;gBACrE,MAAM,EAAE,IAAI,GAAG,EAAS;gBACxB,MAAM,EAAE,IAAI,GAAG,EAAU;gBACzB,WAAW,EAAE,CAAC,CAAC,SAAS;gBACxB,UAAU,EAAE,IAAI;aACjB,CAAA;YACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAC3C,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAChD,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,SAAS,CAAA;YAChE,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;gBAAE,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAA;YACrG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAC/B,CAAC;QACD,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;aAC1B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;aAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YACrB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC,CAAA;IACP,CAAC;IAED,4EAA4E;IAC5E,gBAAgB,CAAC,QAAgB;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAA;QAC1F,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,GAAG,CAAC,CAAA;YACT,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;oBAC5C,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;oBACtB,CAAC,EAAE,CAAA;gBACL,CAAC;YACH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAA;QACd,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,MAA0B;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACxC,CAAC"}

package/dist/auth.d.ts

@@ -13,7 +13,7 @@
  *     The check uses the route the router matched and a normalized path,
  *     never the raw URL, see requiresSession().
  */
-import type { FastifyInstance } from 'fastify';
+import type { FastifyInstance, FastifyRequest } from 'fastify';
 export interface TAuthConfig {
     enabled: boolean;
     issuer: string | null;
@@ -58,6 +58,14 @@ export declare function acceptNameClaim(name: unknown): string | undefined;
  */
 export declare function resolveAuthOrigin(issuer: string | null, configured: string | undefined): string | null;
 export declare function loadAuthConfig(): TAuthConfig;
+/**
+ * The signed-in person behind a request, from the session cookie, or null.
+ * Always null when sign-in is off, because then there is nobody to be.
+ */
+export declare function readSession(config: TAuthConfig, req: FastifyRequest): {
+    userId: string;
+    email: string;
+} | null;
 export declare function registerAuthRoutes(app: FastifyInstance, config: TAuthConfig): Promise<void>;
 /**
  * Reduce a request path to the form the gate compares against, so that no

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAA;AAS9D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;CACf;AAYD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAc9F;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAKjE;AA2BD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAItG;AAED,wBAAgB,cAAc,IAAI,WAAW,CAW5C;AAkCD,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAwFjG;AASD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA0BlE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAKrF"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAS9D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;CACf;AAYD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAc9F;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAKjE;AA2BD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAItG;AAED,wBAAgB,cAAc,IAAI,WAAW,CAW5C;AA8BD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAK9G;AAMD,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAwFjG;AASD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA0BlE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAKrF"}

package/dist/auth.js

@@ -147,6 +147,17 @@ function getCookie(req, name) {
     const match = header.match(new RegExp(`(?:^|;\\s*)${name}=([^;]+)`));
     return match ? (match[1] ?? null) : null;
 }
+/**
+ * The signed-in person behind a request, from the session cookie, or null.
+ * Always null when sign-in is off, because then there is nobody to be.
+ */
+export function readSession(config, req) {
+    if (!config.enabled || !config.issuer)
+        return null;
+    const cookie = getCookie(req, COOKIE_NAME);
+    const session = cookie ? verifySession(config.secret, cookie) : null;
+    return session ? { userId: session.userId, email: session.email } : null;
+}
 function isProductionLike() {
     return process.env.NODE_ENV === 'production';
 }