@owlmeans/server-auth-token 0.1.18-rc.8 → 0.1.18

package/README.md

@@ -1,3 +1,179 @@
+# @owlmeans/server-auth-token
+
+The server half of long-lived access tokens: a MongoDB token store, a guard that verifies a
+presented token and turns it into the same `Auth` payload a browser session produces, the
+list / create / revoke handlers, a shared issuer for other minting paths (an OAuth token endpoint),
+and a coguard helper that admits a token on every already-guarded route. A backend uses it when API
+clients, CLIs or coding agents should call the same routes a signed-in person does. The token
+format, routes and record types live in `@owlmeans/auth-token`; the browser management panel is
+`@owlmeans/web-auth-token`; issuing tokens through an OAuth grant is `@owlmeans/server-oauth`, which
+calls this package's issuer.
+
+## Installation
+
+```bash
+bun add @owlmeans/server-auth-token@^0.1.18
+```
+
+## Concepts
+
+- **Access token** — `<prefix><base58 of 24 random bytes>`; the prefix defaults to `owl_`. The
+  plaintext is returned once at creation; the store keeps only its SHA-256 `hash` and a short
+  `display` form.
+- **Guard, not authentication** — the guard verifies what arrives and resolves an `Auth` with
+  `type: AuthroizationType.AuthToken`; `authenticated()` always returns `null`, nothing is exchanged.
+- **Prefix claim** — the guard matches only an `Authorization` value with the `AUTH-TOKEN` or
+  `Bearer` scheme that carries the deployment's prefix, so it coexists with other bearer guards.
+- **Scope intersection** — on every request the token's scopes are intersected with its identity
+  profile's; a missing or expired profile refuses the token.
+- **Audience** — a token minted through OAuth carries `audience`; a guard configured with
+  `resources` refuses a token whose audience does not intersect them. Without `resources`, every
+  token is admitted.
+- **Deny list** — `denyAliases` names routes the guard never claims, so an interactive-only route
+  stays a 401 for a token even when the guard is inherited.
+
+## Usage
+
+### Register the store and the guard
+
+```typescript
+import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token'
+import { AUTH_IDENTITY_DB_ALIAS } from '@owlmeans/server-auth-identity'
+import { appendAuthTokenGuard, appendAuthTokenResources } from '@owlmeans/server-auth-token'
+
+appendAuthTokenResources(context, AUTH_IDENTITY_DB_ALIAS)   // same dbAlias as the identity resources
+appendAuthTokenGuard(context, GUARD_AUTH_TOKEN, {
+  prefix: 'vib_',                                           // also written to cfg.authToken.prefix
+  denyAliases: [protocols.tokens.create.alias, protocols.tokens.revoke.alias, checkoutProtocol.alias],
+})
+```
+
+### Bind the token routes
+
+```typescript
+import { makeAuthTokenEntrypoints } from '@owlmeans/auth-token'
+import { bind } from '@owlmeans/server-entrypoint'
+import { createAccessToken, listAccessTokens, revokeAccessToken } from '@owlmeans/server-auth-token'
+
+const tokens = makeAuthTokenEntrypoints({ parent: account.base })
+
+context.registerEntrypoints([
+  bind(tokens.list, listAccessTokens(tokens.list)),
+  bind(tokens.create, createAccessToken(tokens.create)),
+  bind(tokens.revoke, revokeAccessToken(tokens.revoke)),
+])
+```
+
+`revokeAccessToken(protocol, { allowAccessTokens: true })` lets a token revoke the same person's
+tokens (for an agent-facing surface); ownership is still checked and minting stays refused.
+
+### Admit tokens on every guarded route
+
+```typescript
+import { withAuthTokenCoguard } from '@owlmeans/server-auth-token'
+
+export const guardedProtocols = withAuthTokenCoguard(appProtocols)   // before creating bindings
+```
+
+The coguard is appended after each protocol's existing guards; protocols without a guard are left
+alone, and running it twice changes nothing.
+
+### Restrict a surface to tokens issued for it
+
+```typescript
+appendAuthTokenGuard(context, 'guard:mcp-token', {
+  resources: ctx => [mcpResourceUri(ctx)],                   // app function, resolved per request
+})
+```
+
+### Mint from another flow
+
+```typescript
+import { accessTokenIssuerOf, refuseTokenAuth } from '@owlmeans/server-auth-token'
+
+refuseTokenAuth(req, 'token-mint')   // a token may never mint a token
+const issued = await accessTokenIssuerOf(context).issueAccessToken(
+  { entityId, userId, profileId, role, scopes: ownScopes },
+  { name: 'MCP connector', scopes: ['*'], expiresIn: 3600, audience: [resourceUri] },
+)
+// issued.token is the plaintext, shown once; issued.record is the hash-free view
+```
+
+## API
+
+### Registration and guard
+
+| Symbol | Purpose |
+|---|---|
+| `appendAuthTokenResources(ctx, dbAlias?)` | Registers `makeAccessTokenResource(dbAlias)` |
+| `appendAuthTokenGuard(ctx, alias?, opts?)` | Registers the guard (default alias `GUARD_AUTH_TOKEN`); writes `opts.prefix` into `cfg.authToken.prefix` |
+| `makeAuthTokenGuard(alias?, opts?)` | The `GuardService` |
+| `makeAccessTokenResource(dbAlias?)` | Mongo resource at `AUTH_TOKEN_RESOURCE`, collection `access-token`; indexes `hash` (unique), `owner` (`entityId`, `profileId`), `expiresAt` (sparse) |
+| `withAuthTokenCoguard(tree, guard?)` | Same-shaped protocol tree with the token guard appended to every guarded protocol |
+| `prefixOf(context, opts?)` | Prefix from guard options, then `cfg.authToken.prefix`, then `owl_` |
+
+### Handlers and issuance
+
+| Symbol | Purpose |
+|---|---|
+| `listAccessTokens(protocol)` | The caller's tokens in the caller's organization entity, newest first, without hashes |
+| `createAccessToken(protocol)` | Mints a token from the session; refuses token auth; scopes may only narrow |
+| `revokeAccessToken(protocol, opts?)` | Sets `revokedAt` on the caller's own token; idempotent; a foreign id answers like an unknown one |
+| `accessTokenIssuerOf(ctx).issueAccessToken(subject, request)` | The shared minting path; `expiresIn` is clamped to `AUTH_TOKEN_MAX_TTL` |
+| `makeAccessTokenIssuer(ctx)` | Builds an `AccessTokenIssuer` (unmemoized) |
+| `refuseTokenAuth(req, what)` | Throws `AuthForbidden(what)` when `req.auth.type` is an access token |
+| `tokenHashHelper.hashAccessToken(token)` | SHA-256 hex — the stored form |
+| `tokenHashHelper.mintAccessToken(prefix)` | `MintedToken` `{ token, hash, display }` |
+| `createTokenHashHelper()` | Builds a `TokenHashHelper` |
+| `issueAccessToken(ctx, subject, request)`, `hashAccessToken(token)` | Deprecated wrappers |
+| `SERVER_AUTH_TOKEN` | `'server-auth-token'` — module alias for error locations |
+
+### Types
+
+| Symbol | Purpose |
+|---|---|
+| `AuthTokenGuardOptions` | `prefix?`, `denyAliases?`, `touchInterval?` (default 5 min), `resourceAlias?`, `profileAlias?`, `resources?` |
+| `AuthTokenConfig` | `ServerConfig` with `authToken?: { prefix? }` |
+| `AuthTokenContext` | `ServerContext<AuthTokenConfig>` |
+| `AccessTokenResource` | `MongoResource<AccessTokenRecord>` |
+| `IssueAccessTokenSubject` | `{ entityId, userId, profileId, role, scopes }` |
+| `IssueAccessTokenRequest` | `CreateAccessToken` (`name`, `scopes?`, `expiresIn?`) plus `audience?` |
+| `AccessTokenIssuer`, `RevokeAccessTokenOptions`, `MintedToken`, `TokenHashHelper` | Supporting types |
+
+## Guard behaviour
+
+A presented token is refused when it is unknown, revoked, expired, outside the configured
+`resources`, or when its identity profile is missing, unreadable or expired. On success the payload
+carries the token's **display** form (never the secret), the profile's `role`, the intersected
+scopes, and an `entitySlug` resolved through `ENTITY_RESOLVER` when one is registered. `lastUsedAt`
+is written fire-and-forget at most once per `touchInterval`. Refusals are logged once a minute per
+token and reason, with the record id only.
+
+## Common pitfalls
+
+- Passing `prefix` only to a guard you build with `makeAuthTokenGuard` — the minting handler reads the
+  prefix from config, so the two disagree and every new token is a 401. Use `appendAuthTokenGuard`.
+- Registering the token store on a different `dbAlias` than the identity resources.
+- Forgetting the deny list — a coguard-admitted token then reaches routes that must stay
+  session-only (minting, checkout, starting an OAuth flow). A child route cannot drop an inherited
+  guard; the refusal belongs in `denyAliases`.
+- Expecting a requested scope the caller lacks to be dropped — it is refused with
+  `AuthForbidden('scope')`.
+- Treating `lastUsedAt` as an access log — it is throttled and best-effort.
+- Decorating protocols with `withAuthTokenCoguard` after bindings were created.
+
+The `server-auth-token` skill covers the guard, the store and the deny-list rule in depth; the
+`auth-token` skill covers the format and routes.
+
+## Related packages
+
+- [`@owlmeans/auth-token`](../auth-token) — token format, routes, record types, constants
+- [`@owlmeans/web-auth-token`](../web-auth-token) — the browser token management panel
+- [`@owlmeans/server-oauth`](../server-oauth) — OAuth authorization server that mints audience-scoped tokens
+- [`@owlmeans/server-auth-identity`](../server-auth-identity) — the identity profiles a token is bound to
+- [`@owlmeans/mongo-resource`](../mongo-resource) — the token store's backend
+- [`@owlmeans/server-api`](../server-api) — the `handlers()` builder the handlers use
+
 <!-- owlmeans:agent-guidance:start -->
 ## Agent guidance
 
