@owlmeans/server-auth-token 0.1.18-rc.30 → 0.1.18-rc.32

package/build/handlers/revoke.js

@@ -0,0 +1,25 @@
+import { AuthForbidden } from '@owlmeans/auth';
+import { makeEntityScope } from '@owlmeans/auth-common';
+import { handlers } from '@owlmeans/server-api';
+import { refuseTokenAuth } from './refuse.js';
+import { tokenRecordUtils } from './utils.js';
+export const revokeAccessToken = (protocol) => handlers().params(protocol, async (payload, context, req) => {
+    const ctx = context;
+    refuseTokenAuth(req, 'token-revoke');
+    const entityId = makeEntityScope(req).requireEntityKey();
+    const profileId = req.auth?.profileId;
+    if (profileId == null)
+        throw new AuthForbidden('profile');
+    const record = await tokenRecordUtils.tokens(ctx).load(payload.id);
+    // A token of another profile answers exactly as an unknown id does — an owner learns nothing
+    // about tokens that are not theirs, not even that one exists.
+    if (record == null || record.entityId !== entityId || record.profileId !== profileId) {
+        throw new AuthForbidden('token');
+    }
+    // Idempotent: revoking twice is what a retry looks like.
+    if (record.revokedAt == null) {
+        await tokenRecordUtils.tokens(ctx).save({ ...record, revokedAt: new Date(), updatedAt: new Date() });
+    }
+    return { id: payload.id };
+});
+//# sourceMappingURL=revoke.js.map

package/build/handlers/revoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../../src/handlers/revoke.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE7C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAwC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IAC3J,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,eAAe,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAEpC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAA;IACxD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAClE,6FAA6F;IAC7F,8DAA8D;IAC9D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrF,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,yDAAyD;IACzD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;IACtG,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;AAC3B,CAAC,CAAC,CAAA"}

package/build/handlers/types.d.ts

@@ -0,0 +1,29 @@
+import { AuthRole } from '@owlmeans/auth';
+import type { CreateAccessToken, IssuedAccessToken } from '@owlmeans/auth-token';
+/** Whoever is minting the token — read once, by whichever caller resolved the session. */
+export interface IssueAccessTokenSubject {
+    entityId: string;
+    userId: string;
+    profileId: string;
+    role: AuthRole;
+    /** The subject's OWN scopes — minting can only narrow, never widen, this set. */
+    scopes: string[];
+}
+export interface IssueAccessTokenRequest extends CreateAccessToken {
+    /**
+     * The resource(s) this token is FOR (RFC 8707), when it is minted through an OAuth grant.
+     * Absent for a token minted by hand — the ordinary, unrestricted kind.
+     */
+    audience?: string[];
+}
+/** Token issuance over one context's store — the one path every minting caller goes through. */
+export interface AccessTokenIssuer {
+    /**
+     * Mint one token for `subject`, exactly what `createAccessToken` does over an HTTP body — pulled
+     * out so a second caller (an OAuth token endpoint) can mint the SAME shape of record over a
+     * session it authenticated its own way, without a duplicate copy of the narrowing rule or the
+     * TTL clamp silently drifting from this one.
+     */
+    issueAccessToken: (subject: IssueAccessTokenSubject, payload: IssueAccessTokenRequest) => Promise<IssuedAccessToken>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/handlers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/handlers/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAEhF,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,QAAQ,CAAA;IACd,iFAAiF;IACjF,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,gGAAgG;AAChG,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACrH"}

package/build/handlers/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/handlers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/handlers/types.ts"],"names":[],"mappings":""}

package/build/handlers/utils/types.d.ts

@@ -0,0 +1,10 @@
+import type { AccessTokenRecord, AccessTokenView } from '@owlmeans/auth-token';
+import type { AccessTokenResource, AuthTokenContext } from '../../types.js';
+/** What every token handler shares: the store and the view a caller may see. */
+export interface TokenRecordUtils {
+    /** A record without its hash — the hash never leaves the server. */
+    view: (record: AccessTokenRecord) => AccessTokenView;
+    /** The token store of a context. */
+    tokens: (ctx: AuthTokenContext) => AccessTokenResource;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/handlers/utils/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/handlers/utils/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,IAAI,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,eAAe,CAAA;IACpD,oCAAoC;IACpC,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,mBAAmB,CAAA;CACvD"}

