@qlover/oauth-wrapper 0.2.0 → 0.2.3

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.2.1
+
+### Patch Changes
+
+#### ♻️ Refactors
+
+- **oauth-wrapper:** change userId type from number to string across interfaces and schemas ([bfe85fa](https://github.com/qlover/fe-base/commit/bfe85fa6e82561164a936dca7e8a9d8e1ca6b7e3)) ([#618](https://github.com/qlover/fe-base/pull/618))
+  - Updated the `ownerUserId` and `userId` parameters in various interfaces and schemas to use `string` instead of `number` for better compatibility with string-based identifiers.
+  - Adjusted related service methods to reflect the new type, ensuring consistency across the OAuth wrapper implementation.
+  - Enhanced the `OAuthClientRowSchema` and other schemas to align with the updated user ID type, improving data validation and integrity.
+
 ## 0.2.0
 
 ### Minor Changes

package/dist/client.cjs

@@ -300,6 +300,7 @@ var OAuthGateway = class {
   constructor(options) {
     this.options = options;
   }
+  options;
   callbackInflight = /* @__PURE__ */ new Map();
   get localeOptions() {
     return {
@@ -742,7 +743,8 @@ var OAuthClient = class {
       locale: this.config.locale,
       redirectUri,
       statePreview: `${state.slice(0, 8)}\u2026`,
-      pkceSaved: this.pkceStore.loadPkceSession() != null
+      pkceSaved: this.pkceStore.loadPkceSession() != null,
+      authorizeUrl: url
     });
     if (params?.target === "_blank") {
       window.open(url, "_blank", "noopener,noreferrer");

package/dist/client.d.ts

@@ -296,7 +296,7 @@ declare class OAuthClient<T extends OAuthUserInfo = OAuthUserInfo> implements OA
     /**
      * @override
      */
-    startOAuthLogin(params?: OAuthGatewayAuthorizeParams): Promise<void>;
+    startOAuthLogin(params?: Partial<OAuthGatewayAuthorizeParams>): Promise<void>;
     completeOAuthCallback(params?: Parameters<OAuthGateway<T>['oAuthWrapperCallback']>[0]): Promise<T>;
     parseOAuthCallbackSearchParams(searchParams: URLSearchParams): Parameters<OAuthGateway<T>['oAuthWrapperCallback']>[0];
     /**

package/dist/client.js

@@ -257,6 +257,7 @@ var OAuthGateway = class {
   constructor(options) {
     this.options = options;
   }
+  options;
   callbackInflight = /* @__PURE__ */ new Map();
   get localeOptions() {
     return {
@@ -699,7 +700,8 @@ var OAuthClient = class {
       locale: this.config.locale,
       redirectUri,
       statePreview: `${state.slice(0, 8)}\u2026`,
-      pkceSaved: this.pkceStore.loadPkceSession() != null
+      pkceSaved: this.pkceStore.loadPkceSession() != null,
+      authorizeUrl: url
     });
     if (params?.target === "_blank") {
       window.open(url, "_blank", "noopener,noreferrer");