@@ -6,7 +182,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.20
+npx @owlmeans/agent-skills@^0.1.18
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
-  "schemaVersion": 2,
+  "schemaVersion": 3,
   "package": "@owlmeans/server-auth-token",
-  "version": "0.1.18-rc.8",
-  "generatedAt": "2026-09-12T14:18:54.799Z",
+  "version": "0.1.18",
+  "generatedAt": "2026-10-28T00:31:34.770Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth-token/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: server-auth-token
-description: How to use @owlmeans/server-auth-token — the server half of long-lived access tokens — the Mongo store, the guard that verifies a presented token and intersects its scopes with the profile's, the mint/list/revoke handlers, and the coguard that admits a token on every already-guarded route. Auto-invoked when registering the token guard or resources, mounting the token handlers, or diagnosing a 401 on a route an access token should reach.
+description: How to use @owlmeans/server-auth-token — the server half of long-lived access tokens — the Mongo store, the guard that verifies a presented token and intersects its scopes with the profile's, the mint/list/revoke handlers, the shared `accessTokenIssuerOf(ctx).issueAccessToken`, audience admission for OAuth-issued tokens, and the coguard that admits a token on every already-guarded route. Auto-invoked when registering the token guard or resources, mounting the token handlers, or diagnosing a 401 on a route an access token should reach.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-auth-token
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth-token": "^0.1.18-rc.8"` in `dependencies`
+**Install:** `"@owlmeans/server-auth-token": "^0.1.18"` in `dependencies`
 **Contracts:** `@owlmeans/auth-token` — the record, the routes, the format helpers
 
