@qlover/oauth-wrapper 0.2.0 → 0.2.3

package/dist/index.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/server/index.ts
 var server_exports = {};
 __export(server_exports, {
+  OAuthAbstractProvider: () => OAuthAbstractProvider,
   OAuthAuthorizationCodeRowSchema: () => OAuthAuthorizationCodeRowSchema,
   OAuthAuthorizeQuerySchema: () => OAuthAuthorizeQuerySchema,
   OAuthClientCreateResponseSchema: () => OAuthClientCreateResponseSchema,
@@ -63,119 +64,6 @@ __export(server_exports, {
 });
 module.exports = __toCommonJS(server_exports);
 
-// src/server/services/OAuthClientsService.ts
-var OAuthClientsService = class {
-  constructor(clientsRepo) {
-    this.clientsRepo = clientsRepo;
-  }
-  /**
-   * List all OAuth clients owned by a user
-   * @override
-   */
-  async listForOwner(ownerUserId) {
-    return this.clientsRepo.listClientByOwner(ownerUserId);
-  }
-  /**
-   * Get detailed information about a specific OAuth client
-   * @override
-   */
-  async getByClientId(ownerUserId, clientId) {
-    const client = await this.clientsRepo.findClientById(clientId);
-    if (!client) {
-      throw new Error("Client not found");
-    }
-    if (client.owner_user_id !== ownerUserId) {
-      throw new Error("Access denied");
-    }
-    return this.mapToDetail(client);
-  }
-  /**
-   * Create a new OAuth client
-   * @override
-   */
-  async create(ownerUserId, input) {
-    const result = await this.clientsRepo.createClient(ownerUserId, input);
-    return {
-      client_id: result.client.client_id,
-      client_secret: result.clientSecret,
-      confidential: result.client.confidential,
-      client_name: result.client.client_name,
-      client_uri: result.client.client_uri,
-      redirect_uris: result.client.redirect_uris,
-      created_at: result.client.created_at
-    };
-  }
-  /**
-   * Update an existing OAuth client
-   * @override
-   */
-  async update(ownerUserId, clientId, input) {
-    const existing = await this.clientsRepo.findClientById(clientId);
-    if (!existing) {
-      throw new Error("Client not found");
-    }
-    if (existing.owner_user_id !== ownerUserId) {
-      throw new Error("Access denied");
-    }
-    return this.clientsRepo.updateClient(ownerUserId, clientId, input);
-  }
-  /**
-   * Rotate the client secret
-   * @override
-   */
-  async rotateSecret(ownerUserId, clientId) {
-    const existing = await this.clientsRepo.findClientById(clientId);
-    if (!existing) {
-      throw new Error("Client not found");
-    }
-    if (existing.owner_user_id !== ownerUserId) {
-      throw new Error("Access denied");
-    }
-    if (!existing.confidential) {
-      throw new Error("Public clients do not have a client_secret");
-    }
-    const result = await this.clientsRepo.rotateClientSecret(
-      ownerUserId,
-      clientId
-    );
-    return {
-      client_id: clientId,
-      client_secret: result.clientSecret
-    };
-  }
-  /**
-   * Delete an OAuth client
-   * @override
-   */
-  async delete(ownerUserId, clientId) {
-    const existing = await this.clientsRepo.findClientById(clientId);
-    if (!existing) {
-      throw new Error("Client not found");
-    }
-    if (existing.owner_user_id !== ownerUserId) {
-      throw new Error("Access denied");
-    }
-    await this.clientsRepo.deleteClient(ownerUserId, clientId);
-  }
-  mapToDetail(row) {
-    return {
-      client_id: row.client_id,
-      client_name: row.client_name,
-      client_uri: row.client_uri,
-      logo_uri: row.logo_uri,
-      redirect_uris: row.redirect_uris,
-      grant_types: row.grant_types,
-      scopes: row.scopes,
-      confidential: row.confidential,
-      created_at: row.created_at,
-      updated_at: row.updated_at
-    };
-  }
-};
-
-// src/server/services/OAuthTokenService.ts
-var import_crypto2 = require("crypto");
-
 // src/core/schema/OAuthAuthorizeSchema.ts
 var import_zod = require("zod");
 function isOAuthRedirectUri(value) {
@@ -192,7 +80,7 @@ function isOAuthRedirectUri(value) {
 }
 var oauthRedirectUriSchema = import_zod.z.string().min(1).refine(isOAuthRedirectUri, { message: "Invalid redirect URI" });
 var OAuthClientRowSchema = import_zod.z.object({
-  id: import_zod.z.number(),
+  id: import_zod.z.string(),
   client_id: import_zod.z.string(),
   client_secret_hash: import_zod.z.string().nullable().optional(),
   client_name: import_zod.z.string(),
@@ -202,7 +90,7 @@ var OAuthClientRowSchema = import_zod.z.object({
   grant_types: import_zod.z.array(import_zod.z.string()),
   scopes: import_zod.z.array(import_zod.z.string()),
   confidential: import_zod.z.boolean(),
-  owner_user_id: import_zod.z.number(),
+  owner_user_id: import_zod.z.string(),
   created_at: import_zod.z.string(),
   updated_at: import_zod.z.string()
 });
@@ -275,7 +163,7 @@ var OAuthConsentBodySchema = import_zod.z.object({
 var OAuthAuthorizationCodeRowSchema = import_zod.z.object({
   code: import_zod.z.string(),
   client_id: import_zod.z.string(),
-  user_id: import_zod.z.number(),
+  user_id: import_zod.z.string(),
   redirect_uri: import_zod.z.string(),
   scope: import_zod.z.string().nullable().optional(),
   code_challenge: import_zod.z.string().nullable().optional(),
@@ -288,16 +176,16 @@ var OAuthAuthorizationCodeRowSchema = import_zod.z.object({
 // src/core/schema/OAuthClientSchema.ts
 var import_zod2 = require("zod");
 var OAuthUserCredentialsSchema = import_zod2.z.object({
-  user_id: import_zod2.z.number(),
+  user_id: import_zod2.z.string(),
   provider_refresh_token: import_zod2.z.string().nullable().optional(),
   provider_session_token: import_zod2.z.string().nullable().optional(),
   updated_at: import_zod2.z.string()
 });
 var OAuthRefreshTokenSchema = import_zod2.z.object({
-  id: import_zod2.z.number(),
+  id: import_zod2.z.string(),
   refresh_token: import_zod2.z.string(),
   client_id: import_zod2.z.string(),
-  user_id: import_zod2.z.number(),
+  user_id: import_zod2.z.string(),
   expires_at: import_zod2.z.string(),
   revoked: import_zod2.z.boolean(),
   created_at: import_zod2.z.string()
@@ -314,12 +202,12 @@ var OAuthTokenResponseSchema = import_zod2.z.object({
 var import_zod3 = require("zod");
 var OAuthUserInfoResponseSchema = import_zod3.z.object({
   sub: import_zod3.z.string(),
-  email: import_zod3.z.string().email(),
+  email: import_zod3.z.email(),
   name: import_zod3.z.string(),
   roles: import_zod3.z.array(import_zod3.z.string()).optional()
 });
 var OAuthUserInfoErrorResponseSchema = import_zod3.z.object({
-  error: import_zod3.z.literal("invalid_token"),
+  error: import_zod3.z.string(),
   error_id: import_zod3.z.string().optional()
 });
 