package/dist/core.cjs

@@ -64,7 +64,7 @@ function isOAuthRedirectUri(value) {
 }
 var oauthRedirectUriSchema = import_zod.z.string().min(1).refine(isOAuthRedirectUri, { message: "Invalid redirect URI" });
 var OAuthClientRowSchema = import_zod.z.object({
-  id: import_zod.z.number(),
+  id: import_zod.z.string(),
   client_id: import_zod.z.string(),
   client_secret_hash: import_zod.z.string().nullable().optional(),
   client_name: import_zod.z.string(),
@@ -74,7 +74,7 @@ var OAuthClientRowSchema = import_zod.z.object({
   grant_types: import_zod.z.array(import_zod.z.string()),
   scopes: import_zod.z.array(import_zod.z.string()),
   confidential: import_zod.z.boolean(),
-  owner_user_id: import_zod.z.number(),
+  owner_user_id: import_zod.z.string(),
   created_at: import_zod.z.string(),
   updated_at: import_zod.z.string()
 });
@@ -147,7 +147,7 @@ var OAuthConsentBodySchema = import_zod.z.object({
 var OAuthAuthorizationCodeRowSchema = import_zod.z.object({
   code: import_zod.z.string(),
   client_id: import_zod.z.string(),
-  user_id: import_zod.z.number(),
+  user_id: import_zod.z.string(),
   redirect_uri: import_zod.z.string(),
   scope: import_zod.z.string().nullable().optional(),
   code_challenge: import_zod.z.string().nullable().optional(),
@@ -160,16 +160,16 @@ var OAuthAuthorizationCodeRowSchema = import_zod.z.object({
 // src/core/schema/OAuthClientSchema.ts
 var import_zod2 = require("zod");
 var OAuthUserCredentialsSchema = import_zod2.z.object({
-  user_id: import_zod2.z.number(),
+  user_id: import_zod2.z.string(),
   provider_refresh_token: import_zod2.z.string().nullable().optional(),
   provider_session_token: import_zod2.z.string().nullable().optional(),
   updated_at: import_zod2.z.string()
 });
 var OAuthRefreshTokenSchema = import_zod2.z.object({
-  id: import_zod2.z.number(),
+  id: import_zod2.z.string(),
   refresh_token: import_zod2.z.string(),
   client_id: import_zod2.z.string(),
-  user_id: import_zod2.z.number(),
+  user_id: import_zod2.z.string(),
   expires_at: import_zod2.z.string(),
   revoked: import_zod2.z.boolean(),
   created_at: import_zod2.z.string()
@@ -186,12 +186,12 @@ var OAuthTokenResponseSchema = import_zod2.z.object({
 var import_zod3 = require("zod");
 var OAuthUserInfoResponseSchema = import_zod3.z.object({
   sub: import_zod3.z.string(),
-  email: import_zod3.z.string().email(),
+  email: import_zod3.z.email(),
   name: import_zod3.z.string(),
   roles: import_zod3.z.array(import_zod3.z.string()).optional()
 });
 var OAuthUserInfoErrorResponseSchema = import_zod3.z.object({
-  error: import_zod3.z.literal("invalid_token"),
+  error: import_zod3.z.string(),
   error_id: import_zod3.z.string().optional()
 });
 

package/dist/core.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { LoginParams } from '@qlover/corekit-bridge/core';
 import { ValueOf } from '@qlover/fe-corekit';
 
 /**
@@ -6,7 +7,7 @@ import { ValueOf } from '@qlover/fe-corekit';
  */
 declare function isOAuthRedirectUri(value: string): boolean;
 declare const OAuthClientRowSchema: z.ZodObject<{
-    id: z.ZodNumber;
+    id: z.ZodString;
     client_id: z.ZodString;
     client_secret_hash: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     client_name: z.ZodString;
@@ -16,7 +17,7 @@ declare const OAuthClientRowSchema: z.ZodObject<{
     grant_types: z.ZodArray<z.ZodString>;
     scopes: z.ZodArray<z.ZodString>;
     confidential: z.ZodBoolean;
-    owner_user_id: z.ZodNumber;
+    owner_user_id: z.ZodString;
     created_at: z.ZodString;
     updated_at: z.ZodString;
 }, z.core.$strip>;
@@ -100,7 +101,7 @@ type OAuthConsentBody = z.infer<typeof OAuthConsentBodySchema>;
 declare const OAuthAuthorizationCodeRowSchema: z.ZodObject<{
     code: z.ZodString;
     client_id: z.ZodString;
-    user_id: z.ZodNumber;
+    user_id: z.ZodString;
     redirect_uri: z.ZodString;
     scope: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     code_challenge: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -112,12 +113,12 @@ declare const OAuthAuthorizationCodeRowSchema: z.ZodObject<{
 type OAuthAuthorizationCodeRow = z.infer<typeof OAuthAuthorizationCodeRowSchema>;
 