 ## Key Exports
@@ -20,10 +20,12 @@ user-invocable: false
 | `makeAuthTokenGuard(alias?, opts?)` | The guard itself |
 | `makeAccessTokenResource(dbAlias?)` | The Mongo resource, with its three indexes |
 | `prefixOf(context, opts?)` | The deployment's prefix: guard options → config → default |
-| `hashAccessToken(token)` · `mintAccessToken(prefix)` | The stored form; one minted `{ token, hash, display }` |
+| `tokenHashHelper` — `.hashAccessToken(token)` · `.mintAccessToken(prefix)` | The stored form; one minted `{ token, hash, display }` |
 | `withAuthTokenCoguard(protocolTree, guard?)` | Return the same-shaped immutable tree with the guard appended to every already-guarded protocol |
-| `listAccessTokens` · `createAccessToken` · `revokeAccessToken` | The three handlers |
-| `AuthTokenGuardOptions` (`prefix`, `denyAliases`, `touchInterval`, `resourceAlias`, `profileAlias`) · `AuthTokenConfig` · `AccessTokenResource` | Types |
+| `listAccessTokens(protocol)` · `createAccessToken(protocol)` · `revokeAccessToken(protocol, { allowAccessTokens? })` | The three handlers; only revoke takes an option (`RevokeAccessTokenOptions`) |
+| `accessTokenIssuerOf(ctx).issueAccessToken(subject, request)` | Mint one token for `{ entityId, userId, profileId, role, scopes }` — what `createAccessToken` does over an HTTP body, and what an OAuth token endpoint calls over a session it verified itself. `request` is `CreateAccessToken` plus `audience?: string[]` |
+| `refuseTokenAuth(req, what)` | The one "interactive session only" check — throws `AuthForbidden` when `req.auth.type` is an access token |
+| `AuthTokenGuardOptions` (`prefix`, `denyAliases`, `touchInterval`, `resourceAlias`, `profileAlias`, `resources`) · `IssueAccessTokenSubject` · `IssueAccessTokenRequest` · `RevokeAccessTokenOptions` · `AuthTokenConfig` · `AccessTokenResource` | Types |
 
 ## Wiring
 
@@ -77,19 +79,39 @@ Three properties keep it from colliding with the guards beside it:
 - `entitySlug` is resolved through `ENTITY_RESOLVER` when one is registered, so the payload is
   identical to a browser session's rather than carrying a raw id.
 
+**Audience admission is opt-in.** A token minted through an OAuth grant carries `audience` (the resources
+it is FOR, RFC 8707). A guard configured with `resources` (`string[]` or `(ctx) => string[]`, resolved
+per request, because `appendAuthTokenGuard` runs from `makeContext` before a secret-mounted hostname is
+necessarily readable) refuses — as an ordinary non-match, a 401 — a token whose non-empty `audience`
+does not intersect it. A token with **no** audience (every hand-minted one) is admitted everywhere its
+scopes reach, and a guard with no `resources` admits every token whatever its audience, so a deployment
+that never mints an audience-restricted token sees no change. Two guards over different surfaces are
+how a token bound to `/mcp` stays out of the ordinary REST API while a REST-scoped token still works
+through `/mcp`.
+
 `lastUsedAt` is a **throttled, fire-and-forget** write (`touchInterval`, default 5 minutes). A usage
 timestamp is never a reason to fail a request, and awaiting it would put a database write on the
 critical path of every authenticated call. It answers one question — "is this token still in use?" —
 and is not an access log.
 
-## A token may never mint or revoke a token
+## A token may never mint a token; it revokes one only where the deployment opts in
 
 Minting is the one operation that turns a stolen credential into a permanent one: a token that can
-create tokens survives the revocation of the token that leaked. `createAccessToken` and
-`revokeAccessToken` refuse a request whose `auth.type` is `AuthroizationType.AuthToken`, and a
+create tokens survives the revocation of the token that leaked. `createAccessToken` and any other
+minting path (an OAuth consent approval calls `refuseTokenAuth` before it snapshots the subject)
+refuse a request whose `auth.type` is `AuthroizationType.AuthToken` — always, with no option — and a
 deployment additionally names those routes in the guard's **deny list**, so the refusal is a 401 at
 the boundary rather than a check every future handler has to remember.
 