package/build/handlers/utils/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/handlers/utils/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/handlers/utils/types.ts"],"names":[],"mappings":""}

package/build/handlers/utils.d.ts

@@ -0,0 +1,4 @@
+import type { TokenRecordUtils } from './utils/types.js';
+export declare const createTokenRecordUtils: () => TokenRecordUtils;
+export declare const tokenRecordUtils: TokenRecordUtils;
+//# sourceMappingURL=utils.d.ts.map

package/build/handlers/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/handlers/utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD,eAAO,MAAM,sBAAsB,QAAO,gBAWzC,CAAA;AAED,eAAO,MAAM,gBAAgB,kBAA2B,CAAA"}

package/build/handlers/utils.js

@@ -0,0 +1,11 @@
+import { AUTH_TOKEN_RESOURCE } from '@owlmeans/auth-token';
+export const createTokenRecordUtils = () => {
+    const view = (record) => {
+        const { hash, ...rest } = record;
+        return rest;
+    };
+    const tokens = (ctx) => ctx.resource(AUTH_TOKEN_RESOURCE);
+    return { view, tokens };
+};
+export const tokenRecordUtils = createTokenRecordUtils();
+//# sourceMappingURL=utils.js.map

package/build/handlers/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/handlers/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAgD,MAAM,sBAAsB,CAAA;AAIxG,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAqB,EAAE;IAC3D,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAmB,EAAE;QAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;QAEhC,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,CAAC,GAAqB,EAAuB,EAAE,CAC5D,GAAG,CAAC,QAAQ,CAAsB,mBAAmB,CAAC,CAAA;IAExD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,EAAE,CAAA"}

package/build/hash/types.d.ts

@@ -0,0 +1,16 @@
+import type { MintedToken } from '../types.js';
+/** Access tokens minted and stored: the plaintext once, the hash forever. */
+export interface TokenHashHelper {
+    /**
+     * The stored form of a token.
+     *
+     * SHA-256 rather than a password hash on purpose: the input is 192 bits of machine-generated
+     * randomness, so there is no dictionary to slow down, and the hash is computed on every single
+     * API request — a deliberately slow function here would be a deliberate rate limit on the
+     * deployment's whole authenticated surface.
+     */
+    hashAccessToken: (token: string) => string;
+    /** Mint one token: the plaintext (returned once), its hash (stored) and its display form. */
+    mintAccessToken: (prefix: string) => MintedToken;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/hash/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/hash/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1C,6FAA6F;IAC7F,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,WAAW,CAAA;CACjD"}

package/build/hash/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/hash/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/hash/types.ts"],"names":[],"mappings":""}

package/build/hash.d.ts

@@ -1,17 +1,6 @@
-/**
- * The stored form of a token.
- *
- * SHA-256 rather than a password hash on purpose: the input is 192 bits of machine-generated
- * randomness, so there is no dictionary to slow down, and the hash is computed on every single
- * API request — a deliberately slow function here would be a deliberate rate limit on the
- * deployment's whole authenticated surface.
- */
+import type { TokenHashHelper } from './hash/types.js';
+export declare const createTokenHashHelper: () => TokenHashHelper;
+export declare const tokenHashHelper: TokenHashHelper;
+/** @deprecated compat:factory-refactor — use `tokenHashHelper.hashAccessToken(…)` */
 export declare const hashAccessToken: (token: string) => string;
-export interface MintedToken {
-    token: string;
-    hash: string;
-    display: string;
-}
-/** Mint one token: the plaintext (returned once), its hash (stored) and its display form. */
-export declare const mintAccessToken: (prefix: string) => MintedToken;
 //# sourceMappingURL=hash.d.ts.map

package/build/hash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,UAAW,MAAM,KAAG,MAA6D,CAAA;AAE7G,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,6FAA6F;AAC7F,eAAO,MAAM,eAAe,WAAY,MAAM,KAAG,WAIhD,CAAA"}
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEtD,eAAO,MAAM,qBAAqB,QAAO,eAUxC,CAAA;AAED,eAAO,MAAM,eAAe,iBAA0B,CAAA;AAEtD,qFAAqF;AACrF,eAAO,MAAM,eAAe,UAAW,MAAM,KAAG,MAAgD,CAAA"}

