@oimlsmart/platform-server 0.1.6 → 0.1.7

package/migrations/0021_oidc_consent_grants.sql

@@ -0,0 +1,44 @@
+-- Migration 0021 — the remembered consent grants (TODO.identity-features/12):
+-- the OP remembers the account holder's "Allow" per (user, client, scope
+-- set), so a repeat authorization the grant COVERS skips the consent page
+-- (the OIDC-correct behavior — the page shows again only when the request
+-- carries prompt=consent, when the granted set no longer covers the asked
+-- scopes, or when the holder revoked the access from the account console).
+--
+-- The doctrines:
+--   - ONE LIVE grant per (user_id, client_id, scope): the partial unique
+--     index keys the live rows only (a live grant = revoked_at IS NULL) —
+--     a revoked triple's re-allow lands a FRESH row and the history keeps
+--     the revoked one;
+--   - scope is the CANONICAL spelling (the scope SET, space-joined,
+--     deduped, sorted — store.ts's normalizeOidcScopeSet): 'profile openid'
+--     and 'openid profile' are the same grant, so the unique triple holds
+--     honestly;
+--   - the skip check's COVERAGE math (the granted set ⊇ the requested set)
+--     is the store's (consentGrantCovers over the live rows), never a LIKE
+--     scan in SQL;
+--   - revocation flips revoked_at (the row STAYS — the audit chain carries
+--     the grant + the revoke, the row is their resolvable record); the
+--     account erasure removes the rows outright (a dead account's grants
+--     die with it — the personal_access_tokens doctrine, migration 0020).
+-- schema.sql carries the same end state for fresh databases —
+-- test/migrations.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+CREATE TABLE IF NOT EXISTS oidc_consent_grants (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  client_id TEXT NOT NULL,
+  -- The granted scope set, the canonical space-joined spelling
+  -- (normalizeOidcScopeSet).
+  scope TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  revoked_at TEXT
+);
+-- One LIVE grant per (user, client, scope set) — the predicate keeps the
+-- revoked rows out of the index, so the re-allow after a revoke inserts
+-- cleanly.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_consent_grants_live
+  ON oidc_consent_grants (user_id, client_id, scope) WHERE revoked_at IS NULL;
+-- The account console's "apps they can access" read.
+CREATE INDEX IF NOT EXISTS idx_oidc_consent_grants_user ON oidc_consent_grants (user_id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oimlsmart/platform-server",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "The OIML SMART platform server kernel: the store seam (ServerStore + the D1 and SQLite implementations), the canonical D1 migration set both deployments apply, the instance profile, the mailer, the RBAC map, the OIDC/OAuth client cones, and the shared role/permission vocabulary. Consumed by the smart monorepo (browser/) and the identity service.",
   "type": "module",
   "repository": {

package/src/store/d1.ts

@@ -47,7 +47,10 @@ import {
   type OidcClient,
   type OidcClientLaunch,
   type OidcCode,
+  type OidcConsentGrant,
   type OidcKeyRow,
+  consentGrantCovers,
+  normalizeOidcScopeSet,
   type OpAccountErasure,
   type OpClientRoleAssignment,
   type OpLiveSession,
@@ -478,6 +481,35 @@ export class D1ServerStore implements ServerStore {
     return this.personalAccessTokenSupportEnsured
   }
 
+  // TODO.identity-features/12 (the remembered consent grants): the
+  // oidc_consent_grants table arrives with migration 0021 — a dev D1
+  // migrated from before it lacks the table, so the grant methods ensure
+  // it defensively (the ensurePersonalAccessTokenSupport posture,
+  // memoized per store).
+  private consentGrantSupportEnsured: Promise<void> | null = null
+
+  private ensureConsentGrantSupport(): Promise<void> {
+    if (!this.consentGrantSupportEnsured) {
+      this.consentGrantSupportEnsured = (async () => {
+        await this.db.prepare(
+          `CREATE TABLE IF NOT EXISTS oidc_consent_grants (
+             id TEXT PRIMARY KEY,
+             user_id TEXT NOT NULL REFERENCES users(id),
+             client_id TEXT NOT NULL,
+             scope TEXT NOT NULL,
+             created_at TEXT NOT NULL DEFAULT (datetime('now')),
+             revoked_at TEXT
+           )`,
+        ).run()
+        await this.db.prepare(
+          'CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_consent_grants_live ON oidc_consent_grants (user_id, client_id, scope) WHERE revoked_at IS NULL',
+        ).run()
+        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_oidc_consent_grants_user ON oidc_consent_grants (user_id)').run()
+      })()
+    }
+    return this.consentGrantSupportEnsured
+  }
+
   // ── users / sessions ─────────────────────────────────────────────
 
   async seedDemoAccounts(): Promise<void> {
@@ -1125,6 +1157,78 @@ export class D1ServerStore implements ServerStore {
     ).run()
   }
 
