@owlmeans/server-auth-token 0.1.18-rc.1

package/README.md

@@ -0,0 +1,15 @@
+<!-- owlmeans:agent-guidance:start -->
+## Agent guidance
+
+This package ships embedded agent skills under `agent-meta/`. After installing your
+`@owlmeans/*` packages, run the OwlMeans agent-skills installer to place them into
+your project's skill store (`.agents/skills/`):
+
+```sh
+npx @owlmeans/agent-skills@^0.1.18-rc.13
+```
+
+The embedded files are version-matched to this package release. Do not edit them
+directly — they are regenerated on each publish. To contribute guidance edits,
+open a PR against the source monorepo.
+<!-- owlmeans:agent-guidance:end -->

package/agent-meta/manifest.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": 2,
+  "package": "@owlmeans/server-auth-token",
+  "version": "0.1.18-rc.1",
+  "generatedAt": "2026-09-10T18:54:42.508Z",
+  "canonicalRepo": "https://github.com/owlmeans/common",
+  "entries": [
+    {
+      "kind": "skill",
+      "name": "server-auth-token",
+      "category": "package-specific",
+      "file": "skills/server-auth-token/SKILL.md",
+      "canonicalPath": ".agents/skills/server-auth-token/SKILL.md"
+    }
+  ]
+}