+`revokeAccessToken(protocol)` refuses a token the same way by default. `revokeAccessToken(protocol,
+{ allowAccessTokens: true })` admits one — for a deployment's coding-agent surface that lets a person
+clean up their own tokens (Viable's connector binds it on `connect.account.tokens.revoke`, while the
+browser's own `/tokens/:id` route stays session-only and on the deny list). The option widens the
+CREDENTIAL only: the token revoked must still be the caller's own profile in its own organization
+(`makeEntityScope(req).requireEntityKey()`), a foreign or unknown id still answers `AuthForbidden`
+alike, and a token may revoke itself. Revoking never creates a credential, so it cannot make a
+stolen token permanent; at worst it signs the person's other agents out.
+
 Minting only ever narrows: asking for a scope the caller does not hold is **refused**, not silently
 dropped — a token that quietly grants less than it was asked for fails later, somewhere else, with
 an error about the wrong thing. Revoke is idempotent (a retry looks like a second revoke), and
@@ -121,7 +143,7 @@ works.
 ## Tests
 
 `bun test ./tests` in the package — what the guard claims, what it resolves (including that a token
-can never outrank its profile), the mint/list/revoke rules, and the coguard's four properties.
+can never outrank its profile), the mint/list/revoke rules (the revoke option: own profile and organization only, minting still refused), `accessTokenIssuerOf(ctx).issueAccessToken` parity with the route, audience admission, and the coguard's four properties.
 
 ## Depends On
 
@@ -132,5 +154,6 @@ can never outrank its profile), the mint/list/revoke rules, and the coguard's fo
 
 ## Related
 
-- [[auth-token]] — the format, the routes and the client carrier guard
+- [[auth-token]] — the format, the routes, `audience` and the client carrier guard
+- [[server-oauth]] — the authorization server that mints audience-scoped tokens through `accessTokenIssuerOf(ctx).issueAccessToken`
 - [[web-auth-token]] — the management panel · [[auth-protocol]] · [[server-auth]]

package/build/guard.d.ts

@@ -1,7 +1,5 @@
 import type { GuardService } from '@owlmeans/entrypoint';
-import type { AuthTokenContext, AuthTokenGuardOptions } from './types.js';
-/** Where the deployment's prefix comes from: the guard's own options, then config, then default. */
-export declare const prefixOf: (context: AuthTokenContext, opts?: AuthTokenGuardOptions) => string;
+import type { AuthTokenGuardOptions } from './types.js';
 /**
  * The guard that verifies a long-lived access token.
  *

package/build/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAqC,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAI3F,OAAO,KAAK,EAAwC,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAE/G,oGAAoG;AACpG,eAAO,MAAM,QAAQ,YAAa,gBAAgB,SAAS,qBAAqB,KAAG,MACc,CAAA;AAEjG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,WACtB,MAAM,SAA2B,qBAAqB,KAC5D,YAsGF,CAAA"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAqC,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAK3F,OAAO,KAAK,EAA0D,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAK/G;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,WACtB,MAAM,SAA2B,qBAAqB,KAC5D,YA6HF,CAAA"}