+  // ── the remembered consent grants (TODO.identity-features/12) ─────
+
+  private static toConsentGrant(row: Record<string, unknown>): OidcConsentGrant {
+    return {
+      id: row.id as string,
+      userId: row.user_id as string,
+      clientId: row.client_id as string,
+      scope: row.scope as string,
+      createdAt: D1ServerStore.storeTimeToIso(row.created_at as string)!,
+      revokedAt: D1ServerStore.storeTimeToIso((row.revoked_at as string | null) ?? null),
+    }
+  }
+
+  async getConsentGrant(userId: string, clientId: string, scope: string): Promise<OidcConsentGrant | null> {
+    await this.ensureConsentGrantSupport()
+    // The skip check's coverage math is the store.ts helper's, never a
+    // LIKE scan: the account's live rows for the client, the freshest
+    // covering grant wins.
+    const res = await this.stmt(
+      'SELECT * FROM oidc_consent_grants WHERE user_id = ? AND client_id = ? AND revoked_at IS NULL ORDER BY created_at DESC, rowid DESC',
+      userId, clientId,
+    ).all<Record<string, unknown>>()
+    for (const row of res.results) {
+      if (consentGrantCovers(row.scope as string, scope)) return D1ServerStore.toConsentGrant(row)
+    }
+    return null
+  }
+
+  async recordConsentGrant(input: { userId: string; clientId: string; scope: string }): Promise<OidcConsentGrant> {
+    await this.ensureConsentGrantSupport()
+    const scope = normalizeOidcScopeSet(input.scope)
+    // The upsert targets the partial unique index: a live triple's row
+    // refreshes its stamp (the re-affirmed consent); a REVOKED triple's
+    // re-allow falls out of the index's predicate and inserts FRESH —
+    // the history survives.
+    await this.stmt(
+      `INSERT INTO oidc_consent_grants (id, user_id, client_id, scope)
+       VALUES (?, ?, ?, ?)
+       ON CONFLICT (user_id, client_id, scope) WHERE revoked_at IS NULL
+       DO UPDATE SET created_at = datetime('now')`,
+      crypto.randomUUID(), input.userId, input.clientId, scope,
+    ).run()
+    const row = await this.stmt(
+      'SELECT * FROM oidc_consent_grants WHERE user_id = ? AND client_id = ? AND scope = ? AND revoked_at IS NULL',
+      input.userId, input.clientId, scope,
+    ).first<Record<string, unknown>>()
+    if (!row) throw new Error('recordConsentGrant: the upsert left no live row')
+    return D1ServerStore.toConsentGrant(row)
+  }
+
+  async listConsentGrants(userId: string): Promise<OidcConsentGrant[]> {
+    await this.ensureConsentGrantSupport()
+    // The console's list: the LIVE grants only (the revoked rows ride the
+    // audit chain), newest first — created_at is second-resolution, the
+    // rowid breaks the tie.
+    const res = await this.stmt(
+      'SELECT * FROM oidc_consent_grants WHERE user_id = ? AND revoked_at IS NULL ORDER BY created_at DESC, rowid DESC',
+      userId,
+    ).all<Record<string, unknown>>()
+    return res.results.map(D1ServerStore.toConsentGrant)
+  }
+
+  /** The guarded revoke: the owner's LIVE row flips, once. */
+  async revokeConsentGrant(id: string, userId: string): Promise<boolean> {
+    await this.ensureConsentGrantSupport()
+    const res = await this.stmt(
+      "UPDATE oidc_consent_grants SET revoked_at = datetime('now') WHERE id = ? AND user_id = ? AND revoked_at IS NULL",
+      id, userId,
+    ).run()
+    return (res.meta.changes ?? 0) > 0
+  }
+
   // ── the upstream providers (TODO.identity/08) ─────────────────────
   // The provider + link rows port directly (D1 is SQLite).
 