package/agent-meta/skills/server-auth-token/SKILL.md

@@ -0,0 +1,136 @@
+---
+name: server-auth-token
+description: How to use @owlmeans/server-auth-token — the server half of long-lived access tokens — the Mongo store, the guard that verifies a presented token and intersects its scopes with the profile's, the mint/list/revoke handlers, and the coguard that admits a token on every already-guarded route. Auto-invoked when registering the token guard or resources, mounting the token handlers, or diagnosing a 401 on a route an access token should reach.
+user-invocable: false
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/server-auth-token
+
+**Layer:** Server
+**Install:** `"@owlmeans/server-auth-token": "^0.1.18-rc.1"` in `dependencies`
+**Contracts:** `@owlmeans/auth-token` — the record, the routes, the format helpers
+
+## Key Exports
+
+| Export | Description |
+|--------|-------------|
+| `appendAuthTokenResources(ctx, dbAlias?)` | Register the token store. Pass the identity resources' `dbAlias` |
+| `appendAuthTokenGuard(ctx, alias?, opts?)` | Register the guard AND write `opts.prefix` into the config |
+| `makeAuthTokenGuard(alias?, opts?)` | The guard itself |
+| `makeAccessTokenResource(dbAlias?)` | The Mongo resource, with its three indexes |
+| `prefixOf(context, opts?)` | The deployment's prefix: guard options → config → default |
+| `hashAccessToken(token)` · `mintAccessToken(prefix)` | The stored form; one minted `{ token, hash, display }` |
+| `setupAuthTokenCoguard(entrypoints, guard?)` | Append the guard to every entrypoint that already has one |
+| `listAccessTokens` · `createAccessToken` · `revokeAccessToken` | The three handlers |
+| `AuthTokenGuardOptions` (`prefix`, `denyAliases`, `touchInterval`, `resourceAlias`, `profileAlias`) · `AuthTokenConfig` · `AccessTokenResource` | Types |
+
+## Wiring
+
+```typescript
+appendAuthTokenResources(context, AUTH_IDENTITY_DB_ALIAS)
+appendAuthTokenGuard(context, GUARD_AUTH_TOKEN, {
+  prefix: 'vib_',
+  denyAliases: TOKEN_DENIED_ROUTES,
+})
+```
+
+**The prefix is written into the configuration, because the guard is not the only reader.** The
+minting handler has no guard instance to ask and resolves it through `prefixOf(ctx)`, and the two
+MUST agree: a deployment that told only the guard issues `owl_…` tokens its own guard refuses to
+claim, and every request 401s with nothing anywhere saying why.
+
+Register the store against the **same `dbAlias` as the identity resources**. The guard reads a
+token's profile back on every request, and splitting the two across databases makes every
+authenticated call a cross-database join nobody wrote.
+
+## The store
+
+`hash` is **uniquely** indexed — two records answering one presented secret would make revocation a
+coin toss. `entityId`/`profileId` are plain indexed strings, never declared ObjectId references,
+because that is how the identity records they point at store them, and a reference declared on one
+side of a join and not the other finds nothing. No `$jsonSchema` is applied: the write path is one
+handler with a validated body, and a collection schema would have to be kept in step with a record
+the guard writes to (`lastUsedAt`) on every request.
+
+SHA-256 rather than a password hash is deliberate. The input is 192 bits of machine-generated
+randomness, so there is no dictionary to slow down, and the hash is computed on **every** API
+request — a deliberately slow function here would be a deliberate rate limit on the deployment's
+whole authenticated surface.
+
+## The guard verifies; it never authenticates
+
+`authenticated()` returns `null`. Nothing is exchanged, no envelope is signed, no session begins: a
+caller presents a credential it was handed once, and the guard turns it into the same `Auth` payload
+every other guard produces — so ownership gates, entitlement gates and handlers written against a
+browser session work unchanged for an API client. The `token` field carries the **display** form, so
+a log or an audit trail can hold it safely.
+
+Three properties keep it from colliding with the guards beside it:
+
+- it claims a header only when the value carries the deployment's prefix, under `AUTH-TOKEN` **or**
+  `Bearer`;
+- **it intersects the token's scopes with its profile's on every request** — and loads the profile
+  per request, which is what makes revoking a person's access revoke every token they ever minted
+  without a single token record being touched. `ALL_SCOPES` on either side widens to the other. A
+  revoked token, an expired token, a missing profile and an expired profile all refuse;
+- `entitySlug` is resolved through `ENTITY_RESOLVER` when one is registered, so the payload is
+  identical to a browser session's rather than carrying a raw id.
+
+`lastUsedAt` is a **throttled, fire-and-forget** write (`touchInterval`, default 5 minutes). A usage
+timestamp is never a reason to fail a request, and awaiting it would put a database write on the
+critical path of every authenticated call. It answers one question — "is this token still in use?" —
+and is not an access log.
+
+## A token may never mint or revoke a token
+
+Minting is the one operation that turns a stolen credential into a permanent one: a token that can
+create tokens survives the revocation of the token that leaked. `createAccessToken` and
+`revokeAccessToken` refuse a request whose `auth.type` is `AuthroizationType.AuthToken`, and a
+deployment additionally names those routes in the guard's **deny list**, so the refusal is a 401 at
+the boundary rather than a check every future handler has to remember.
+
+Minting only ever narrows: asking for a scope the caller does not hold is **refused**, not silently
+dropped — a token that quietly grants less than it was asked for fails later, somewhere else, with
+an error about the wrong thing. Revoke is idempotent (a retry looks like a second revoke), and
+another profile's token answers exactly as an unknown id does, so an owner learns nothing about
+tokens that are not theirs.
+
+## The coguard admits a token everywhere, and the deny list lives in the GUARD
+
+```typescript
+setupAuthTokenCoguard(managerEntrypoints as Array<{ guards?: string[] }>)
+```
+
+An API client drives the same surface a browser does — projects, stories, files — so admitting the
+token only on a dedicated prefix would mean a second copy of every route. The coguard **appends**,
+never substitutes: the primary guard stays first and still claims its own credential, and this one
+matches only a value carrying the prefix. It skips entrypoints that have no guard, and it is
+idempotent.
+
+**Run it after the last elevation**, because it reads the guard list each entrypoint actually ended
+up with.
+
+Routes that must stay behind an interactive session — opening a checkout, starting an OAuth flow,
+minting another token — are named in `AuthTokenGuardOptions.denyAliases` rather than skipped here.
+A child entrypoint inherits every guard its ancestors declare and **cannot drop one**, so the only
+place left to say "not with this credential" is the moment the guard decides whether the request is
+its business at all. Refusing in `match` is what makes it a 401 instead of a route that quietly
+works.
+
+## Tests
+
+`bun test ./tests` in the package — what the guard claims, what it resolves (including that a token
+can never outrank its profile), the mint/list/revoke rules, and the coguard's four properties.
+
+## Depends On
+
+- `@owlmeans/auth-token` — the contracts · `@owlmeans/auth`, `@owlmeans/auth-common`
+- `@owlmeans/server-auth-identity` — the profile a token is bound to
+- `@owlmeans/mongo-resource`, `@owlmeans/server-api`, `@owlmeans/server-context`
+- `@noble/hashes`, `@scure/base`
+
+## Related
+
+- [[auth-token]] — the format, the routes and the client carrier guard
+- [[web-auth-token]] — the management panel · [[auth-protocol]] · [[server-auth]]