package/build/hash.js

@@ -1,19 +1,16 @@
-import { AUTH_TOKEN_SECRET_BYTES, displayOf } from '@owlmeans/auth-token';
+import { AUTH_TOKEN_SECRET_BYTES, tokenFormatHelper } from '@owlmeans/auth-token';
 import { base58 } from '@scure/base';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex, randomBytes } from '@noble/hashes/utils';
-/**
- * The stored form of a token.
- *
- * SHA-256 rather than a password hash on purpose: the input is 192 bits of machine-generated
- * randomness, so there is no dictionary to slow down, and the hash is computed on every single
- * API request — a deliberately slow function here would be a deliberate rate limit on the
- * deployment's whole authenticated surface.
- */
-export const hashAccessToken = (token) => bytesToHex(sha256(new TextEncoder().encode(token)));
-/** Mint one token: the plaintext (returned once), its hash (stored) and its display form. */
-export const mintAccessToken = (prefix) => {
-    const token = `${prefix}${base58.encode(randomBytes(AUTH_TOKEN_SECRET_BYTES))}`;
-    return { token, hash: hashAccessToken(token), display: displayOf(token, prefix) };
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex, randomBytes } from '@noble/hashes/utils.js';
+export const createTokenHashHelper = () => {
+    const hashAccessToken = (token) => bytesToHex(sha256(new TextEncoder().encode(token)));
+    const mintAccessToken = (prefix) => {
+        const token = `${prefix}${base58.encode(randomBytes(AUTH_TOKEN_SECRET_BYTES))}`;
+        return { token, hash: hashAccessToken(token), display: tokenFormatHelper.displayOf(token, prefix) };
+    };
+    return { hashAccessToken, mintAccessToken };
 };
+export const tokenHashHelper = createTokenHashHelper();
+/** @deprecated compat:factory-refactor — use `tokenHashHelper.hashAccessToken(…)` */
+export const hashAccessToken = (token) => tokenHashHelper.hashAccessToken(token);
 //# sourceMappingURL=hash.js.map

package/build/hash.js.map

@@ -1 +1 @@
-{"version":3,"file":"hash.js","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAE7D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAQ7G,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAe,EAAE;IAC7D,MAAM,KAAK,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAA;IAE/E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAA;AACnF,CAAC,CAAA"}
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAIhE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAoB,EAAE;IACzD,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEtG,MAAM,eAAe,GAAG,CAAC,MAAc,EAAe,EAAE;QACtD,MAAM,KAAK,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAA;QAE/E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAA;IACrG,CAAC,CAAA;IAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAA;AAEtD,qFAAqF;AACrF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA"}

package/build/index.d.ts

@@ -1,9 +1,12 @@
 export * from './consts.js';
 export * from './resource.js';
+export * from './prefix.js';
 export * from './guard.js';
 export * from './hash.js';
 export * from './coguard.js';
 export * from './append.js';
 export * from './handlers/index.js';
+export type * from './handlers/types.js';
 export type * from './types.js';
+export type * from './hash/types.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,mBAAmB,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,mBAAmB,qBAAqB,CAAA;AACxC,mBAAmB,YAAY,CAAA;AAC/B,mBAAmB,iBAAiB,CAAA"}

package/build/index.js

@@ -1,5 +1,6 @@
 export * from './consts.js';
 export * from './resource.js';
+export * from './prefix.js';
 export * from './guard.js';
 export * from './hash.js';
 export * from './coguard.js';

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA"}

package/build/prefix.d.ts

@@ -0,0 +1,4 @@
+import type { AuthTokenContext, AuthTokenGuardOptions } from './types.js';
+/** Where the deployment's prefix comes from: the guard's own options, then config, then default. */
+export declare const prefixOf: (context: AuthTokenContext, opts?: AuthTokenGuardOptions) => string;
+//# sourceMappingURL=prefix.d.ts.map

package/build/prefix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prefix.d.ts","sourceRoot":"","sources":["../src/prefix.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAE1F,oGAAoG;AACpG,eAAO,MAAM,QAAQ,YAAa,gBAAgB,SAAS,qBAAqB,KAAG,MACc,CAAA"}

package/build/prefix.js

@@ -0,0 +1,4 @@
+import { AUTH_TOKEN_DEFAULT_PREFIX } from '@owlmeans/auth-token';
+/** Where the deployment's prefix comes from: the guard's own options, then config, then default. */
+export const prefixOf = (context, opts) => opts?.prefix ?? context.cfg.authToken?.prefix ?? AUTH_TOKEN_DEFAULT_PREFIX;
+//# sourceMappingURL=prefix.js.map