@@ -1512,6 +1616,10 @@ export class D1ServerStore implements ServerStore {
     // again).
     await this.ensurePersonalAccessTokenSupport()
     const personalAccessTokens = await this.stmt('DELETE FROM personal_access_tokens WHERE user_id = ?', userId).run()
+    // TODO.identity-features/12: the remembered consent grants die with
+    // the account (a tombstone never skips a consent page again).
+    await this.ensureConsentGrantSupport()
+    const consentGrants = await this.stmt('DELETE FROM oidc_consent_grants WHERE user_id = ?', userId).run()
     await this.stmt(
       `UPDATE users SET
          email = ?, name = 'Deleted account', provider = 'erased',
@@ -1529,6 +1637,7 @@ export class D1ServerStore implements ServerStore {
       factors: (passkeys.meta.changes ?? 0) + (totp.meta.changes ?? 0) + (recovery.meta.changes ?? 0)
         + (challenges.meta.changes ?? 0) + (mfa.meta.changes ?? 0),
       personalAccessTokens: personalAccessTokens.meta.changes ?? 0,
+      consentGrants: consentGrants.meta.changes ?? 0,
     }
   }
 

package/src/store/sqlite/consent-grants-store.ts

@@ -0,0 +1,85 @@
+// ═══════════════════════════════════════════════════════════════════
+// The remembered consent grants' SQLite half (TODO.identity-features/12)
+// — the sync implementations behind the ServerStore consent-grant
+// methods (sqlite-server-store.ts delegates here one-for-one, the
+// pat-store.ts pattern). The D1 store implements the same surface in
+// d1.ts.
+//
+// The doctrines carried:
+//   - ONE LIVE grant per (user, client, scope set): the partial unique
+//     index (migration 0021) is the backstop; the record path's upsert
+//     targets it, so a repeat allow refreshes the live row's stamp and a
+//     REVOKED triple's re-allow lands a fresh row (the history survives);
+//   - the scope cell is the CANONICAL spelling (normalizeOidcScopeSet) —
+//     written normalized, read defensively (a hand-edited row still reads
+//     as a set, never trusted as a string match);
+//   - the revoke is a GUARDED update (the owner's live row flips, once);
+//   - the erasure (op-accounts-store.ts's eraseOpAccount) removes the
+//     rows outright — a dead account's grants die with it.
+//
+// NODE-ONLY: better-sqlite3 through ./store's getDb. The Worker bundle
+// never sees this module.
+// ═══════════════════════════════════════════════════════════════════
+
+import { randomUUID } from 'crypto'
+import { getDb } from './store'
+import { storeTimeToIso } from './factors-store'
+import { consentGrantCovers, normalizeOidcScopeSet, type OidcConsentGrant } from '../../store'
+
+function toConsentGrant(row: Record<string, unknown>): OidcConsentGrant {
+  return {
+    id: row.id as string,
+    userId: row.user_id as string,
+    clientId: row.client_id as string,
+    scope: row.scope as string,
+    createdAt: storeTimeToIso(row.created_at as string)!,
+    revokedAt: storeTimeToIso((row.revoked_at as string | null) ?? null),
+  }
+}
+
+/** The authorize endpoint's remembered-consent read: the account's LIVE
+ *  grant for this client whose scope set COVERS the requested set (the
+ *  freshest first, when several cover). */
+export function getConsentGrant(userId: string, clientId: string, scope: string): OidcConsentGrant | null {
+  const rows = getDb().prepare(
+    'SELECT * FROM oidc_consent_grants WHERE user_id = ? AND client_id = ? AND revoked_at IS NULL ORDER BY created_at DESC, rowid DESC',
+  ).all(userId, clientId) as Array<Record<string, unknown>>
+  for (const row of rows) {
+    if (consentGrantCovers(row.scope as string, scope)) return toConsentGrant(row)
+  }
+  return null
+}
+
+/** The consent decision's remember (the allow): the upsert on the live
+ *  triple refreshes the stamp; a revoked triple's re-allow inserts fresh
+ *  (the partial unique index's predicate keeps the revoked row out of the
+ *  collision). Answers the live row. */
+export function recordConsentGrant(input: { userId: string; clientId: string; scope: string }): OidcConsentGrant {
+  const scope = normalizeOidcScopeSet(input.scope)
+  getDb().prepare(
+    `INSERT INTO oidc_consent_grants (id, user_id, client_id, scope)
+     VALUES (?, ?, ?, ?)
+     ON CONFLICT (user_id, client_id, scope) WHERE revoked_at IS NULL
+     DO UPDATE SET created_at = datetime('now')`,
+  ).run(randomUUID(), input.userId, input.clientId, scope)
+  const row = getDb().prepare(
+    'SELECT * FROM oidc_consent_grants WHERE user_id = ? AND client_id = ? AND scope = ? AND revoked_at IS NULL',
+  ).get(input.userId, input.clientId, scope) as Record<string, unknown> | undefined
+  if (!row) throw new Error('recordConsentGrant: the upsert left no live row')
+  return toConsentGrant(row)
+}
+
+/** The console's list: the account's LIVE grants, newest first. */
+export function listConsentGrants(userId: string): OidcConsentGrant[] {
+  const rows = getDb().prepare(
+    'SELECT * FROM oidc_consent_grants WHERE user_id = ? AND revoked_at IS NULL ORDER BY created_at DESC, rowid DESC',
+  ).all(userId) as Array<Record<string, unknown>>
+  return rows.map(toConsentGrant)
+}
+
+/** The guarded revoke: the owner's LIVE row flips, once. */
+export function revokeConsentGrant(id: string, userId: string): boolean {
+  return getDb().prepare(
+    "UPDATE oidc_consent_grants SET revoked_at = datetime('now') WHERE id = ? AND user_id = ? AND revoked_at IS NULL",
+  ).run(id, userId).changes > 0
+}