package/build/append.d.ts

@@ -0,0 +1,20 @@
+import type { BasicContext } from '@owlmeans/context';
+import type { AuthTokenGuardOptions } from './types.js';
+/**
+ * Register the token store.
+ *
+ * Pass the same `dbAlias` the identity resources use: a token's `entityId`/`profileId` are read
+ * back against those collections on every request, and splitting the two across databases makes
+ * every lookup a cross-database join nobody wrote.
+ */
+export declare const appendAuthTokenResources: (context: BasicContext<any>, dbAlias?: string) => void;
+/**
+ * Register the guard that verifies a presented access token.
+ *
+ * A `prefix` passed here is written into the configuration, because the guard is not the only
+ * reader: the minting handler has no guard instance to ask, and the two MUST agree — a deployment
+ * that told only the guard would issue `owl_…` tokens its own guard refuses to claim, and every
+ * request would 401 with nothing anywhere saying why.
+ */
+export declare const appendAuthTokenGuard: (context: BasicContext<any>, alias?: string, opts?: AuthTokenGuardOptions) => void;
+//# sourceMappingURL=append.d.ts.map

package/build/append.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGrD,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAExE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,YAAa,YAAY,CAAC,GAAG,CAAC,YAAY,MAAM,KAAG,IAEvF,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,YACtB,YAAY,CAAC,GAAG,CAAC,UAAS,MAAM,SAA4B,qBAAqB,KACzF,IAMF,CAAA"}

package/build/append.js

@@ -0,0 +1,29 @@
+import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token';
+import { makeAuthTokenGuard } from './guard.js';
+import { makeAccessTokenResource } from './resource.js';
+/**
+ * Register the token store.
+ *
+ * Pass the same `dbAlias` the identity resources use: a token's `entityId`/`profileId` are read
+ * back against those collections on every request, and splitting the two across databases makes
+ * every lookup a cross-database join nobody wrote.
+ */
+export const appendAuthTokenResources = (context, dbAlias) => {
+    context.registerResource(makeAccessTokenResource(dbAlias));
+};
+/**
+ * Register the guard that verifies a presented access token.
+ *
+ * A `prefix` passed here is written into the configuration, because the guard is not the only
+ * reader: the minting handler has no guard instance to ask, and the two MUST agree — a deployment
+ * that told only the guard would issue `owl_…` tokens its own guard refuses to claim, and every
+ * request would 401 with nothing anywhere saying why.
+ */
+export const appendAuthTokenGuard = (context, alias = GUARD_AUTH_TOKEN, opts) => {
+    if (opts?.prefix != null) {
+        const cfg = context.cfg;
+        cfg.authToken = { ...cfg.authToken, prefix: opts.prefix };
+    }
+    context.registerService(makeAuthTokenGuard(alias, opts));
+};
+//# sourceMappingURL=append.js.map

package/build/append.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"append.js","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAGvD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,OAA0B,EAAE,OAAgB,EAAQ,EAAE;IAC7F,OAAO,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAA;AAC5D,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAA0B,EAAE,KAAK,GAAW,gBAAgB,EAAE,IAA4B,EACpF,EAAE;IACR,IAAI,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAsB,CAAA;QAC1C,GAAG,CAAC,SAAS,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;IAC3D,CAAC;IACD,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;AAC1D,CAAC,CAAA"}

package/build/coguard.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Let an access token authenticate every route that already has a guard.
+ *
+ * An API client drives the same surface a browser does — projects, stories, files — so admitting
+ * the token only on a dedicated prefix would mean a second copy of every route. The coguard is
+ * appended, never substituted: the primary guard stays first and still claims its own credential,
+ * and this one matches only a value carrying the deployment's token prefix.
+ *
+ * Routes that must stay behind an interactive session are named in the GUARD's deny list rather
+ * than skipped here — a child entrypoint inherits every guard its ancestors declare and cannot
+ * drop one, so the refusal has to live where the credential is inspected.
+ */
+export declare const setupAuthTokenCoguard: (entrypoints: Array<{
+    guards?: string[];
+}>, guard?: string) => void;
+//# sourceMappingURL=coguard.d.ts.map

package/build/coguard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coguard.d.ts","sourceRoot":"","sources":["../src/coguard.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,gBACnB,KAAK,CAAC;IAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,UAAS,MAAM,KACvD,IAMF,CAAA"}