package/build/prefix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prefix.js","sourceRoot":"","sources":["../src/prefix.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAGhE,oGAAoG;AACpG,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAyB,EAAE,IAA4B,EAAU,EAAE,CAC1F,IAAI,EAAE,MAAM,IAAK,OAAO,CAAC,GAAuB,CAAC,SAAS,EAAE,MAAM,IAAI,yBAAyB,CAAA"}

package/build/types.d.ts

@@ -48,4 +48,9 @@ export interface AuthTokenConfig extends ServerConfig {
     };
 }
 export type AuthTokenContext<C extends AuthTokenConfig = AuthTokenConfig> = ServerContext<C>;
+export interface MintedToken {
+    token: string;
+    hash: string;
+    display: string;
+}
 //# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAE3E,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAA;AAElE,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,EAAE,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,SAAS,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI,aAAa,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAE3E,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAA;AAElE,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,EAAE,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,SAAS,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI,aAAa,CAAC,CAAC,CAAC,CAAA;AAE5F,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth-token",
-  "version": "0.1.18-rc.30",
+  "version": "0.1.18-rc.32",
   "license": "MIT",
   "description": "The server half of OwlMeans access tokens — the store, the guard that verifies a presented token, the management handlers and the coguard that admits one on an existing route.",
   "type": "module",
@@ -23,23 +23,23 @@
     }
   },
   "dependencies": {
-    "@noble/hashes": "^1.5.0",
-    "@owlmeans/auth": "^0.1.18-rc.38",
-    "@owlmeans/auth-common": "^0.1.18-rc.45",
-    "@owlmeans/auth-token": "^0.1.18-rc.30",
-    "@owlmeans/context": "^0.1.18-rc.32",
-    "@owlmeans/entrypoint": "^0.1.18-rc.39",
-    "@owlmeans/log": "^0.1.18-rc.0",
-    "@owlmeans/mongo-resource": "^0.1.18-rc.41",
-    "@owlmeans/resource": "^0.1.18-rc.38",
-    "@owlmeans/server-api": "^0.1.18-rc.49",
-    "@owlmeans/server-auth-identity": "^0.1.18-rc.45",
-    "@owlmeans/server-context": "^0.1.18-rc.41",
-    "@scure/base": "^1.1.9"
+    "@noble/hashes": "^2.4.0",
+    "@owlmeans/auth": "^0.1.18-rc.40",
+    "@owlmeans/auth-common": "^0.1.18-rc.47",
+    "@owlmeans/auth-token": "^0.1.18-rc.32",
+    "@owlmeans/context": "^0.1.18-rc.34",
+    "@owlmeans/entrypoint": "^0.1.18-rc.41",
+    "@owlmeans/log": "^0.1.18-rc.2",
+    "@owlmeans/mongo-resource": "^0.1.18-rc.43",
+    "@owlmeans/resource": "^0.1.18-rc.40",
+    "@owlmeans/server-api": "^0.1.18-rc.51",
+    "@owlmeans/server-auth-identity": "^0.1.18-rc.47",
+    "@owlmeans/server-context": "^0.1.18-rc.43",
+    "@scure/base": "^2.4.0"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@types/bun": "^1.4.0",
+    "@types/bun": "^1.4.2",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },

package/src/guard.ts

@@ -1,8 +1,8 @@
 import type { Auth } from '@owlmeans/auth'
 import { ALL_SCOPES, AuthroizationType } from '@owlmeans/auth'
 import {
-  AUTH_TOKEN_DEFAULT_PREFIX, AUTH_TOKEN_SCHEME, AUTH_TOKEN_RESOURCE, AUTH_TOKEN_TOUCH_INTERVAL,
-  BEARER_SCHEME, GUARD_AUTH_TOKEN, isAccessToken, parseAuthorizationHeader
+  AUTH_TOKEN_SCHEME, AUTH_TOKEN_RESOURCE, AUTH_TOKEN_TOUCH_INTERVAL,
+  BEARER_SCHEME, GUARD_AUTH_TOKEN, tokenFormatHelper
 } from '@owlmeans/auth-token'
 import { AUTH_HEADER } from '@owlmeans/auth'
 import { ENTITY_RESOLVER } from '@owlmeans/auth-common'
@@ -11,13 +11,12 @@ import { createService } from '@owlmeans/context'
 import type { AbstractRequest, AbstractResponse, GuardService } from '@owlmeans/entrypoint'
 import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity'
 import type { IdentityProfile, IdentityProfileResource } from '@owlmeans/server-auth-identity'
-import { hashAccessToken } from './hash.js'
+import { tokenHashHelper } from './hash.js'
+import { prefixOf } from './prefix.js'
 import type { AccessTokenResource, AuthTokenConfig, AuthTokenContext, AuthTokenGuardOptions } from './types.js'
 import { logger, logThrottle } from '@owlmeans/log'
 