package/src/store/sqlite/op-accounts-store.ts

@@ -313,6 +313,7 @@ export function eraseOpAccount(userId: string): {
   tokens: number
   factors: number
   personalAccessTokens: number
+  consentGrants: number
 } | null {
   const db = getDb()
   const row = db.prepare('SELECT 1 AS ok FROM users WHERE id = ?').get(userId)
@@ -339,6 +340,9 @@ export function eraseOpAccount(userId: string): {
   // TODO.identity-features/08: the developer tokens die with the account
   // (the hashed rows go — a tombstone's tokens never exchange again).
   const personalAccessTokens = db.prepare('DELETE FROM personal_access_tokens WHERE user_id = ?').run(userId).changes
+  // TODO.identity-features/12: the remembered consent grants die with the
+  // account (a tombstone never skips a consent page again).
+  const consentGrants = db.prepare('DELETE FROM oidc_consent_grants WHERE user_id = ?').run(userId).changes
   db.prepare(
     `UPDATE users SET
        email = ?, name = 'Deleted account', provider = 'erased',
@@ -346,7 +350,7 @@ export function eraseOpAccount(userId: string): {
        avatar_url = NULL, email_verified_at = NULL, active = 0
      WHERE id = ?`,
   ).run(`deleted-${userId}@erased.invalid`, userId)
-  return { ...revoked, links, clientRoles, memberships, tokens, factors, personalAccessTokens }
+  return { ...revoked, links, clientRoles, memberships, tokens, factors, personalAccessTokens, consentGrants }
 }
 
 /** The last OP-side sign-in per account, FROM THE AUDIT CHAIN: the

package/src/store/sqlite/schema.sql

@@ -825,3 +825,27 @@ CREATE TABLE IF NOT EXISTS personal_access_tokens (
   UNIQUE (token_hash)
 );
 CREATE INDEX IF NOT EXISTS idx_personal_access_tokens_user ON personal_access_tokens (user_id);
+
+-- ═══════════════════════════════════════════════════════════════════
+-- The remembered consent grants (TODO.identity-features/12): the OP
+-- remembers the account holder's "Allow" per (user, client, scope set) —
+-- a repeat authorization the grant COVERS skips the consent page (unless
+-- the request carries prompt=consent). scope is the canonical space-joined
+-- set spelling (normalizeOidcScopeSet); the partial unique index keys ONE
+-- LIVE grant per (user_id, client_id, scope) — revocation flips
+-- revoked_at (the row stays for the audit + the history), a revoked
+-- triple's re-allow lands a fresh row, and the account erasure removes
+-- the rows outright. The D1 migration set carries the identical end state
+-- (0021_oidc_consent_grants.sql).
+-- ═══════════════════════════════════════════════════════════════════
+CREATE TABLE IF NOT EXISTS oidc_consent_grants (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  client_id TEXT NOT NULL,
+  scope TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  revoked_at TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_consent_grants_live
+  ON oidc_consent_grants (user_id, client_id, scope) WHERE revoked_at IS NULL;
+CREATE INDEX IF NOT EXISTS idx_oidc_consent_grants_user ON oidc_consent_grants (user_id);