package/build/coguard.js

@@ -0,0 +1,23 @@
+import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token';
+/**
+ * Let an access token authenticate every route that already has a guard.
+ *
+ * An API client drives the same surface a browser does — projects, stories, files — so admitting
+ * the token only on a dedicated prefix would mean a second copy of every route. The coguard is
+ * appended, never substituted: the primary guard stays first and still claims its own credential,
+ * and this one matches only a value carrying the deployment's token prefix.
+ *
+ * Routes that must stay behind an interactive session are named in the GUARD's deny list rather
+ * than skipped here — a child entrypoint inherits every guard its ancestors declare and cannot
+ * drop one, so the refusal has to live where the credential is inspected.
+ */
+export const setupAuthTokenCoguard = (entrypoints, guard = GUARD_AUTH_TOKEN) => {
+    entrypoints.forEach(entrypoint => {
+        if (entrypoint.guards == null || entrypoint.guards.length < 1)
+            return;
+        if (entrypoint.guards.includes(guard))
+            return;
+        entrypoint.guards = [...entrypoint.guards, guard];
+    });
+};
+//# sourceMappingURL=coguard.js.map

package/build/coguard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coguard.js","sourceRoot":"","sources":["../src/coguard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,WAAyC,EAAE,KAAK,GAAW,gBAAgB,EACrE,EAAE;IACR,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;QAC/B,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAM;QACrE,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAM;QAC7C,UAAU,CAAC,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/build/consts.d.ts

@@ -0,0 +1,3 @@
+/** Service alias of the module, for error locations. */
+export declare const SERVER_AUTH_TOKEN = "server-auth-token";
+//# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,sBAAsB,CAAA"}

package/build/consts.js

@@ -0,0 +1,3 @@
+/** Service alias of the module, for error locations. */
+export const SERVER_AUTH_TOKEN = 'server-auth-token';
+//# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAA"}

package/build/guard.d.ts

@@ -0,0 +1,24 @@
+import type { GuardService } from '@owlmeans/entrypoint';
+import type { AuthTokenContext, AuthTokenGuardOptions } from './types.js';
+/** Where the deployment's prefix comes from: the guard's own options, then config, then default. */
+export declare const prefixOf: (context: AuthTokenContext, opts?: AuthTokenGuardOptions) => string;
+/**
+ * The guard that verifies a long-lived access token.
+ *
+ * It is a GUARD, not an authentication method: nothing is exchanged, no envelope is signed, no
+ * session begins. A caller presents a credential it was handed once, and the guard turns it into
+ * the same `Auth` payload every other guard produces — so ownership gates, entitlement gates and
+ * handlers written against a browser session work unchanged for an API client.
+ *
+ * Three properties are what keep it from colliding with the guards it sits beside:
+ *
+ * - it claims a header only when the value carries the deployment's prefix, so an OwlMeans
+ *   `ED25519-BASIC-TOKEN` bearer, an OIDC one, and this one can all arrive under `Authorization`
+ *   without any of them shadowing the others;
+ * - it accepts the OwlMeans `AUTH-TOKEN` scheme AND plain `Bearer`, because a third-party client
+ *   configured with a URL sends the latter whatever the documentation says;
+ * - it intersects the token's scopes with its profile's on every request, so a token can never
+ *   outlive or outrank the person who minted it.
+ */
+export declare const makeAuthTokenGuard: (alias?: string, opts?: AuthTokenGuardOptions) => GuardService;
+//# sourceMappingURL=guard.d.ts.map

package/build/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAqC,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAI3F,OAAO,KAAK,EAAwC,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAE/G,oGAAoG;AACpG,eAAO,MAAM,QAAQ,YAAa,gBAAgB,SAAS,qBAAqB,KAAG,MACc,CAAA;AAEjG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,WACtB,MAAM,SAA2B,qBAAqB,KAC5D,YAsGF,CAAA"}