 interface OAuthClientsInterface {
-    listForOwner(ownerUserId: number): Promise<OAuthClientListItem[]>;
-    getByClientId(ownerUserId: number, clientId: string): Promise<OAuthClientDetail>;
-    create(ownerUserId: number, input: OAuthClientCreate): Promise<OAuthClientCreateResponse>;
-    update(ownerUserId: number, clientId: string, input: OAuthClientUpdate): Promise<OAuthClientDetail>;
-    rotateSecret(ownerUserId: number, clientId: string): Promise<OAuthClientSecretRotateResponse>;
-    delete(ownerUserId: number, clientId: string): Promise<void>;
+    listForOwner(ownerUserId: string): Promise<OAuthClientListItem[]>;
+    getByClientId(ownerUserId: string, clientId: string): Promise<OAuthClientDetail>;
+    create(ownerUserId: string, input: OAuthClientCreate): Promise<OAuthClientCreateResponse>;
+    update(ownerUserId: string, clientId: string, input: OAuthClientUpdate): Promise<OAuthClientDetail>;
+    rotateSecret(ownerUserId: string, clientId: string): Promise<OAuthClientSecretRotateResponse>;
+    delete(ownerUserId: string, clientId: string): Promise<void>;
 }
 
 /**
@@ -125,21 +126,21 @@ interface OAuthClientsInterface {
  */
 interface OAuthClientsRepositoryInterface {
     findClientById(clientId: string): Promise<OAuthClientRow | null>;
-    listClientByOwner(ownerUserId: number): Promise<OAuthClientListItem[]>;
-    createClient(ownerUserId: number, input: OAuthClientCreate): Promise<{
+    listClientByOwner(ownerUserId: string): Promise<OAuthClientListItem[]>;
+    createClient(ownerUserId: string, input: OAuthClientCreate): Promise<{
         client: OAuthClientRow;
         clientSecret?: string;
     }>;
-    updateClient(ownerUserId: number, clientId: string, input: OAuthClientUpdate): Promise<OAuthClientDetail>;
-    rotateClientSecret(ownerUserId: number, clientId: string): Promise<{
+    updateClient(ownerUserId: string, clientId: string, input: OAuthClientUpdate): Promise<OAuthClientDetail>;
+    rotateClientSecret(ownerUserId: string, clientId: string): Promise<{
         clientSecret: string;
     }>;
-    deleteClient(ownerUserId: number, clientId: string): Promise<void>;
+    deleteClient(ownerUserId: string, clientId: string): Promise<void>;
     verifyClientCredentials(clientId: string, clientSecret: string | undefined): Promise<OAuthClientRow>;
 }
 
 type OAuthSessionPayload = {
-    userId: number;
+    userId: string;
     email: string;
     name: string;
     providerSessionToken: string;
@@ -199,116 +200,18 @@ declare const OAuthTokenRevokeSchema: z.ZodObject<{
 }, z.core.$strip>;
 type OAuthTokenRevokeRequest = z.infer<typeof OAuthTokenRevokeSchema>;
 
