@owlmeans/server-auth-token 0.1.18-rc.30 → 0.1.18-rc.32

package/src/handlers/issue.ts

@@ -0,0 +1,50 @@
+import { AuthForbidden, ALL_SCOPES } from '@owlmeans/auth'
+import { AUTH_TOKEN_MAX_TTL, type AccessTokenRecord, type IssuedAccessToken } from '@owlmeans/auth-token'
+import { memoHelper } from '@owlmeans/context'
+import { tokenHashHelper } from '../hash.js'
+import { prefixOf } from '../prefix.js'
+import type { AuthTokenContext } from '../types.js'
+import type { AccessTokenIssuer, IssueAccessTokenRequest, IssueAccessTokenSubject } from './types.js'
+import { tokenRecordUtils } from './utils.js'
+
+export const makeAccessTokenIssuer = (ctx: AuthTokenContext): AccessTokenIssuer => {
+  const issueAccessToken = async (
+    subject: IssueAccessTokenSubject, payload: IssueAccessTokenRequest
+  ): Promise<IssuedAccessToken> => {
+    const own = subject.scopes
+    const scopes = payload.scopes ?? own
+    // A token is a delegation, so it can only ever narrow. Asking for a scope the caller does not
+    // hold is refused rather than silently dropped: a token that quietly grants less than it was
+    // asked for fails later, somewhere else, with an error about the wrong thing.
+    if (!own.includes(ALL_SCOPES) && scopes.some(scope => !own.includes(scope))) {
+      throw new AuthForbidden('scope')
+    }
+
+    // The SAME resolver the guard uses, so a minted token is one this deployment's guard claims.
+    const minted = tokenHashHelper.mintAccessToken(prefixOf(ctx))
+    const now = new Date()
+    const record = await tokenRecordUtils.tokens(ctx).create({
+      hash: minted.hash,
+      display: minted.display,
+      name: payload.name,
+      userId: subject.userId,
+      profileId: subject.profileId,
+      entityId: subject.entityId,
+      scopes,
+      role: subject.role,
+      createdAt: now,
+      ...(payload.audience != null ? { audience: payload.audience } : {}),
+      ...(payload.expiresIn != null
+        ? { expiresAt: new Date(now.getTime() + Math.min(payload.expiresIn * 1000, AUTH_TOKEN_MAX_TTL)) }
+        : {}),
+    } as AccessTokenRecord)
+
+    // The only moment the plaintext exists outside the caller's own machine.
+    return { token: minted.token, record: tokenRecordUtils.view(record) } satisfies IssuedAccessToken
+  }
+
+  return { issueAccessToken }
+}
+
+/** The token issuer of a context — one per context. */
+export const accessTokenIssuerOf = memoHelper.oncePer(makeAccessTokenIssuer)

package/src/handlers/list.ts

@@ -0,0 +1,21 @@
+import { AuthForbidden } from '@owlmeans/auth'
+import type { AccessTokenList, AuthTokenEntrypoints } from '@owlmeans/auth-token'
+import { makeEntityScope } from '@owlmeans/auth-common'
+import { handlers } from '@owlmeans/server-api'
+import type { AuthTokenContext } from '../types.js'
+import { tokenRecordUtils } from './utils.js'
+
+export const listAccessTokens = (protocol: AuthTokenEntrypoints['list']) => handlers<AuthTokenContext>().request(protocol, async (req, context) => {
+  const ctx = context as AuthTokenContext
+  const entityId = makeEntityScope(req).requireEntityKey()
+  const profileId = req.auth?.profileId
+  if (profileId == null) throw new AuthForbidden('profile')
+
+  const result = await tokenRecordUtils.tokens(ctx).list({ entityId, profileId }, { size: 0 })
+
+  return {
+    items: result.items
+      .map(tokenRecordUtils.view)
+      .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()),
+  } satisfies AccessTokenList
+})