package/build/guard.js

@@ -0,0 +1,126 @@
+import { ALL_SCOPES, AuthroizationType } from '@owlmeans/auth';
+import { AUTH_TOKEN_DEFAULT_PREFIX, AUTH_TOKEN_SCHEME, AUTH_TOKEN_RESOURCE, AUTH_TOKEN_TOUCH_INTERVAL, BEARER_SCHEME, GUARD_AUTH_TOKEN, isAccessToken, parseAuthorizationHeader } from '@owlmeans/auth-token';
+import { AUTH_HEADER } from '@owlmeans/auth';
+import { ENTITY_RESOLVER } from '@owlmeans/auth-common';
+import { createService } from '@owlmeans/context';
+import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity';
+import { hashAccessToken } from './hash.js';
+/** Where the deployment's prefix comes from: the guard's own options, then config, then default. */
+export const prefixOf = (context, opts) => opts?.prefix ?? context.cfg.authToken?.prefix ?? AUTH_TOKEN_DEFAULT_PREFIX;
+/**
+ * The guard that verifies a long-lived access token.
+ *
+ * It is a GUARD, not an authentication method: nothing is exchanged, no envelope is signed, no
+ * session begins. A caller presents a credential it was handed once, and the guard turns it into
+ * the same `Auth` payload every other guard produces — so ownership gates, entitlement gates and
+ * handlers written against a browser session work unchanged for an API client.
+ *
+ * Three properties are what keep it from colliding with the guards it sits beside:
+ *
+ * - it claims a header only when the value carries the deployment's prefix, so an OwlMeans
+ *   `ED25519-BASIC-TOKEN` bearer, an OIDC one, and this one can all arrive under `Authorization`
+ *   without any of them shadowing the others;
+ * - it accepts the OwlMeans `AUTH-TOKEN` scheme AND plain `Bearer`, because a third-party client
+ *   configured with a URL sends the latter whatever the documentation says;
+ * - it intersects the token's scopes with its profile's on every request, so a token can never
+ *   outlive or outrank the person who minted it.
+ */
+export const makeAuthTokenGuard = (alias = GUARD_AUTH_TOKEN, opts = {}) => {
+    const touchInterval = opts.touchInterval ?? AUTH_TOKEN_TOUCH_INTERVAL;
+    const present = (req, prefix) => {
+        const parsed = parseAuthorizationHeader(req.headers?.[AUTH_HEADER]);
+        if (parsed == null)
+            return null;
+        if (parsed.scheme !== AUTH_TOKEN_SCHEME && parsed.scheme !== BEARER_SCHEME)
+            return null;
+        return isAccessToken(parsed.value, prefix) ? parsed.value : null;
+    };
+    const service = createService(alias, {
+        match: async (req) => {
+            const context = service.assertCtx();
+            if (req == null)
+                return false;
+            // A denied route refuses the credential outright. The refusal has to happen here rather
+            // than in the handler: a guard appended to a base reaches every child, and a child cannot
+            // drop what it inherited — so the only place left to say "not with this credential" is the
+            // moment the guard decides whether the request is its business at all.
+            if (opts.denyAliases != null && req.alias != null && opts.denyAliases.includes(req.alias)) {
+                return false;
+            }
+            return present(req, prefixOf(context, opts)) != null;
+        },
+        handle: async (req, res) => {
+            const context = service.assertCtx();
+            const prefix = prefixOf(context, opts);
+            const presented = present(req, prefix);
+            if (presented == null)
+                return false;
+            const tokens = context.resource(opts.resourceAlias ?? AUTH_TOKEN_RESOURCE);
+            const record = await tokens.load({ hash: hashAccessToken(presented) });
+            if (record == null)
+                return false;
+            if (record.revokedAt != null)
+                return false;
+            if (record.expiresAt != null && new Date(record.expiresAt) < new Date())
+                return false;
+            // A token is only ever as good as the profile behind it. Reading the profile per request is
+            // what makes revoking a person's access revoke every token they ever minted, without any
+            // token record being touched.
+            const profiles = context.resource(opts.profileAlias ?? AUTH_IDENTITY_PROFILE);
+            let profile = null;
+            try {
+                profile = await profiles.load({ entityId: record.entityId, profileId: record.profileId });
+            }
+            catch {
+                return false;
+            }
+            if (profile == null)
+                return false;
+            if (profile.expiresAt != null && new Date(profile.expiresAt) < new Date())
+                return false;
+            const profileScopes = profile.scopes ?? [];
+            const scopes = profileScopes.includes(ALL_SCOPES)
+                ? record.scopes
+                : record.scopes.includes(ALL_SCOPES)
+                    ? profileScopes
+                    : record.scopes.filter(scope => profileScopes.includes(scope));
+            // `attachEntity` canonicalizes whatever it is given, but it resolves by NAME — so writing
+            // the current slug here costs one cached read and keeps the payload identical to the one a
+            // browser session produces.
+            let entitySlug = record.entityId;
+            if (context.hasService(ENTITY_RESOLVER)) {
+                const resolver = context.service(ENTITY_RESOLVER);
+                const entity = await resolver.byId(record.entityId);
+                if (entity != null)
+                    entitySlug = entity.slug;
+            }
+            res.resolve({
+                // Never the secret: what a downstream reader sees is the display form, which is what a
+                // log or an audit trail can safely carry.
+                token: record.display,
+                type: AuthroizationType.AuthToken,
+                role: profile.role,
+                userId: record.userId,
+                profileId: record.profileId,
+                entitySlug,
+                scopes,
+                isUser: true,
+                source: context.cfg.service,
+                createdAt: new Date(record.createdAt),
+                ...(record.expiresAt != null ? { expiresAt: new Date(record.expiresAt) } : {}),
+            });
+            const last = record.lastUsedAt == null ? 0 : new Date(record.lastUsedAt).getTime();
+            if (Date.now() - last > touchInterval) {
+                // Fire and forget: a usage timestamp is never a reason to fail a request, and awaiting it
+                // would put a database write on the critical path of every authenticated call.
+                void tokens.save({ ...record, lastUsedAt: new Date() })
+                    .catch((e) => console.error('auth-token: lastUsedAt', e));
+            }
+            return true;
+        },
+        /** Server-side guard: it verifies what arrives, it never produces a credential. */
+        authenticated: async () => null,
+    });
+    return service;
+};
+//# sourceMappingURL=guard.js.map