-/**
- * OAuth user adapter profile shape.
- *
- * Significance: Keeps OAuth services independent from provider SDK user models.
- * Core idea: Represent only the profile fields required by OAuth login and userinfo.
- * Main function: Provide a canonical user profile contract for adapters.
- * Main purpose: Let the OAuth wrapper switch user providers without changing services.
- *
- * @example
- * const sub = String(profile.id);
- */
-type OAuthUserProfile = {
-    id: string | number;
-    email?: string | null;
-    name?: string | null;
-    first_name?: string | null;
-    last_name?: string | null;
-    roles?: string[];
-    [key: string]: unknown;
-};
-/**
- * OAuth provider login credentials result.
- *
- * Significance: Normalizes provider login responses for middleware sessions.
- * Core idea: Require a session token while allowing provider-specific metadata.
- * Main function: Carry the provider session token after credential verification.
- * Main purpose: Persist the token needed to mint OAuth access tokens later.
- *
- * @example
- * const sessionToken = credentials.token;
- */
-type OAuthUserCredentials = {
-    token: string;
-    [key: string]: unknown;
-};
-/**
- * OAuth provider access token result.
- *
- * Significance: Normalizes provider token exchange responses.
- * Core idea: OAuth token services only need access, expiry, and optional refresh token.
- * Main function: Return a provider access token for third-party OAuth clients.
- * Main purpose: Hide provider SDK response details behind the adapter contract.
- *
- * @example
- * return { access_token: token.access_token, expires_in: token.expires_in };
- */
-type OAuthUserAccessToken = {
-    access_token: string;
-    expires_in: number;
-    refresh_token?: string | null;
-    [key: string]: unknown;
-};
-/**
- * User adapter contract for the OAuth wrapper.
- *
- * Significance: Defines the boundary between OAuth core services and user providers.
- * Core idea: Keep provider-specific login, token exchange, and profile lookup behind one port.
- * Main function: Verify credentials, exchange provider tokens, and load user profiles.
- * Main purpose: Allow any upstream user API to be swapped without changing OAuth services.
- *
- * @example
- * const access = await adapter.exchangeAccessToken({ token: sessionToken });
- */
-interface OAuthUserAdapterInterface {
-    /**
-     * Verifies user credentials with the backing user provider.
-     *
-     * @param email - User email or username accepted by the provider.
-     * @param password - Plain credential submitted by the login form.
-     * @returns Provider credentials containing a session token.
-     */
-    login(email: string, password: string): Promise<OAuthUserCredentials>;
-    /**
-     * Exchanges a provider session token for a provider access token.
-     *
-     * @param params - Session token and optional language preference.
-     * @returns Provider access token payload used as the OAuth access token response.
-     */
-    exchangeAccessToken(params: {
-        token: string;
-        lang?: string;
-    }): Promise<OAuthUserAccessToken>;
-    /**
-     * Loads profile information using a provider session token.
-     *
-     * @param sessionToken - Provider session token from a successful login.
-     * @returns Canonical user profile for session creation.
-     */
-    getUserInfo(sessionToken: string): Promise<OAuthUserProfile>;
-    /**
-     * Loads profile information using a provider access token.
-     *
-     * @param accessToken - Bearer access token presented to the userinfo endpoint.
-     * @returns Canonical user profile for OIDC userinfo claims.
-     */
-    getUserInfoByAccessToken(accessToken: string): Promise<OAuthUserProfile>;
-}
-
 declare const OAuthUserCredentialsSchema: z.ZodObject<{
-    user_id: z.ZodNumber;
+    user_id: z.ZodString;
     provider_refresh_token: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     provider_session_token: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     updated_at: z.ZodString;
 }, z.core.$strip>;
 type OAuthUserCredentialsRow = z.infer<typeof OAuthUserCredentialsSchema>;
 declare const OAuthRefreshTokenSchema: z.ZodObject<{
-    id: z.ZodNumber;
+    id: z.ZodString;
     refresh_token: z.ZodString;
     client_id: z.ZodString;
-    user_id: z.ZodNumber;
+    user_id: z.ZodString;
     expires_at: z.ZodString;
     revoked: z.ZodBoolean;
     created_at: z.ZodString;
@@ -326,7 +229,7 @@ type OAuthTokenResponse = z.infer<typeof OAuthTokenResponseSchema>;
 type CreateAuthorizationCodeInput = {
     code: string;
     client_id: string;
-    user_id: number;
+    user_id: string;
     redirect_uri: string;
     scope: string | null;
     code_challenge: string | null;
@@ -336,14 +239,14 @@ type CreateAuthorizationCodeInput = {
 type CreateOAuthRefreshTokenInput = {
     refresh_token: string;
     client_id: string;
-    user_id: number;
+    user_id: string;
     expires_at: string;
 };
 interface OAuthWrapperRepositoryInterface extends OAuthClientsRepositoryInterface {
     create(input: CreateAuthorizationCodeInput): Promise<void>;
     consumeCode(code: string): Promise<OAuthAuthorizationCodeRow | null>;
-    getUserCredentials(userId: number): Promise<OAuthUserCredentialsRow | null>;
-    upsertUserCredentials(userId: number, fields: {
+    getUserCredentials(userId: string): Promise<OAuthUserCredentialsRow | null>;
+    upsertUserCredentials(userId: string, fields: {
         provider_refresh_token?: string | null;
         provider_session_token?: string | null;
     }): Promise<void>;
@@ -351,7 +254,7 @@ interface OAuthWrapperRepositoryInterface extends OAuthClientsRepositoryInterfac
     upsertRefreshToken(input: {
         refresh_token: string;
         client_id: string;
-        user_id: number;
+        user_id: string;
         expires_at: string;
     }): Promise<void>;
     revokeRefreshToken(tokenHash: string): Promise<void>;
@@ -359,18 +262,18 @@ interface OAuthWrapperRepositoryInterface extends OAuthClientsRepositoryInterfac
     createRefreshToken(input: CreateOAuthRefreshTokenInput): Promise<void>;
     revokeByTokenHash(tokenHash: string): Promise<void>;
     /** Revoke all active refresh tokens issued for the given user. */
-    revokeRefreshTokensByUserId(userId: number): Promise<void>;
+    revokeRefreshTokensByUserId(userId: string): Promise<void>;
 }
 