package/src/store/sqlite.ts

@@ -172,7 +172,7 @@ import {
   updateOpAccount,
   updateUserName,
 } from './sqlite/op-accounts-store'
-import { installStore, type AuthUserPayload, type CertificateHolderClaim, type CertificateHolderOrg, type CompleteEmailChangeResult, type CompleteEnrollmentResult, type EmailChangeToken, type EnrollmentToken, type EntityChange, type EntityRow, type EventKeyFilter, type FederationPeer, type IdentityApproval, type IdentityLink, type IdentityProvider, type InstrumentRegistration, type InstrumentRegistrationLifecycle, type InstrumentRegistrationScopeStatus, type NotifyDelivery, type NotifyDeliveryStatus, type NotifyEntityMute, type NotifyInboxState, type NotifyPreferences, type NotifyRule, type OAuthInitialAssignment, type OidcAccessToken, type OidcAuthorization, type OidcClient, type OidcClientLaunch, type OidcCode, type OidcKeyRow, type OpAccountErasure, type OpClientRoleAssignment, type OpLiveSession, type OrgJoinRequest, type OrgMembership, type OrgMembershipState, type OrgRegistryContact, type OrgRegistryOrg, type OrgRegistryState, type PersonalAccessToken, type PlatformEvent, type ServerStore, type SessionView, type SsoSignInState, type UserAdminRow, type AdvanceCounterResult, type MfaPending, type RecoveryCodeState, type TotpSecret, type WebauthnChallenge, type WebauthnCredential } from '../store'
+import { installStore, type AuthUserPayload, type CertificateHolderClaim, type CertificateHolderOrg, type CompleteEmailChangeResult, type CompleteEnrollmentResult, type EmailChangeToken, type EnrollmentToken, type EntityChange, type EntityRow, type EventKeyFilter, type FederationPeer, type IdentityApproval, type IdentityLink, type IdentityProvider, type InstrumentRegistration, type InstrumentRegistrationLifecycle, type InstrumentRegistrationScopeStatus, type NotifyDelivery, type NotifyDeliveryStatus, type NotifyEntityMute, type NotifyInboxState, type NotifyPreferences, type NotifyRule, type OAuthInitialAssignment, type OidcAccessToken, type OidcAuthorization, type OidcClient, type OidcClientLaunch, type OidcCode, type OidcConsentGrant, type OidcKeyRow, type OpAccountErasure, type OpClientRoleAssignment, type OpLiveSession, type OrgJoinRequest, type OrgMembership, type OrgMembershipState, type OrgRegistryContact, type OrgRegistryOrg, type OrgRegistryState, type PersonalAccessToken, type PlatformEvent, type ServerStore, type SessionView, type SsoSignInState, type UserAdminRow, type AdvanceCounterResult, type MfaPending, type RecoveryCodeState, type TotpSecret, type WebauthnChallenge, type WebauthnCredential } from '../store'
 import {
   advanceWebauthnCounter,
   consumeMfaPending,
@@ -205,6 +205,12 @@ import {
   revokePersonalAccessToken,
   stampPersonalAccessTokenUse,
 } from './sqlite/pat-store'
+import {
+  getConsentGrant,
+  listConsentGrants,
+  recordConsentGrant,
+  revokeConsentGrant,
+} from './sqlite/consent-grants-store'
 
 
 /** The workflow tables the reset wipe covers (the D1 store's
@@ -652,6 +658,20 @@ export function createSqliteServerStore(): ServerStore {
       retireOidcKey(kid)
     },
 
+    // ── the remembered consent grants (TODO.identity-features/12) ──
+    async getConsentGrant(userId: string, clientId: string, scope: string): Promise<OidcConsentGrant | null> {
+      return getConsentGrant(userId, clientId, scope)
+    },
+    async recordConsentGrant(input: { userId: string; clientId: string; scope: string }): Promise<OidcConsentGrant> {
+      return recordConsentGrant(input)
+    },
+    async listConsentGrants(userId: string): Promise<OidcConsentGrant[]> {
+      return listConsentGrants(userId)
+    },
+    async revokeConsentGrant(id: string, userId: string): Promise<boolean> {
+      return revokeConsentGrant(id, userId)
+    },
+
     // ── the upstream providers (TODO.identity/08) ──
     async listIdentityProviders(): Promise<IdentityProvider[]> {
       return listIdentityProviders()

package/src/store.ts

@@ -436,6 +436,44 @@ export interface OidcKeyRow {
   retiredAt: string | null
 }
 