package/build/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EACL,yBAAyB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAC5F,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,wBAAwB,EACzE,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAG3C,oGAAoG;AACpG,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAyB,EAAE,IAA4B,EAAU,EAAE,CAC1F,IAAI,EAAE,MAAM,IAAK,OAAO,CAAC,GAAuB,CAAC,SAAS,EAAE,MAAM,IAAI,yBAAyB,CAAA;AAEjG;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,KAAK,GAAW,gBAAgB,EAAE,IAAI,GAA0B,EAAE,EACpD,EAAE;IAChB,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,yBAAyB,CAAA;IAErE,MAAM,OAAO,GAAG,CAAC,GAA6B,EAAE,MAAc,EAAiB,EAAE;QAC/E,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;QACnE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO,IAAI,CAAA;QAEvF,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAClE,CAAC,CAAA;IAED,MAAM,OAAO,GAAiB,aAAa,CAAe,KAAK,EAAE;QAC/D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAqC,CAAA;YACtE,IAAI,GAAG,IAAI,IAAI;gBAAE,OAAO,KAAK,CAAA;YAC7B,wFAAwF;YACxF,0FAA0F;YAC1F,2FAA2F;YAC3F,uEAAuE;YACvE,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1F,OAAO,KAAK,CAAA;YACd,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAA;QACtD,CAAC;QAED,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAqC,CAAA;YACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACtC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACtC,IAAI,SAAS,IAAI,IAAI;gBAAE,OAAO,KAAU,CAAA;YAExC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAsB,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAA;YAC/F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACtE,IAAI,MAAM,IAAI,IAAI;gBAAE,OAAO,KAAU,CAAA;YACrC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI;gBAAE,OAAO,KAAU,CAAA;YAC/C,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,KAAU,CAAA;YAE1F,4FAA4F;YAC5F,yFAAyF;YACzF,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAC/B,IAAI,CAAC,YAAY,IAAI,qBAAqB,CAC3C,CAAA;YACD,IAAI,OAAO,GAA2B,IAAI,CAAA;YAC1C,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;YAC3F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAU,CAAA;YACnB,CAAC;YACD,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,KAAU,CAAA;YACtC,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,KAAU,CAAA;YAE5F,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;YAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/C,CAAC,CAAC,MAAM,CAAC,MAAM;gBACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAClC,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;YAElE,0FAA0F;YAC1F,2FAA2F;YAC3F,4BAA4B;YAC5B,IAAI,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAA;YAChC,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAA;gBACxE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBACnD,IAAI,MAAM,IAAI,IAAI;oBAAE,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;YAC9C,CAAC;YAED,GAAG,CAAC,OAAO,CAAC;gBACV,uFAAuF;gBACvF,0CAA0C;gBAC1C,KAAK,EAAE,MAAM,CAAC,OAAO;gBACrB,IAAI,EAAE,iBAAiB,CAAC,SAAS;gBACjC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU;gBACV,MAAM;gBACN,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBACrC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvE,CAAC,CAAA;YAEV,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAA;YAClF,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,aAAa,EAAE,CAAC;gBACtC,0FAA0F;gBAC1F,+EAA+E;gBAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;qBACpD,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAA;YACtE,CAAC;YAED,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,mFAAmF;QACnF,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;KAChC,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/handlers/index.d.ts