package/build/guard.js

@@ -1,12 +1,13 @@
 import { ALL_SCOPES, AuthroizationType } from '@owlmeans/auth';
-import { AUTH_TOKEN_DEFAULT_PREFIX, AUTH_TOKEN_SCHEME, AUTH_TOKEN_RESOURCE, AUTH_TOKEN_TOUCH_INTERVAL, BEARER_SCHEME, GUARD_AUTH_TOKEN, isAccessToken, parseAuthorizationHeader } from '@owlmeans/auth-token';
+import { AUTH_TOKEN_SCHEME, AUTH_TOKEN_RESOURCE, AUTH_TOKEN_TOUCH_INTERVAL, BEARER_SCHEME, GUARD_AUTH_TOKEN, tokenFormatHelper } from '@owlmeans/auth-token';
 import { AUTH_HEADER } from '@owlmeans/auth';
 import { ENTITY_RESOLVER } from '@owlmeans/auth-common';
 import { createService } from '@owlmeans/context';
 import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity';
-import { hashAccessToken } from './hash.js';
-/** Where the deployment's prefix comes from: the guard's own options, then config, then default. */
-export const prefixOf = (context, opts) => opts?.prefix ?? context.cfg.authToken?.prefix ?? AUTH_TOKEN_DEFAULT_PREFIX;
+import { tokenHashHelper } from './hash.js';
+import { prefixOf } from './prefix.js';
+import { logger, logThrottle } from '@owlmeans/log';
+const log = logger('server-auth-token');
 /**
  * The guard that verifies a long-lived access token.
  *
@@ -26,14 +27,26 @@ export const prefixOf = (context, opts) => opts?.prefix ?? context.cfg.authToken
  *   outlive or outrank the person who minted it.
  */
 export const makeAuthTokenGuard = (alias = GUARD_AUTH_TOKEN, opts = {}) => {
+    /**
+     * A presented access token the guard did not accept. Never the token, not even its display form:
+     * its record id only. Once a minute per token and reason — a client retrying a revoked token calls every second.
+     */
+    const refuse = (reason, record) => {
+        if (logThrottle(`auth-token:${reason}:${record?.id ?? ''}`, 60_000)) {
+            log.warn('Access token refused', {
+                reason, tokenId: record?.id, entityId: record?.entityId,
+            }, { event: 'auth.refused' });
+        }
+        return false;
+    };
     const touchInterval = opts.touchInterval ?? AUTH_TOKEN_TOUCH_INTERVAL;
     const present = (req, prefix) => {
-        const parsed = parseAuthorizationHeader(req.headers?.[AUTH_HEADER]);
+        const parsed = tokenFormatHelper.parseAuthorizationHeader(req.headers?.[AUTH_HEADER]);
         if (parsed == null)
             return null;
         if (parsed.scheme !== AUTH_TOKEN_SCHEME && parsed.scheme !== BEARER_SCHEME)
             return null;
-        return isAccessToken(parsed.value, prefix) ? parsed.value : null;
+        return tokenFormatHelper.isAccessToken(parsed.value, prefix) ? parsed.value : null;
     };
     const service = createService(alias, {
         match: async (req) => {
@@ -56,13 +69,23 @@ export const makeAuthTokenGuard = (alias = GUARD_AUTH_TOKEN, opts = {}) => {
             if (presented == null)
                 return false;
             const tokens = context.resource(opts.resourceAlias ?? AUTH_TOKEN_RESOURCE);
-            const record = await tokens.load({ hash: hashAccessToken(presented) });
+            const record = await tokens.load({ hash: tokenHashHelper.hashAccessToken(presented) });
             if (record == null)
-                return false;
+                return refuse('unknown');
             if (record.revokedAt != null)
-                return false;
+                return refuse('revoked', record);
             if (record.expiresAt != null && new Date(record.expiresAt) < new Date())
-                return false;
+                return refuse('expired', record);
+            // A token minted through an OAuth grant carries the resource(s) it was issued FOR. A token
+            // with no audience is the ordinary hand-minted kind and is admitted everywhere its scopes
+            // reach, exactly as before this check existed — the guard has to OPT IN with `resources` to
+            // narrow anything, so a deployment that never touches this option sees no change at all.
+            const resources = typeof opts.resources === 'function' ? opts.resources(context) : opts.resources;
+            if (record.audience != null && record.audience.length > 0
+                && resources != null && resources.length > 0
+                && !record.audience.some(resource => resources.includes(resource))) {
+                return refuse('audience', record);
+            }
             // A token is only ever as good as the profile behind it. Reading the profile per request is
             // what makes revoking a person's access revoke every token they ever minted, without any
             // token record being touched.
@@ -72,12 +95,12 @@ export const makeAuthTokenGuard = (alias = GUARD_AUTH_TOKEN, opts = {}) => {
                 profile = await profiles.load({ entityId: record.entityId, profileId: record.profileId });
             }
             catch {
-                return false;
+                return refuse('profile-unreadable', record);
             }
             if (profile == null)
-                return false;
+                return refuse('profile', record);
             if (profile.expiresAt != null && new Date(profile.expiresAt) < new Date())
-                return false;
+                return refuse('profile-expired', record);
             const profileScopes = profile.scopes ?? [];
             const scopes = profileScopes.includes(ALL_SCOPES)
                 ? record.scopes
@@ -114,7 +137,7 @@ export const makeAuthTokenGuard = (alias = GUARD_AUTH_TOKEN, opts = {}) => {
                 // Fire and forget: a usage timestamp is never a reason to fail a request, and awaiting it
                 // would put a database write on the critical path of every authenticated call.
                 void tokens.save({ ...record, lastUsedAt: new Date() })
-                    .catch((e) => console.error('auth-token: lastUsedAt', e));
+                    .catch((e) => { log.warn('Access token lastUsedAt not saved', { tokenId: record.id, error: e }); });
             }
             return true;
         },