-/** Where the deployment's prefix comes from: the guard's own options, then config, then default. */
-export const prefixOf = (context: AuthTokenContext, opts?: AuthTokenGuardOptions): string =>
-  opts?.prefix ?? (context.cfg as AuthTokenConfig).authToken?.prefix ?? AUTH_TOKEN_DEFAULT_PREFIX
+const log = logger('server-auth-token')
 
 /**
  * The guard that verifies a long-lived access token.
@@ -37,32 +36,30 @@ export const prefixOf = (context: AuthTokenContext, opts?: AuthTokenGuardOptions
  * - it intersects the token's scopes with its profile's on every request, so a token can never
  *   outlive or outrank the person who minted it.
  */
-const log = logger('server-auth-token')
-
-/**
- * A presented access token the guard did not accept. Never the token, not even its display form:
- * its record id only. Once a minute per token and reason — a client retrying a revoked token calls every second.
- */
-const refuse = (reason: string, record?: { id?: string, entityId?: string }): false => {
-  if (logThrottle(`auth-token:${reason}:${record?.id ?? ''}`, 60_000)) {
-    log.warn('Access token refused', {
-      reason, tokenId: record?.id, entityId: record?.entityId,
-    }, { event: 'auth.refused' })
-  }
-  return false
-}
-
 export const makeAuthTokenGuard = (
   alias: string = GUARD_AUTH_TOKEN, opts: AuthTokenGuardOptions = {}
 ): GuardService => {
+  /**
+   * A presented access token the guard did not accept. Never the token, not even its display form:
+   * its record id only. Once a minute per token and reason — a client retrying a revoked token calls every second.
+   */
+  const refuse = (reason: string, record?: { id?: string, entityId?: string }): false => {
+    if (logThrottle(`auth-token:${reason}:${record?.id ?? ''}`, 60_000)) {
+      log.warn('Access token refused', {
+        reason, tokenId: record?.id, entityId: record?.entityId,
+      }, { event: 'auth.refused' })
+    }
+    return false
+  }
+
   const touchInterval = opts.touchInterval ?? AUTH_TOKEN_TOUCH_INTERVAL
 
   const present = (req: Partial<AbstractRequest>, prefix: string): string | null => {
-    const parsed = parseAuthorizationHeader(req.headers?.[AUTH_HEADER])
+    const parsed = tokenFormatHelper.parseAuthorizationHeader(req.headers?.[AUTH_HEADER])
     if (parsed == null) return null
     if (parsed.scheme !== AUTH_TOKEN_SCHEME && parsed.scheme !== BEARER_SCHEME) return null
 
-    return isAccessToken(parsed.value, prefix) ? parsed.value : null
+    return tokenFormatHelper.isAccessToken(parsed.value, prefix) ? parsed.value : null
   }
 
   const service: GuardService = createService<GuardService>(alias, {
@@ -87,7 +84,7 @@ export const makeAuthTokenGuard = (
       if (presented == null) return false as T
 
       const tokens = context.resource<AccessTokenResource>(opts.resourceAlias ?? AUTH_TOKEN_RESOURCE)
-      const record = await tokens.load({ hash: hashAccessToken(presented) })
+      const record = await tokens.load({ hash: tokenHashHelper.hashAccessToken(presented) })
       if (record == null) return refuse('unknown') as T
       if (record.revokedAt != null) return refuse('revoked', record) as T
       if (record.expiresAt != null && new Date(record.expiresAt) < new Date()) return refuse('expired', record) as T