+// ── the remembered consent grants (TODO.identity-features/12) ────────
+
+/** A remembered consent grant (the oidc_consent_grants row): the account
+ *  holder's "Allow", remembered per (user, client, scope set) so a repeat
+ *  authorization the grant COVERS skips the consent page. A LIVE grant
+ *  carries revoked_at NULL — revocation flips the stamp and the row stays
+ *  (the audit chain's resolvable record); the account erasure removes the
+ *  rows outright (the PAT doctrine). scope is the CANONICAL set spelling
+ *  (normalizeOidcScopeSet) — the partial unique index keys one live row
+ *  per (user, client, scope) triple. */
+export interface OidcConsentGrant {
+  id: string
+  userId: string
+  clientId: string
+  /** The granted scope set, space-joined in the canonical spelling. */
+  scope: string
+  createdAt: string
+  revokedAt: string | null
+}
+
+/** The scope set's canonical spelling: split on whitespace, drop empties
+ *  and duplicates, sort — 'profile openid' and 'openid profile' are the
+ *  SAME set, so the (user, client, scope) triple's uniqueness holds
+ *  honestly. */
+export function normalizeOidcScopeSet(scope: string): string {
+  return [...new Set(scope.split(/\s+/).filter(Boolean))].sort().join(' ')
+}
+
+/** The skip check's coverage math (the authorize endpoint's rule): a live
+ *  grant covers the request when EVERY requested scope is in the granted
+ *  set. Both sides normalize first, so a hand-edited row still reads as a
+ *  set — never trusted as a string match. */
+export function consentGrantCovers(grantScope: string, requestedScope: string): boolean {
+  const granted = new Set(normalizeOidcScopeSet(grantScope).split(' ').filter(Boolean))
+  const requested = normalizeOidcScopeSet(requestedScope).split(' ').filter(Boolean)
+  return requested.length > 0 && requested.every(s => granted.has(s))
+}
+
 // ── the upstream providers (TODO.identity/08) ────────────────────────
 
 /** An upstream identity provider the OP links + accepts (a registry
@@ -551,7 +589,8 @@ export interface OpClientRoleAssignment {
  *  rows removed (passkeys, TOTP secrets, recovery codes, and the
  *  account's pending ceremony state). TODO.identity-features/08 adds
  *  `personalAccessTokens`: the developer-token rows (a dead account's
- *  tokens die with it). */
+ *  tokens die with it). TODO.identity-features/12 adds `consentGrants`:
+ *  the remembered consent rows (a dead account's grants die with it). */
 export interface OpAccountErasure {
   sessions: number
   accessTokens: number
@@ -563,6 +602,7 @@ export interface OpAccountErasure {
   tokens: number
   factors: number
   personalAccessTokens: number
+  consentGrants: number
 }
 
 // ── the account console (TODO.identity/06) ───────────────────────────
@@ -1468,6 +1508,28 @@ export interface ServerStore {
   upsertOidcKey(input: { kid: string; publicJwk: string }): Promise<void>
   retireOidcKey(kid: string): Promise<void>
 
+  // ── the remembered consent grants (TODO.identity-features/12) ──
+  /** The authorize endpoint's remembered-consent read: the account's
+   *  LIVE grant for this client whose scope set COVERS the requested set
+   *  (the consentGrantCovers math over the live rows), or null — the
+   *  consent page shows. Both scope spellings normalize before the math. */
+  getConsentGrant(userId: string, clientId: string, scope: string): Promise<OidcConsentGrant | null>
+  /** The consent decision's remember (the allow): the upsert per
+   *  (user, client, scope) — a live triple's row refreshes its stamp (the
+   *  re-affirmed consent); a REVOKED triple's re-allow lands a FRESH live
+   *  row (the partial unique index keeps the revoked rows out of the
+   *  collision, so the history survives). The scope cell stores the
+   *  canonical spelling (normalizeOidcScopeSet). Answers the live row. */
+  recordConsentGrant(input: { userId: string; clientId: string; scope: string }): Promise<OidcConsentGrant>
+  /** The account console's "apps they can access": the account's LIVE
+   *  grants, newest first (the revoked rows never list — the audit chain
+   *  carries them). */
+  listConsentGrants(userId: string): Promise<OidcConsentGrant[]>
+  /** The console's "Revoke access": flips revoked_at on the account's OWN
+   *  live row — a second revoke or another account's row answers false
+   *  (the PAT guard's posture). The row STAYS. */
+  revokeConsentGrant(id: string, userId: string): Promise<boolean>
+
   // ── the upstream providers (TODO.identity/08) ──
   /** The upstream registry (admin-managed; OP_UPSTREAM_SEED bootstraps).
    *  Secrets are NEVER in these rows — clientSecretRef is an env name. */