package/build/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EACL,yBAAyB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAC5F,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,wBAAwB,EACzE,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAG3C,oGAAoG;AACpG,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAyB,EAAE,IAA4B,EAAU,EAAE,CAC1F,IAAI,EAAE,MAAM,IAAK,OAAO,CAAC,GAAuB,CAAC,SAAS,EAAE,MAAM,IAAI,yBAAyB,CAAA;AAEjG;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,KAAK,GAAW,gBAAgB,EAAE,IAAI,GAA0B,EAAE,EACpD,EAAE;IAChB,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,yBAAyB,CAAA;IAErE,MAAM,OAAO,GAAG,CAAC,GAA6B,EAAE,MAAc,EAAiB,EAAE;QAC/E,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;QACnE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO,IAAI,CAAA;QAEvF,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAClE,CAAC,CAAA;IAED,MAAM,OAAO,GAAiB,aAAa,CAAe,KAAK,EAAE;QAC/D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAqC,CAAA;YACtE,IAAI,GAAG,IAAI,IAAI;gBAAE,OAAO,KAAK,CAAA;YAC7B,wFAAwF;YACxF,0FAA0F;YAC1F,2FAA2F;YAC3F,uEAAuE;YACvE,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1F,OAAO,KAAK,CAAA;YACd,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAA;QACtD,CAAC;QAED,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAqC,CAAA;YACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACtC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACtC,IAAI,SAAS,IAAI,IAAI;gBAAE,OAAO,KAAU,CAAA;YAExC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAsB,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAA;YAC/F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACtE,IAAI,MAAM,IAAI,IAAI;gBAAE,OAAO,KAAU,CAAA;YACrC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI;gBAAE,OAAO,KAAU,CAAA;YAC/C,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,KAAU,CAAA;YAE1F,4FAA4F;YAC5F,yFAAyF;YACzF,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAC/B,IAAI,CAAC,YAAY,IAAI,qBAAqB,CAC3C,CAAA;YACD,IAAI,OAAO,GAA2B,IAAI,CAAA;YAC1C,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;YAC3F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAU,CAAA;YACnB,CAAC;YACD,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,KAAU,CAAA;YACtC,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,KAAU,CAAA;YAE5F,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;YAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/C,CAAC,CAAC,MAAM,CAAC,MAAM;gBACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAClC,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;YAElE,0FAA0F;YAC1F,2FAA2F;YAC3F,4BAA4B;YAC5B,IAAI,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAA;YAChC,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAA;gBACxE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBACnD,IAAI,MAAM,IAAI,IAAI;oBAAE,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;YAC9C,CAAC;YAED,GAAG,CAAC,OAAO,CAAC;gBACV,uFAAuF;gBACvF,0CAA0C;gBAC1C,KAAK,EAAE,MAAM,CAAC,OAAO;gBACrB,IAAI,EAAE,iBAAiB,CAAC,SAAS;gBACjC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU;gBACV,MAAM;gBACN,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBACrC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvE,CAAC,CAAA;YAEV,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAA;YAClF,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,aAAa,EAAE,CAAC;gBACtC,0FAA0F;gBAC1F,+EAA+E;gBAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;qBACpD,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAA;YACtE,CAAC;YAED,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,mFAAmF;QACnF,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;KAChC,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EACL,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EACjE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EACnD,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEnD,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAA;AAEvC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,KAAK,GAAW,gBAAgB,EAAE,IAAI,GAA0B,EAAE,EACpD,EAAE;IAChB;;;OAGG;IACH,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,MAA2C,EAAS,EAAE;QACpF,IAAI,WAAW,CAAC,cAAc,MAAM,IAAI,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;gBAC/B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ;aACxD,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;QAC/B,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,yBAAyB,CAAA;IAErE,MAAM,OAAO,GAAG,CAAC,GAA6B,EAAE,MAAc,EAAiB,EAAE;QAC/E,MAAM,MAAM,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;QACrF,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO,IAAI,CAAA;QAEvF,OAAO,iBAAiB,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACpF,CAAC,CAAA;IAED,MAAM,OAAO,GAAiB,aAAa,CAAe,KAAK,EAAE;QAC/D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAqC,CAAA;YACtE,IAAI,GAAG,IAAI,IAAI;gBAAE,OAAO,KAAK,CAAA;YAC7B,wFAAwF;YACxF,0FAA0F;YAC1F,2FAA2F;YAC3F,uEAAuE;YACvE,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1F,OAAO,KAAK,CAAA;YACd,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAA;QACtD,CAAC;QAED,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAqC,CAAA;YACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACtC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACtC,IAAI,SAAS,IAAI,IAAI;gBAAE,OAAO,KAAU,CAAA;YAExC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAsB,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAA;YAC/F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACtF,IAAI,MAAM,IAAI,IAAI;gBAAE,OAAO,MAAM,CAAC,SAAS,CAAM,CAAA;YACjD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI;gBAAE,OAAO,MAAM,CAAC,SAAS,EAAE,MAAM,CAAM,CAAA;YACnE,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,MAAM,CAAC,SAAS,EAAE,MAAM,CAAM,CAAA;YAC9G,2FAA2F;YAC3F,0FAA0F;YAC1F,4FAA4F;YAC5F,yFAAyF;YACzF,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAA;YACjG,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;mBACpD,SAAS,IAAI,IAAI,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;mBACzC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACrE,OAAO,MAAM,CAAC,UAAU,EAAE,MAAM,CAAM,CAAA;YACxC,CAAC;YAED,4FAA4F;YAC5F,yFAAyF;YACzF,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAC/B,IAAI,CAAC,YAAY,IAAI,qBAAqB,CAC3C,CAAA;YACD,IAAI,OAAO,GAA2B,IAAI,CAAA;YAC1C,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;YAC3F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAM,CAAA;YAClD,CAAC;YACD,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,MAAM,CAAC,SAAS,EAAE,MAAM,CAAM,CAAA;YAC1D,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAM,CAAA;YAExH,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;YAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/C,CAAC,CAAC,MAAM,CAAC,MAAM;gBACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAClC,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;YAElE,0FAA0F;YAC1F,2FAA2F;YAC3F,4BAA4B;YAC5B,IAAI,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAA;YAChC,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAA;gBACxE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBACnD,IAAI,MAAM,IAAI,IAAI;oBAAE,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;YAC9C,CAAC;YAED,GAAG,CAAC,OAAO,CAAC;gBACV,uFAAuF;gBACvF,0CAA0C;gBAC1C,KAAK,EAAE,MAAM,CAAC,OAAO;gBACrB,IAAI,EAAE,iBAAiB,CAAC,SAAS;gBACjC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU;gBACV,MAAM;gBACN,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBACrC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvE,CAAC,CAAA;YAEV,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAA;YAClF,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,aAAa,EAAE,CAAC;gBACtC,0FAA0F;gBAC1F,+EAA+E;gBAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;qBACpD,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAC/G,CAAC;YAED,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,mFAAmF;QACnF,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;KAChC,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/handlers/create.d.ts