@@ -0,0 +1,4 @@
+export declare const listAccessTokens: import("@owlmeans/server-entrypoint").RefedEntrypointHandler<import("@owlmeans/entrypoint").AbstractResponse<any>>;
+export declare const createAccessToken: import("@owlmeans/server-entrypoint").RefedEntrypointHandler<import("@owlmeans/entrypoint").AbstractResponse<any>>;
+export declare const revokeAccessToken: import("@owlmeans/server-entrypoint").RefedEntrypointHandler<import("@owlmeans/entrypoint").AbstractResponse<any>>;
+//# sourceMappingURL=index.d.ts.map

package/build/handlers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAsCA,eAAO,MAAM,gBAAgB,oHAa3B,CAAA;AAEF,eAAO,MAAM,iBAAiB,oHAsC5B,CAAA;AAEF,eAAO,MAAM,iBAAiB,oHAqB5B,CAAA"}

package/build/handlers/index.js

@@ -0,0 +1,94 @@
+import { AuthForbidden, AuthroizationType, ALL_SCOPES, AuthRole } from '@owlmeans/auth';
+import { AUTH_TOKEN_MAX_TTL, AUTH_TOKEN_RESOURCE } from '@owlmeans/auth-token';
+import { requireEntityKey } from '@owlmeans/auth-common';
+import { handleBody, handleParams, handleRequest } from '@owlmeans/server-api';
+import { mintAccessToken } from '../hash.js';
+import { prefixOf } from '../guard.js';
+const view = (record) => {
+    const { hash, ...rest } = record;
+    return rest;
+};
+const tokens = (ctx) => ctx.resource(AUTH_TOKEN_RESOURCE);
+/**
+ * A token may never mint another token.
+ *
+ * Minting is the one operation that turns a stolen credential into a permanent one: a token that
+ * can create tokens survives the revocation of the token that leaked. Creating and revoking
+ * therefore require a credential a person produced in a browser — which is also why the deployment
+ * names these routes in the guard's deny list, so the refusal is a 401 at the boundary rather than
+ * a check every future handler has to remember.
+ */
+const refuseTokenAuth = (req, what) => {
+    if (req.auth?.type === AuthroizationType.AuthToken) {
+        throw new AuthForbidden(what);
+    }
+};
+export const listAccessTokens = handleRequest(async (req, context) => {
+    const ctx = context;
+    const entityId = requireEntityKey(req);
+    const profileId = req.auth?.profileId;
+    if (profileId == null)
+        throw new AuthForbidden('profile');
+    const result = await tokens(ctx).list({ entityId, profileId }, { size: 0 });
+    return {
+        items: result.items
+            .map(view)
+            .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()),
+    };
+});
+export const createAccessToken = handleBody(async (payload, context, req) => {
+    const ctx = context;
+    refuseTokenAuth(req, 'token-mint');
+    const entityId = requireEntityKey(req);
+    const profileId = req.auth?.profileId;
+    const userId = req.auth?.userId;
+    if (profileId == null || userId == null)
+        throw new AuthForbidden('profile');
+    const own = req.auth?.scopes ?? [];
+    const scopes = payload.scopes ?? own;
+    // A token is a delegation, so it can only ever narrow. Asking for a scope the caller does not
+    // hold is refused rather than silently dropped: a token that quietly grants less than it was
+    // asked for fails later, somewhere else, with an error about the wrong thing.
+    if (!own.includes(ALL_SCOPES) && scopes.some(scope => !own.includes(scope))) {
+        throw new AuthForbidden('scope');
+    }
+    // The SAME resolver the guard uses, so a minted token is one this deployment's guard claims.
+    const minted = mintAccessToken(prefixOf(ctx));
+    const now = new Date();
+    const record = await tokens(ctx).create({
+        hash: minted.hash,
+        display: minted.display,
+        name: payload.name,
+        userId,
+        profileId,
+        entityId,
+        scopes,
+        role: req.auth?.role ?? AuthRole.User,
+        createdAt: now,
+        ...(payload.expiresIn != null
+            ? { expiresAt: new Date(now.getTime() + Math.min(payload.expiresIn * 1000, AUTH_TOKEN_MAX_TTL)) }
+            : {}),
+    });
+    // The only moment the plaintext exists outside the caller's own machine.
+    return { token: minted.token, record: view(record) };
+});
+export const revokeAccessToken = handleParams(async (payload, context, req) => {
+    const ctx = context;
+    refuseTokenAuth(req, 'token-revoke');
+    const entityId = requireEntityKey(req);
+    const profileId = req.auth?.profileId;
+    if (profileId == null)
+        throw new AuthForbidden('profile');
+    const record = await tokens(ctx).load(payload.id);
+    // A token of another profile answers exactly as an unknown id does — an owner learns nothing
+    // about tokens that are not theirs, not even that one exists.
+    if (record == null || record.entityId !== entityId || record.profileId !== profileId) {
+        throw new AuthForbidden('token');
+    }
+    // Idempotent: revoking twice is what a retry looks like.
+    if (record.revokedAt == null) {
+        await tokens(ctx).save({ ...record, revokedAt: new Date(), updatedAt: new Date() });
+    }
+    return { id: payload.id };
+});
+//# sourceMappingURL=index.js.map