package/src/handlers/refuse.ts

@@ -0,0 +1,20 @@
+import { AuthForbidden, AuthroizationType } from '@owlmeans/auth'
+
+/**
+ * A token may never mint another token.
+ *
+ * Minting is the one operation that turns a stolen credential into a permanent one: a token that
+ * can create tokens survives the revocation of the token that leaked. Creating and revoking
+ * therefore require a credential a person produced in a browser — which is also why the deployment
+ * names these routes in the guard's deny list, so the refusal is a 401 at the boundary rather than
+ * a check every future handler has to remember.
+ *
+ * Exported because an OAuth authorization server's consent-approval handler
+ * (`@owlmeans/server-oauth`) mints tokens too and needs the exact same guard, over a session it
+ * verified itself rather than a route this package bound.
+ */
+export const refuseTokenAuth = (req: { auth?: { type?: string } }, what: string): void => {
+  if (req.auth?.type === AuthroizationType.AuthToken) {
+    throw new AuthForbidden(what)
+  }
+}

package/src/handlers/revoke.ts

@@ -0,0 +1,30 @@
+import { AuthForbidden } from '@owlmeans/auth'
+import type { AuthTokenEntrypoints } from '@owlmeans/auth-token'
+import { makeEntityScope } from '@owlmeans/auth-common'
+import { handlers } from '@owlmeans/server-api'
+import type { AuthTokenContext } from '../types.js'
+import { refuseTokenAuth } from './refuse.js'
+import { tokenRecordUtils } from './utils.js'
+
+export const revokeAccessToken = (protocol: AuthTokenEntrypoints['revoke']) => handlers<AuthTokenContext>().params(protocol, async (payload, context, req) => {
+  const ctx = context as AuthTokenContext
+  refuseTokenAuth(req, 'token-revoke')
+
+  const entityId = makeEntityScope(req).requireEntityKey()
+  const profileId = req.auth?.profileId
+  if (profileId == null) throw new AuthForbidden('profile')
+
+  const record = await tokenRecordUtils.tokens(ctx).load(payload.id)
+  // A token of another profile answers exactly as an unknown id does — an owner learns nothing
+  // about tokens that are not theirs, not even that one exists.
+  if (record == null || record.entityId !== entityId || record.profileId !== profileId) {
+    throw new AuthForbidden('token')
+  }
+
+  // Idempotent: revoking twice is what a retry looks like.
+  if (record.revokedAt == null) {
+    await tokenRecordUtils.tokens(ctx).save({ ...record, revokedAt: new Date(), updatedAt: new Date() })
+  }
+
+  return { id: payload.id }
+})

package/src/handlers/types.ts

@@ -0,0 +1,31 @@
+import { AuthRole } from '@owlmeans/auth'
+import type { CreateAccessToken, IssuedAccessToken } from '@owlmeans/auth-token'
+
+/** Whoever is minting the token — read once, by whichever caller resolved the session. */
+export interface IssueAccessTokenSubject {
+  entityId: string
+  userId: string
+  profileId: string
+  role: AuthRole
+  /** The subject's OWN scopes — minting can only narrow, never widen, this set. */
+  scopes: string[]
+}
+
+export interface IssueAccessTokenRequest extends CreateAccessToken {
+  /**
+   * The resource(s) this token is FOR (RFC 8707), when it is minted through an OAuth grant.
+   * Absent for a token minted by hand — the ordinary, unrestricted kind.
+   */
+  audience?: string[]
+}
+
+/** Token issuance over one context's store — the one path every minting caller goes through. */
+export interface AccessTokenIssuer {
+  /**
+   * Mint one token for `subject`, exactly what `createAccessToken` does over an HTTP body — pulled
+   * out so a second caller (an OAuth token endpoint) can mint the SAME shape of record over a
+   * session it authenticated its own way, without a duplicate copy of the narrowing rule or the
+   * TTL clamp silently drifting from this one.
+   */
+  issueAccessToken: (subject: IssueAccessTokenSubject, payload: IssueAccessTokenRequest) => Promise<IssuedAccessToken>
+}

package/src/handlers/utils/types.ts

@@ -0,0 +1,10 @@
+import type { AccessTokenRecord, AccessTokenView } from '@owlmeans/auth-token'
+import type { AccessTokenResource, AuthTokenContext } from '../../types.js'
+
+/** What every token handler shares: the store and the view a caller may see. */
+export interface TokenRecordUtils {
+  /** A record without its hash — the hash never leaves the server. */
+  view: (record: AccessTokenRecord) => AccessTokenView
+  /** The token store of a context. */
+  tokens: (ctx: AuthTokenContext) => AccessTokenResource
+}