@@ -0,0 +1,5 @@
+import type { AuthTokenEntrypoints } from '@owlmeans/auth-token';
+export declare const createAccessToken: (protocol: AuthTokenEntrypoints['create']) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    body: import("@owlmeans/auth-token").CreateAccessToken;
+}, import("@owlmeans/auth-token").IssuedAccessToken>>;
+//# sourceMappingURL=create.d.ts.map

package/build/handlers/create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/handlers/create.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAOhE,eAAO,MAAM,iBAAiB,aAAc,oBAAoB,CAAC,QAAQ,CAAC;;qDAYxE,CAAA"}

package/build/handlers/create.js

@@ -0,0 +1,18 @@
+import { AuthForbidden, AuthRole } from '@owlmeans/auth';
+import { makeEntityScope } from '@owlmeans/auth-common';
+import { handlers } from '@owlmeans/server-api';
+import { accessTokenIssuerOf } from './issue.js';
+import { refuseTokenAuth } from './refuse.js';
+export const createAccessToken = (protocol) => handlers().body(protocol, async (payload, context, req) => {
+    const ctx = context;
+    refuseTokenAuth(req, 'token-mint');
+    const entityId = makeEntityScope(req).requireEntityKey();
+    const profileId = req.auth?.profileId;
+    const userId = req.auth?.userId;
+    if (profileId == null || userId == null)
+        throw new AuthForbidden('profile');
+    return accessTokenIssuerOf(ctx).issueAccessToken({
+        entityId, profileId, userId, role: req.auth?.role ?? AuthRole.User, scopes: req.auth?.scopes ?? [],
+    }, payload);
+});
+//# sourceMappingURL=create.js.map

package/build/handlers/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../src/handlers/create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAwC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IACzJ,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IAElC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAA;IACxD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAA;IAC/B,IAAI,SAAS,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAE3E,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC;QAC/C,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE;KACnG,EAAE,OAAO,CAAC,CAAA;AACb,CAAC,CAAC,CAAA"}

package/build/handlers/index.d.ts

@@ -1,12 +1,12 @@
-import type { AccessTokenList, IssuedAccessToken } from '@owlmeans/auth-token';
-import type { AuthTokenEntrypoints } from '@owlmeans/auth-token';
-export declare const listAccessTokens: (protocol: AuthTokenEntrypoints['list']) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, AccessTokenList>>;
-export declare const createAccessToken: (protocol: AuthTokenEntrypoints['create']) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<import("@owlmeans/entrypoint").EntrypointProtocol<{
-    body: import("@owlmeans/auth-token").CreateAccessToken;
-}, IssuedAccessToken>>;
-export declare const revokeAccessToken: (protocol: AuthTokenEntrypoints['revoke']) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<import("@owlmeans/entrypoint").EntrypointProtocol<{
-    params: import("@owlmeans/auth-token").AccessTokenParams;
-}, {
-    id: string;
-}>>;
+import type { IssuedAccessToken } from '@owlmeans/auth-token';
+import type { AuthTokenContext } from '../types.js';
+import type { IssueAccessTokenRequest, IssueAccessTokenSubject } from './types.js';
+export * from './refuse.js';
+export * from './issue.js';
+export * from './list.js';
+export * from './create.js';
+export * from './revoke.js';
+export type { IssueAccessTokenRequest, IssueAccessTokenSubject, RevokeAccessTokenOptions } from './types.js';
+/** @deprecated compat:factory-refactor — use `accessTokenIssuerOf(ctx).issueAccessToken(…)` */
+export declare const issueAccessToken: (ctx: AuthTokenContext, subject: IssueAccessTokenSubject, payload: IssueAccessTokenRequest) => Promise<IssuedAccessToken>;
 //# sourceMappingURL=index.d.ts.map

package/build/handlers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,eAAe,EAAsC,iBAAiB,EACvE,MAAM,sBAAsB,CAAA;AAM7B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AA0BhE,eAAO,MAAM,gBAAgB,aAAc,oBAAoB,CAAC,MAAM,CAAC,iLAarE,CAAA;AAEF,eAAO,MAAM,iBAAiB,aAAc,oBAAoB,CAAC,QAAQ,CAAC;;sBAsCxE,CAAA;AAEF,eAAO,MAAM,iBAAiB,aAAc,oBAAoB,CAAC,QAAQ,CAAC;;;;GAqBxE,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AAElF,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAE3B,YAAY,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAE5G,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB,QACtB,gBAAgB,WAAW,uBAAuB,WAAW,uBAAuB,KACxF,OAAO,CAAC,iBAAiB,CAAsE,CAAA"}