 declare const OAuthUserInfoResponseSchema: z.ZodObject<{
     sub: z.ZodString;
-    email: z.ZodString;
+    email: z.ZodEmail;
     name: z.ZodString;
     roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 type OAuthUserInfoResponse = z.infer<typeof OAuthUserInfoResponseSchema>;
 declare const OAuthUserInfoErrorResponseSchema: z.ZodObject<{
-    error: z.ZodLiteral<"invalid_token">;
+    error: z.ZodString;
     error_id: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type OAuthUserInfoErrorResponse = z.infer<typeof OAuthUserInfoErrorResponseSchema>;
@@ -414,25 +317,40 @@ interface OAuthTokenServiceInterface {
      */
     revokeToken(rawFields: Record<string, string>): Promise<void>;
 }
-interface OAuthServiceInterface<SessionPayload extends OAuthSessionPayload> extends OAuthTokenServiceInterface {
-    resolveAuthorizePage(rawQuery: Record<string, string | string[] | undefined>): Promise<{
-        ok: true;
-        data: OAuthAuthorizePageData;
-    } | {
-        ok: false;
-        error: OAuthAuthorizeValidationError;
-    }>;
-    processConsent(requestBody: unknown): Promise<OAuthConsentResult>;
-    getUserInfo(accessToken: string): Promise<OAuthUserInfoResponse>;
-    getOAuthSession(): OAuthSessionInterface<SessionPayload>;
-    getOAuthAdapter(): OAuthUserAdapterInterface;
-    getOAuthTokenService(): OAuthTokenServiceInterface;
+type ResolveAuthorizePageResult = {
+    ok: true;
+    data: OAuthAuthorizePageData;
+} | {
+    ok: false;
+    error: OAuthAuthorizeValidationError;
+};
+interface OAuthProviderInterface<SessionPayload extends OAuthSessionPayload> extends OAuthTokenServiceInterface {
+    login(params: LoginParams): Promise<SessionPayload>;
+    /**
+     * Get the OAuth repository
+     */
     getOAuthRepo(): OAuthWrapperRepositoryInterface;
     /**
-     * Application logout: revoke issued refresh tokens, clear stored provider
-     * credentials, and clear the authorization-server session cookie.
+     * Clear the session
+     */
+    clearSession(): Promise<void>;
+    /**
+     * Get the session
+     */
+    getSession(): Promise<SessionPayload | null>;
+    /**
+     * Logout the user
+     */
+    logout(userId: string): Promise<void>;
+    /**
+     * Resolve the authorize page
      */
-    logoutUser(userId: number): Promise<void>;
+    resolveAuthorizePage(rawQuery: Record<string, string | string[] | undefined>): Promise<ResolveAuthorizePageResult>;
+    /**
+     * Process the consent
+     */
+    processConsent(requestBody: unknown): Promise<OAuthConsentResult>;
+    getUserInfoWithAccessToken(accessToken: string): Promise<OAuthUserInfoResponse>;
 }
 