package/src/handlers/utils.ts

@@ -0,0 +1,18 @@
+import { AUTH_TOKEN_RESOURCE, type AccessTokenRecord, type AccessTokenView } from '@owlmeans/auth-token'
+import type { AccessTokenResource, AuthTokenContext } from '../types.js'
+import type { TokenRecordUtils } from './utils/types.js'
+
+export const createTokenRecordUtils = (): TokenRecordUtils => {
+  const view = (record: AccessTokenRecord): AccessTokenView => {
+    const { hash, ...rest } = record
+
+    return rest
+  }
+
+  const tokens = (ctx: AuthTokenContext): AccessTokenResource =>
+    ctx.resource<AccessTokenResource>(AUTH_TOKEN_RESOURCE)
+
+  return { view, tokens }
+}
+
+export const tokenRecordUtils = createTokenRecordUtils()

package/src/hash/types.ts

@@ -0,0 +1,16 @@
+import type { MintedToken } from '../types.js'
+
+/** Access tokens minted and stored: the plaintext once, the hash forever. */
+export interface TokenHashHelper {
+  /**
+   * The stored form of a token.
+   *
+   * SHA-256 rather than a password hash on purpose: the input is 192 bits of machine-generated
+   * randomness, so there is no dictionary to slow down, and the hash is computed on every single
+   * API request — a deliberately slow function here would be a deliberate rate limit on the
+   * deployment's whole authenticated surface.
+   */
+  hashAccessToken: (token: string) => string
+  /** Mint one token: the plaintext (returned once), its hash (stored) and its display form. */
+  mintAccessToken: (prefix: string) => MintedToken
+}

package/src/hash.ts

@@ -1,27 +1,23 @@
-import { AUTH_TOKEN_SECRET_BYTES, displayOf } from '@owlmeans/auth-token'
+import { AUTH_TOKEN_SECRET_BYTES, tokenFormatHelper } from '@owlmeans/auth-token'
 import { base58 } from '@scure/base'
-import { sha256 } from '@noble/hashes/sha256'
-import { bytesToHex, randomBytes } from '@noble/hashes/utils'
+import { sha256 } from '@noble/hashes/sha2.js'
+import { bytesToHex, randomBytes } from '@noble/hashes/utils.js'
+import type { MintedToken } from './types.js'
+import type { TokenHashHelper } from './hash/types.js'
 
-/**
- * The stored form of a token.
- *
- * SHA-256 rather than a password hash on purpose: the input is 192 bits of machine-generated
- * randomness, so there is no dictionary to slow down, and the hash is computed on every single
- * API request — a deliberately slow function here would be a deliberate rate limit on the
- * deployment's whole authenticated surface.
- */
-export const hashAccessToken = (token: string): string => bytesToHex(sha256(new TextEncoder().encode(token)))
+export const createTokenHashHelper = (): TokenHashHelper => {
+  const hashAccessToken = (token: string): string => bytesToHex(sha256(new TextEncoder().encode(token)))
 
-export interface MintedToken {
-  token: string
-  hash: string
-  display: string
-}
+  const mintAccessToken = (prefix: string): MintedToken => {
+    const token = `${prefix}${base58.encode(randomBytes(AUTH_TOKEN_SECRET_BYTES))}`
 
-/** Mint one token: the plaintext (returned once), its hash (stored) and its display form. */
-export const mintAccessToken = (prefix: string): MintedToken => {
-  const token = `${prefix}${base58.encode(randomBytes(AUTH_TOKEN_SECRET_BYTES))}`
+    return { token, hash: hashAccessToken(token), display: tokenFormatHelper.displayOf(token, prefix) }
+  }
 