package/src/handlers/create.ts

@@ -0,0 +1,21 @@
+import { AuthForbidden, AuthRole } from '@owlmeans/auth'
+import type { AuthTokenEntrypoints } from '@owlmeans/auth-token'
+import { makeEntityScope } from '@owlmeans/auth-common'
+import { handlers } from '@owlmeans/server-api'
+import type { AuthTokenContext } from '../types.js'
+import { accessTokenIssuerOf } from './issue.js'
+import { refuseTokenAuth } from './refuse.js'
+
+export const createAccessToken = (protocol: AuthTokenEntrypoints['create']) => handlers<AuthTokenContext>().body(protocol, async (payload, context, req) => {
+  const ctx = context as AuthTokenContext
+  refuseTokenAuth(req, 'token-mint')
+
+  const entityId = makeEntityScope(req).requireEntityKey()
+  const profileId = req.auth?.profileId
+  const userId = req.auth?.userId
+  if (profileId == null || userId == null) throw new AuthForbidden('profile')
+
+  return accessTokenIssuerOf(ctx).issueAccessToken({
+    entityId, profileId, userId, role: req.auth?.role ?? AuthRole.User, scopes: req.auth?.scopes ?? [],
+  }, payload)
+})

package/src/handlers/index.ts

@@ -1,152 +1,17 @@
-import { AuthForbidden, AuthroizationType, ALL_SCOPES, AuthRole } from '@owlmeans/auth'
-import {
-  AUTH_TOKEN_MAX_TTL, AUTH_TOKEN_RESOURCE
-} from '@owlmeans/auth-token'
-import type {
-  AccessTokenList, AccessTokenRecord, AccessTokenView, CreateAccessToken, IssuedAccessToken
-} from '@owlmeans/auth-token'
-import { requireEntityKey } from '@owlmeans/auth-common'
-import { handlers } from '@owlmeans/server-api'
-import { mintAccessToken } from '../hash.js'
-import { prefixOf } from '../guard.js'
-import type { AccessTokenResource, AuthTokenContext } from '../types.js'
-import type { AuthTokenEntrypoints } from '@owlmeans/auth-token'
+import type { IssuedAccessToken } from '@owlmeans/auth-token'
+import type { AuthTokenContext } from '../types.js'
+import { accessTokenIssuerOf } from './issue.js'
+import type { IssueAccessTokenRequest, IssueAccessTokenSubject } from './types.js'
 
-const view = (record: AccessTokenRecord): AccessTokenView => {
-  const { hash, ...rest } = record
+export * from './refuse.js'
+export * from './issue.js'
+export * from './list.js'
+export * from './create.js'
+export * from './revoke.js'
 
-  return rest
-}
+export type { IssueAccessTokenRequest, IssueAccessTokenSubject } from './types.js'
 