 declare const OAuthRfcCodes: {
@@ -457,4 +375,4 @@ declare function generatePkceVerifier(length?: number): string;
 declare function computePkceS256Challenge(verifier: string): Promise<string>;
 declare function randomOAuthState(): string;
 
-export { type CreateAuthorizationCodeInput, type CreateOAuthRefreshTokenInput, type OAuthAuthorizationCodeRow, OAuthAuthorizationCodeRowSchema, type OAuthAuthorizePageData, type OAuthAuthorizeQuery, OAuthAuthorizeQuerySchema, type OAuthAuthorizeValidationError, type OAuthClientCreate, type OAuthClientCreateResponse, OAuthClientCreateResponseSchema, OAuthClientCreateSchema, type OAuthClientDetail, OAuthClientDetailSchema, type OAuthClientListItem, OAuthClientListItemSchema, type OAuthClientRow, OAuthClientRowSchema, type OAuthClientSecretRotateResponse, OAuthClientSecretRotateResponseSchema, type OAuthClientUpdate, OAuthClientUpdateSchema, type OAuthClientsInterface, type OAuthClientsRepositoryInterface, type OAuthConsentBody, OAuthConsentBodySchema, type OAuthConsentResult, type OAuthRefreshTokenRow, OAuthRefreshTokenSchema, type OAuthRfcCodeType, OAuthRfcCodes, type OAuthRfcErrorCodesType, type OAuthServiceInterface, type OAuthSessionInterface, type OAuthSessionPayload, type OAuthTokenAuthorizationCodeRequest, OAuthTokenAuthorizationCodeSchema, type OAuthTokenErrorResponse, OAuthTokenErrorResponseSchema, type OAuthTokenRefreshRequest, OAuthTokenRefreshSchema, type OAuthTokenRequest, OAuthTokenRequestSchema, type OAuthTokenResponse, OAuthTokenResponseSchema, type OAuthTokenRevokeRequest, OAuthTokenRevokeSchema, type OAuthTokenServiceInterface, type OAuthUserAccessToken, type OAuthUserAdapterInterface, type OAuthUserCredentials, type OAuthUserCredentialsRow, OAuthUserCredentialsSchema, type OAuthUserInfoErrorResponse, OAuthUserInfoErrorResponseSchema, type OAuthUserInfoResponse, OAuthUserInfoResponseSchema, type OAuthUserProfile, type OAuthWrapperRepositoryInterface, computePkceS256Challenge, generatePkceVerifier, isOAuthRedirectUri, randomOAuthState };
+export { type CreateAuthorizationCodeInput, type CreateOAuthRefreshTokenInput, type OAuthAuthorizationCodeRow, OAuthAuthorizationCodeRowSchema, type OAuthAuthorizePageData, type OAuthAuthorizeQuery, OAuthAuthorizeQuerySchema, type OAuthAuthorizeValidationError, type OAuthClientCreate, type OAuthClientCreateResponse, OAuthClientCreateResponseSchema, OAuthClientCreateSchema, type OAuthClientDetail, OAuthClientDetailSchema, type OAuthClientListItem, OAuthClientListItemSchema, type OAuthClientRow, OAuthClientRowSchema, type OAuthClientSecretRotateResponse, OAuthClientSecretRotateResponseSchema, type OAuthClientUpdate, OAuthClientUpdateSchema, type OAuthClientsInterface, type OAuthClientsRepositoryInterface, type OAuthConsentBody, OAuthConsentBodySchema, type OAuthConsentResult, type OAuthProviderInterface, type OAuthRefreshTokenRow, OAuthRefreshTokenSchema, type OAuthRfcCodeType, OAuthRfcCodes, type OAuthRfcErrorCodesType, type OAuthSessionInterface, type OAuthSessionPayload, type OAuthTokenAuthorizationCodeRequest, OAuthTokenAuthorizationCodeSchema, type OAuthTokenErrorResponse, OAuthTokenErrorResponseSchema, type OAuthTokenRefreshRequest, OAuthTokenRefreshSchema, type OAuthTokenRequest, OAuthTokenRequestSchema, type OAuthTokenResponse, OAuthTokenResponseSchema, type OAuthTokenRevokeRequest, OAuthTokenRevokeSchema, type OAuthTokenServiceInterface, type OAuthUserCredentialsRow, OAuthUserCredentialsSchema, type OAuthUserInfoErrorResponse, OAuthUserInfoErrorResponseSchema, type OAuthUserInfoResponse, OAuthUserInfoResponseSchema, type OAuthWrapperRepositoryInterface, type ResolveAuthorizePageResult, computePkceS256Challenge, generatePkceVerifier, isOAuthRedirectUri, randomOAuthState };