-  return { token, hash: hashAccessToken(token), display: displayOf(token, prefix) }
+  return { hashAccessToken, mintAccessToken }
 }
+
+export const tokenHashHelper = createTokenHashHelper()
+
+/** @deprecated compat:factory-refactor — use `tokenHashHelper.hashAccessToken(…)` */
+export const hashAccessToken = (token: string): string => tokenHashHelper.hashAccessToken(token)

package/src/index.ts

@@ -1,8 +1,11 @@
 export * from './consts.js'
 export * from './resource.js'
+export * from './prefix.js'
 export * from './guard.js'
 export * from './hash.js'
 export * from './coguard.js'
 export * from './append.js'
 export * from './handlers/index.js'
+export type * from './handlers/types.js'
 export type * from './types.js'
+export type * from './hash/types.js'

package/src/prefix.ts

@@ -0,0 +1,6 @@
+import { AUTH_TOKEN_DEFAULT_PREFIX } from '@owlmeans/auth-token'
+import type { AuthTokenConfig, AuthTokenContext, AuthTokenGuardOptions } from './types.js'
+
+/** Where the deployment's prefix comes from: the guard's own options, then config, then default. */
+export const prefixOf = (context: AuthTokenContext, opts?: AuthTokenGuardOptions): string =>
+  opts?.prefix ?? (context.cfg as AuthTokenConfig).authToken?.prefix ?? AUTH_TOKEN_DEFAULT_PREFIX

package/src/types.ts

@@ -52,3 +52,9 @@ export interface AuthTokenConfig extends ServerConfig {
 }
 
 export type AuthTokenContext<C extends AuthTokenConfig = AuthTokenConfig> = ServerContext<C>
+
+export interface MintedToken {
+  token: string
+  hash: string
+  display: string
+}

package/tests/guard.spec.ts

@@ -2,7 +2,7 @@ import { describe, expect, test } from 'bun:test'
 import { AuthroizationType } from '@owlmeans/auth'
 import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token'
 import type { GuardService } from '@owlmeans/entrypoint'
-import { hashAccessToken } from '../src/hash.js'
+import { tokenHashHelper } from '../src/hash.js'
 import {
   makeTestContext, request, response, seedProfile, seedToken, TEST_ENTITY, TEST_PREFIX, TEST_PROFILE
 } from './context.js'
@@ -12,7 +12,7 @@ const TOKEN = `${TEST_PREFIX}averylongrandomsecretvalue`
 const armed = async (opts = {}) => {
   const context = await makeTestContext(opts)
   await seedProfile(context)
-  await seedToken(context, hashAccessToken(TOKEN))
+  await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN))
 
   return { context, guard: context.service<GuardService>(GUARD_AUTH_TOKEN) }
 }
@@ -60,7 +60,7 @@ describe('@owlmeans/server-auth-token — what the guard resolves', () => {
   test('a token can never outrank its profile', async () => {
     const context = await makeTestContext()
     await seedProfile(context, { scopes: ['project:read'] })
-    await seedToken(context, hashAccessToken(TOKEN), { scopes: ['*', 'project:write'] })
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN), { scopes: ['*', 'project:write'] })
     const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
     const res = response()
 
@@ -71,7 +71,7 @@ describe('@owlmeans/server-auth-token — what the guard resolves', () => {
   test('refuses a revoked token', async () => {
     const context = await makeTestContext()
     await seedProfile(context)
-    await seedToken(context, hashAccessToken(TOKEN), { revokedAt: new Date() })
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN), { revokedAt: new Date() })
     const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
 
     expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
@@ -80,7 +80,7 @@ describe('@owlmeans/server-auth-token — what the guard resolves', () => {
   test('refuses an expired token', async () => {
     const context = await makeTestContext()
     await seedProfile(context)
-    await seedToken(context, hashAccessToken(TOKEN), { expiresAt: new Date(Date.now() - 1000) })
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN), { expiresAt: new Date(Date.now() - 1000) })
     const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
 
     expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
@@ -94,7 +94,7 @@ describe('@owlmeans/server-auth-token — what the guard resolves', () => {
 
   test('refuses when the profile behind it is gone — revoking a person revokes their tokens', async () => {
     const context = await makeTestContext()
-    await seedToken(context, hashAccessToken(TOKEN))
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN))
     const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
 
     expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
@@ -103,7 +103,7 @@ describe('@owlmeans/server-auth-token — what the guard resolves', () => {
   test('refuses when the profile has expired', async () => {
     const context = await makeTestContext()
     await seedProfile(context, { expiresAt: new Date(Date.now() - 1000) })
-    await seedToken(context, hashAccessToken(TOKEN))
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN))
     const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
 
     expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
@@ -126,7 +126,7 @@ describe('@owlmeans/server-auth-token — audience admission', () => {
   test('a token scoped to a resource is refused by a guard for a different one', async () => {
     const context = await makeTestContext({ resources: ['https://api.example.com'] })
     await seedProfile(context)
-    await seedToken(context, hashAccessToken(TOKEN), { audience: ['https://api.example.com/mcp'] })
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN), { audience: ['https://api.example.com/mcp'] })
     const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
 
     expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
@@ -135,7 +135,7 @@ describe('@owlmeans/server-auth-token — audience admission', () => {
   test('a token scoped to a resource is admitted by a guard configured for it', async () => {
     const context = await makeTestContext({ resources: ['https://api.example.com/mcp', 'https://api.example.com'] })
     await seedProfile(context)
-    await seedToken(context, hashAccessToken(TOKEN), { audience: ['https://api.example.com/mcp'] })
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN), { audience: ['https://api.example.com/mcp'] })
     const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
 
     expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(true)
@@ -144,7 +144,7 @@ describe('@owlmeans/server-auth-token — audience admission', () => {
   test('a guard that never opted in ignores audience entirely — full backward compatibility', async () => {
     const context = await makeTestContext()
     await seedProfile(context)
-    await seedToken(context, hashAccessToken(TOKEN), { audience: ['https://api.example.com/mcp'] })
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN), { audience: ['https://api.example.com/mcp'] })
     const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
 
     expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(true)
@@ -153,7 +153,7 @@ describe('@owlmeans/server-auth-token — audience admission', () => {
   test('a function `resources` option is resolved with the live context, not cached from registration', async () => {
     const context = await makeTestContext({ resources: () => ['https://api.example.com'] })
     await seedProfile(context)
-    await seedToken(context, hashAccessToken(TOKEN), { audience: ['https://api.example.com'] })
+    await seedToken(context, tokenHashHelper.hashAccessToken(TOKEN), { audience: ['https://api.example.com'] })
     const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
 
     expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(true)
@@ -162,11 +162,11 @@ describe('@owlmeans/server-auth-token — audience admission', () => {
 
 describe('@owlmeans/server-auth-token — the hash at rest', () => {
   test('the stored value is not the token', () => {
-    const hash = hashAccessToken(TOKEN)
+    const hash = tokenHashHelper.hashAccessToken(TOKEN)
 
     expect(hash).not.toBe(TOKEN)
     expect(hash).toMatch(/^[0-9a-f]{64}$/)
-    expect(hashAccessToken(TOKEN)).toBe(hash)
-    expect(hashAccessToken(`${TOKEN}x`)).not.toBe(hash)
+    expect(tokenHashHelper.hashAccessToken(TOKEN)).toBe(hash)
+    expect(tokenHashHelper.hashAccessToken(`${TOKEN}x`)).not.toBe(hash)
   })
 })

package/tests/handlers.spec.ts

@@ -7,8 +7,8 @@ import {
   listAccessTokens as bindListAccessTokens,
   revokeAccessToken as bindRevokeAccessToken,
 } from '../src/handlers/index.js'
-import { hashAccessToken } from '../src/hash.js'
-import { issueAccessToken } from '../src/handlers/index.js'
+import { tokenHashHelper } from '../src/hash.js'
+import { accessTokenIssuerOf } from '../src/handlers/index.js'
 import { makeTestContext, seedProfile, seedToken, TEST_ENTITY, TEST_PREFIX, TEST_PROFILE, TEST_USER } from './context.js'
 
 /**
@@ -58,7 +58,7 @@ describe('@owlmeans/server-auth-token — minting', () => {
     // The view a caller sees carries no hash at all.
     expect((issued.record as unknown as AccessTokenRecord).hash).toBeUndefined()
 
-    const stored = await context.resource<any>(AUTH_TOKEN_RESOURCE).load({ hash: hashAccessToken(issued.token) })
+    const stored = await context.resource<any>(AUTH_TOKEN_RESOURCE).load({ hash: tokenHashHelper.hashAccessToken(issued.token) })
     expect(stored).not.toBeNull()
     expect(stored.hash).not.toBe(issued.token)
   })
@@ -110,10 +110,10 @@ describe('@owlmeans/server-auth-token — issueAccessToken (the OAuth server\'s
     const context = await makeTestContext()
     const subject = { entityId: TEST_ENTITY, profileId: TEST_PROFILE, userId: TEST_USER, role: AuthRole.User, scopes: ['*'] }
 