package/build/handlers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACvF,OAAO,EACL,kBAAkB,EAAE,mBAAmB,EACxC,MAAM,sBAAsB,CAAA;AAK7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAGtC,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAmB,EAAE;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IAEhC,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,GAAqB,EAAuB,EAAE,CAC5D,GAAG,CAAC,QAAQ,CAAsB,mBAAmB,CAAC,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,GAAiC,EAAE,IAAY,EAAQ,EAAE;IAChF,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IACnE,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IAE3E,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;aAChB,GAAG,CAAC,IAAI,CAAC;aACT,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;KAC3D,CAAA;AAC7B,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAoB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IAC7F,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IAElC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAA;IAC/B,IAAI,SAAS,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAE3E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAA;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAA;IACpC,8FAA8F;IAC9F,6FAA6F;IAC7F,8EAA8E;IAC9E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,6FAA6F;IAC7F,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM;QACN,SAAS;QACT,QAAQ;QACR,MAAM;QACN,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI;QACrC,SAAS,EAAE,GAAG;QACd,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAE;YACjG,CAAC,CAAC,EAAE,CAAC;KACa,CAAC,CAAA;IAEvB,yEAAyE;IACzE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAA8B,CAAA;AAClF,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAoB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IAC/F,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,eAAe,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAEpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACjD,6FAA6F;IAC7F,8DAA8D;IAC9D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrF,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,yDAAyD;IACzD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;AAC3B,CAAC,CAAC,CAAA"}

package/build/hash.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The stored form of a token.
+ *
+ * SHA-256 rather than a password hash on purpose: the input is 192 bits of machine-generated
+ * randomness, so there is no dictionary to slow down, and the hash is computed on every single
+ * API request — a deliberately slow function here would be a deliberate rate limit on the
+ * deployment's whole authenticated surface.
+ */
+export declare const hashAccessToken: (token: string) => string;
+export interface MintedToken {
+    token: string;
+    hash: string;
+    display: string;
+}
+/** Mint one token: the plaintext (returned once), its hash (stored) and its display form. */
+export declare const mintAccessToken: (prefix: string) => MintedToken;
+//# sourceMappingURL=hash.d.ts.map

package/build/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,UAAW,MAAM,KAAG,MAA6D,CAAA;AAE7G,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,6FAA6F;AAC7F,eAAO,MAAM,eAAe,WAAY,MAAM,KAAG,WAIhD,CAAA"}

package/build/hash.js

@@ -0,0 +1,19 @@
+import { AUTH_TOKEN_SECRET_BYTES, displayOf } from '@owlmeans/auth-token';
+import { base58 } from '@scure/base';
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex, randomBytes } from '@noble/hashes/utils';
+/**
+ * The stored form of a token.
+ *
+ * SHA-256 rather than a password hash on purpose: the input is 192 bits of machine-generated
+ * randomness, so there is no dictionary to slow down, and the hash is computed on every single
+ * API request — a deliberately slow function here would be a deliberate rate limit on the
+ * deployment's whole authenticated surface.
+ */
+export const hashAccessToken = (token) => bytesToHex(sha256(new TextEncoder().encode(token)));
+/** Mint one token: the plaintext (returned once), its hash (stored) and its display form. */
+export const mintAccessToken = (prefix) => {
+    const token = `${prefix}${base58.encode(randomBytes(AUTH_TOKEN_SECRET_BYTES))}`;
+    return { token, hash: hashAccessToken(token), display: displayOf(token, prefix) };
+};
+//# sourceMappingURL=hash.js.map

package/build/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAE7D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAQ7G,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAe,EAAE;IAC7D,MAAM,KAAK,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAA;IAE/E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAA;AACnF,CAAC,CAAA"}

package/build/index.d.ts

@@ -0,0 +1,9 @@
+export * from './consts.js';
+export * from './resource.js';
+export * from './guard.js';
+export * from './hash.js';
+export * from './coguard.js';
+export * from './append.js';
+export * from './handlers/index.js';
+export type * from './types.js';
+//# sourceMappingURL=index.d.ts.map