package/dist/core.js

@@ -14,7 +14,7 @@ function isOAuthRedirectUri(value) {
 }
 var oauthRedirectUriSchema = z.string().min(1).refine(isOAuthRedirectUri, { message: "Invalid redirect URI" });
 var OAuthClientRowSchema = z.object({
-  id: z.number(),
+  id: z.string(),
   client_id: z.string(),
   client_secret_hash: z.string().nullable().optional(),
   client_name: z.string(),
@@ -24,7 +24,7 @@ var OAuthClientRowSchema = z.object({
   grant_types: z.array(z.string()),
   scopes: z.array(z.string()),
   confidential: z.boolean(),
-  owner_user_id: z.number(),
+  owner_user_id: z.string(),
   created_at: z.string(),
   updated_at: z.string()
 });
@@ -97,7 +97,7 @@ var OAuthConsentBodySchema = z.object({
 var OAuthAuthorizationCodeRowSchema = z.object({
   code: z.string(),
   client_id: z.string(),
-  user_id: z.number(),
+  user_id: z.string(),
   redirect_uri: z.string(),
   scope: z.string().nullable().optional(),
   code_challenge: z.string().nullable().optional(),
@@ -110,16 +110,16 @@ var OAuthAuthorizationCodeRowSchema = z.object({
 // src/core/schema/OAuthClientSchema.ts
 import { z as z2 } from "zod";
 var OAuthUserCredentialsSchema = z2.object({
-  user_id: z2.number(),
+  user_id: z2.string(),
   provider_refresh_token: z2.string().nullable().optional(),
   provider_session_token: z2.string().nullable().optional(),
   updated_at: z2.string()
 });
 var OAuthRefreshTokenSchema = z2.object({
-  id: z2.number(),
+  id: z2.string(),
   refresh_token: z2.string(),
   client_id: z2.string(),
-  user_id: z2.number(),
+  user_id: z2.string(),
   expires_at: z2.string(),
   revoked: z2.boolean(),
   created_at: z2.string()
@@ -136,12 +136,12 @@ var OAuthTokenResponseSchema = z2.object({
 import { z as z3 } from "zod";
 var OAuthUserInfoResponseSchema = z3.object({
   sub: z3.string(),
-  email: z3.string().email(),
+  email: z3.email(),
   name: z3.string(),
   roles: z3.array(z3.string()).optional()
 });
 var OAuthUserInfoErrorResponseSchema = z3.object({
-  error: z3.literal("invalid_token"),
+  error: z3.string(),
   error_id: z3.string().optional()
 });