-    const withAudience = await issueAccessToken(context, subject, { name: 'mcp', audience: ['https://api.example.com/mcp'] })
+    const withAudience = await accessTokenIssuerOf(context).issueAccessToken(subject, { name: 'mcp', audience: ['https://api.example.com/mcp'] })
     expect(withAudience.record.audience).toEqual(['https://api.example.com/mcp'])
 
-    const withoutAudience = await issueAccessToken(context, subject, { name: 'hand-minted' })
+    const withoutAudience = await accessTokenIssuerOf(context).issueAccessToken(subject, { name: 'hand-minted' })
     expect(withoutAudience.record.audience).toBeUndefined()
   })
 
@@ -121,9 +121,9 @@ describe('@owlmeans/server-auth-token — issueAccessToken (the OAuth server\'s
     const context = await makeTestContext()
     const subject = { entityId: TEST_ENTITY, profileId: TEST_PROFILE, userId: TEST_USER, role: AuthRole.User, scopes: ['projects:read'] }
 
-    await expect(issueAccessToken(context, subject, { name: 'x', scopes: ['projects:write'] })).rejects.toThrow()
+    await expect(accessTokenIssuerOf(context).issueAccessToken(subject, { name: 'x', scopes: ['projects:write'] })).rejects.toThrow()
 
-    const issued = await issueAccessToken(context, subject, { name: 'x', expiresIn: 60 * 60 * 24 * 400 })
+    const issued = await accessTokenIssuerOf(context).issueAccessToken(subject, { name: 'x', expiresIn: 60 * 60 * 24 * 400 })
     const ttlMs = new Date(issued.record.expiresAt!).getTime() - Date.now()
     expect(ttlMs).toBeLessThanOrEqual(366 * 24 * 60 * 60 * 1000)
   })
@@ -133,10 +133,10 @@ describe('@owlmeans/server-auth-token — listing and revoking', () => {
   test('a list shows the caller\'s own tokens and never a hash', async () => {
     const context = await makeTestContext()
     await seedProfile(context)
-    await seedToken(context, hashAccessToken('tst_one'), { id: 'one', name: 'one' })
-    await seedToken(context, hashAccessToken('tst_two'), { id: 'two', name: 'two' })
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_one'), { id: 'one', name: 'one' })
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_two'), { id: 'two', name: 'two' })
     // Somebody else's token, in the same store.
-    await seedToken(context, hashAccessToken('tst_other'), {
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_other'), {
       id: 'other', name: 'other', profileId: 'someone-else',
     })
 
@@ -149,7 +149,7 @@ describe('@owlmeans/server-auth-token — listing and revoking', () => {
   test('revoking marks the record and is idempotent', async () => {
     const context = await makeTestContext()
     await seedProfile(context)
-    await seedToken(context, hashAccessToken('tst_one'), { id: 'one' })
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_one'), { id: 'one' })
 
     await invoke(revokeAccessToken, context, { ...session(), params: { id: 'one' } })
     const first = await context.resource<any>(AUTH_TOKEN_RESOURCE).load('one')
@@ -164,7 +164,7 @@ describe('@owlmeans/server-auth-token — listing and revoking', () => {
   test('another profile\'s token answers exactly as an unknown id does', async () => {
     const context = await makeTestContext()
     await seedProfile(context)
-    await seedToken(context, hashAccessToken('tst_other'), { id: 'other', profileId: 'someone-else' })
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_other'), { id: 'other', profileId: 'someone-else' })
 
     await expect(
       invoke(revokeAccessToken, context, { ...session(), params: { id: 'other' } })
@@ -177,7 +177,7 @@ describe('@owlmeans/server-auth-token — listing and revoking', () => {
   test('a token may never revoke a token', async () => {
     const context = await makeTestContext()
     await seedProfile(context)
-    await seedToken(context, hashAccessToken('tst_one'), { id: 'one' })
+    await seedToken(context, tokenHashHelper.hashAccessToken('tst_one'), { id: 'one' })
 
     await expect(invoke(
       revokeAccessToken, context,