package/build/handlers/index.js

@@ -1,94 +1,9 @@
-import { AuthForbidden, AuthroizationType, ALL_SCOPES, AuthRole } from '@owlmeans/auth';
-import { AUTH_TOKEN_MAX_TTL, AUTH_TOKEN_RESOURCE } from '@owlmeans/auth-token';
-import { requireEntityKey } from '@owlmeans/auth-common';
-import { handlers } from '@owlmeans/server-api';
-import { mintAccessToken } from '../hash.js';
-import { prefixOf } from '../guard.js';
-const view = (record) => {
-    const { hash, ...rest } = record;
-    return rest;
-};
-const tokens = (ctx) => ctx.resource(AUTH_TOKEN_RESOURCE);
-/**
- * A token may never mint another token.
- *
- * Minting is the one operation that turns a stolen credential into a permanent one: a token that
- * can create tokens survives the revocation of the token that leaked. Creating and revoking
- * therefore require a credential a person produced in a browser — which is also why the deployment
- * names these routes in the guard's deny list, so the refusal is a 401 at the boundary rather than
- * a check every future handler has to remember.
- */
-const refuseTokenAuth = (req, what) => {
-    if (req.auth?.type === AuthroizationType.AuthToken) {
-        throw new AuthForbidden(what);
-    }
-};
-export const listAccessTokens = (protocol) => handlers().request(protocol, async (req, context) => {
-    const ctx = context;
-    const entityId = requireEntityKey(req);
-    const profileId = req.auth?.profileId;
-    if (profileId == null)
-        throw new AuthForbidden('profile');
-    const result = await tokens(ctx).list({ entityId, profileId }, { size: 0 });
-    return {
-        items: result.items
-            .map(view)
-            .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()),
-    };
-});
-export const createAccessToken = (protocol) => handlers().body(protocol, async (payload, context, req) => {
-    const ctx = context;
-    refuseTokenAuth(req, 'token-mint');
-    const entityId = requireEntityKey(req);
-    const profileId = req.auth?.profileId;
-    const userId = req.auth?.userId;
-    if (profileId == null || userId == null)
-        throw new AuthForbidden('profile');
-    const own = req.auth?.scopes ?? [];
-    const scopes = payload.scopes ?? own;
-    // A token is a delegation, so it can only ever narrow. Asking for a scope the caller does not
-    // hold is refused rather than silently dropped: a token that quietly grants less than it was
-    // asked for fails later, somewhere else, with an error about the wrong thing.
-    if (!own.includes(ALL_SCOPES) && scopes.some(scope => !own.includes(scope))) {
-        throw new AuthForbidden('scope');
-    }
-    // The SAME resolver the guard uses, so a minted token is one this deployment's guard claims.
-    const minted = mintAccessToken(prefixOf(ctx));
-    const now = new Date();
-    const record = await tokens(ctx).create({
-        hash: minted.hash,
-        display: minted.display,
-        name: payload.name,
-        userId,
-        profileId,
-        entityId,
-        scopes,
-        role: req.auth?.role ?? AuthRole.User,
-        createdAt: now,
-        ...(payload.expiresIn != null
-            ? { expiresAt: new Date(now.getTime() + Math.min(payload.expiresIn * 1000, AUTH_TOKEN_MAX_TTL)) }
-            : {}),
-    });
-    // The only moment the plaintext exists outside the caller's own machine.
-    return { token: minted.token, record: view(record) };
-});
-export const revokeAccessToken = (protocol) => handlers().params(protocol, async (payload, context, req) => {
-    const ctx = context;
-    refuseTokenAuth(req, 'token-revoke');
-    const entityId = requireEntityKey(req);
-    const profileId = req.auth?.profileId;
-    if (profileId == null)
-        throw new AuthForbidden('profile');
-    const record = await tokens(ctx).load(payload.id);
-    // A token of another profile answers exactly as an unknown id does — an owner learns nothing
-    // about tokens that are not theirs, not even that one exists.
-    if (record == null || record.entityId !== entityId || record.profileId !== profileId) {
-        throw new AuthForbidden('token');
-    }
-    // Idempotent: revoking twice is what a retry looks like.
-    if (record.revokedAt == null) {
-        await tokens(ctx).save({ ...record, revokedAt: new Date(), updatedAt: new Date() });
-    }
-    return { id: payload.id };
-});
+import { accessTokenIssuerOf } from './issue.js';
+export * from './refuse.js';
+export * from './issue.js';
+export * from './list.js';
+export * from './create.js';
+export * from './revoke.js';
+/** @deprecated compat:factory-refactor — use `accessTokenIssuerOf(ctx).issueAccessToken(…)` */
+export const issueAccessToken = async (ctx, subject, payload) => await accessTokenIssuerOf(ctx).issueAccessToken(subject, payload);
 //# sourceMappingURL=index.js.map

package/build/handlers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACvF,OAAO,EACL,kBAAkB,EAAE,mBAAmB,EACxC,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAItC,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAmB,EAAE;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IAEhC,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,GAAqB,EAAuB,EAAE,CAC5D,GAAG,CAAC,QAAQ,CAAsB,mBAAmB,CAAC,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,GAAiC,EAAE,IAAY,EAAQ,EAAE;IAChF,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAsC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IAChJ,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IAE3E,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;aAChB,GAAG,CAAC,IAAI,CAAC;aACT,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;KAC3D,CAAA;AAC7B,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAwC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IACzJ,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IAElC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAA;IAC/B,IAAI,SAAS,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAE3E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAA;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAA;IACpC,8FAA8F;IAC9F,6FAA6F;IAC7F,8EAA8E;IAC9E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,6FAA6F;IAC7F,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM;QACN,SAAS;QACT,QAAQ;QACR,MAAM;QACN,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI;QACrC,SAAS,EAAE,GAAG;QACd,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAE;YACjG,CAAC,CAAC,EAAE,CAAC;KACa,CAAC,CAAA;IAEvB,yEAAyE;IACzE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAA8B,CAAA;AAClF,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAwC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IAC3J,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,eAAe,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAEpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACjD,6FAA6F;IAC7F,8DAA8D;IAC9D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrF,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,yDAAyD;IACzD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;AAC3B,CAAC,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGhD,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAI3B,+FAA+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,GAAqB,EAAE,OAAgC,EAAE,OAAgC,EAC7D,EAAE,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA"}