-const tokens = (ctx: AuthTokenContext): AccessTokenResource =>
-  ctx.resource<AccessTokenResource>(AUTH_TOKEN_RESOURCE)
-
-/**
- * A token may never mint another token.
- *
- * Minting is the one operation that turns a stolen credential into a permanent one: a token that
- * can create tokens survives the revocation of the token that leaked. Creating and revoking
- * therefore require a credential a person produced in a browser — which is also why the deployment
- * names these routes in the guard's deny list, so the refusal is a 401 at the boundary rather than
- * a check every future handler has to remember.
- *
- * Exported because an OAuth authorization server's consent-approval handler
- * (`@owlmeans/server-oauth`) mints tokens too and needs the exact same guard, over a session it
- * verified itself rather than a route this package bound.
- */
-export const refuseTokenAuth = (req: { auth?: { type?: string } }, what: string): void => {
-  if (req.auth?.type === AuthroizationType.AuthToken) {
-    throw new AuthForbidden(what)
-  }
-}
-
-/** Whoever is minting the token — read once, by whichever caller resolved the session. */
-export interface IssueAccessTokenSubject {
-  entityId: string
-  userId: string
-  profileId: string
-  role: AuthRole
-  /** The subject's OWN scopes — minting can only narrow, never widen, this set. */
-  scopes: string[]
-}
-
-export interface IssueAccessTokenRequest extends CreateAccessToken {
-  /**
-   * The resource(s) this token is FOR (RFC 8707), when it is minted through an OAuth grant.
-   * Absent for a token minted by hand — the ordinary, unrestricted kind.
-   */
-  audience?: string[]
-}
-
-/**
- * Mint one token for `subject`, exactly what `createAccessToken` does over an HTTP body — pulled
- * out so a second caller (an OAuth token endpoint) can mint the SAME shape of record over a
- * session it authenticated its own way, without a duplicate copy of the narrowing rule or the
- * TTL clamp silently drifting from this one.
- */
+/** @deprecated compat:factory-refactor — use `accessTokenIssuerOf(ctx).issueAccessToken(…)` */
 export const issueAccessToken = async (
   ctx: AuthTokenContext, subject: IssueAccessTokenSubject, payload: IssueAccessTokenRequest
-): Promise<IssuedAccessToken> => {
-  const own = subject.scopes
-  const scopes = payload.scopes ?? own
-  // A token is a delegation, so it can only ever narrow. Asking for a scope the caller does not
-  // hold is refused rather than silently dropped: a token that quietly grants less than it was
-  // asked for fails later, somewhere else, with an error about the wrong thing.
-  if (!own.includes(ALL_SCOPES) && scopes.some(scope => !own.includes(scope))) {
-    throw new AuthForbidden('scope')
-  }
-
-  // The SAME resolver the guard uses, so a minted token is one this deployment's guard claims.
-  const minted = mintAccessToken(prefixOf(ctx))
-  const now = new Date()
-  const record = await tokens(ctx).create({
-    hash: minted.hash,
-    display: minted.display,
-    name: payload.name,
-    userId: subject.userId,
-    profileId: subject.profileId,
-    entityId: subject.entityId,
-    scopes,
-    role: subject.role,
-    createdAt: now,
-    ...(payload.audience != null ? { audience: payload.audience } : {}),
-    ...(payload.expiresIn != null
-      ? { expiresAt: new Date(now.getTime() + Math.min(payload.expiresIn * 1000, AUTH_TOKEN_MAX_TTL)) }
-      : {}),
-  } as AccessTokenRecord)
-
-  // The only moment the plaintext exists outside the caller's own machine.
-  return { token: minted.token, record: view(record) } satisfies IssuedAccessToken
-}
-
-export const listAccessTokens = (protocol: AuthTokenEntrypoints['list']) => handlers<AuthTokenContext>().request(protocol, async (req, context) => {
-  const ctx = context as AuthTokenContext
-  const entityId = requireEntityKey(req)
-  const profileId = req.auth?.profileId
-  if (profileId == null) throw new AuthForbidden('profile')
-
-  const result = await tokens(ctx).list({ entityId, profileId }, { size: 0 })
-
-  return {
-    items: result.items
-      .map(view)
-      .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()),
-  } satisfies AccessTokenList
-})
-
-export const createAccessToken = (protocol: AuthTokenEntrypoints['create']) => handlers<AuthTokenContext>().body(protocol, async (payload, context, req) => {
-  const ctx = context as AuthTokenContext
-  refuseTokenAuth(req, 'token-mint')
-
-  const entityId = requireEntityKey(req)
-  const profileId = req.auth?.profileId
-  const userId = req.auth?.userId
-  if (profileId == null || userId == null) throw new AuthForbidden('profile')
-
-  return issueAccessToken(ctx, {
-    entityId, profileId, userId, role: req.auth?.role ?? AuthRole.User, scopes: req.auth?.scopes ?? [],
-  }, payload)
-})
-
-export const revokeAccessToken = (protocol: AuthTokenEntrypoints['revoke']) => handlers<AuthTokenContext>().params(protocol, async (payload, context, req) => {
-  const ctx = context as AuthTokenContext
-  refuseTokenAuth(req, 'token-revoke')
-
-  const entityId = requireEntityKey(req)
-  const profileId = req.auth?.profileId
-  if (profileId == null) throw new AuthForbidden('profile')
-
-  const record = await tokens(ctx).load(payload.id)
-  // A token of another profile answers exactly as an unknown id does — an owner learns nothing
-  // about tokens that are not theirs, not even that one exists.
-  if (record == null || record.entityId !== entityId || record.profileId !== profileId) {
-    throw new AuthForbidden('token')
-  }
-
-  // Idempotent: revoking twice is what a retry looks like.
-  if (record.revokedAt == null) {
-    await tokens(ctx).save({ ...record, revokedAt: new Date(), updatedAt: new Date() })
-  }
-
-  return { id: payload.id }
-})
+): Promise<IssuedAccessToken> => await accessTokenIssuerOf(ctx).issueAccessToken(subject, payload)