@@ -400,16 +288,6 @@ function randomOAuthState() {
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
 
-// src/server/utils/OAuthWrapperError.ts
-var import_fe_corekit = require("@qlover/fe-corekit");
-var OAuthWrapperError = class extends import_fe_corekit.ExecutorError {
-  constructor(id, status, cause) {
-    super(id, cause);
-    this.status = status;
-  }
-  name = "OAuthWrapperError";
-};
-
 // src/server/utils/pkce.ts
 var import_crypto = require("crypto");
 var PKCE_VERIFIER_MIN = 43;
@@ -443,267 +321,43 @@ function verifyPkceS256(verifier, challenge) {
   }
 }
 
-// src/server/services/OAuthTokenService.ts
-function hashOpaqueToken(token) {
-  return (0, import_crypto2.createHash)("sha256").update(token).digest("hex");
-}
-var OAuthTokenService = class _OAuthTokenService {
-  constructor(tokenEncryption, userAdapter, oauthRepo) {
-    this.tokenEncryption = tokenEncryption;
-    this.userAdapter = userAdapter;
-    this.oauthRepo = oauthRepo;
-  }
-  static REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1e3;
-  /**
-   * @override
-   */
-  async exchangeToken(rawFields) {
-    let request;
-    try {
-      request = OAuthTokenRequestSchema.parse(rawFields);
-    } catch {
-      throw new OAuthWrapperError(
-        OAuthRfcCodes.INVALID_REQUEST,
-        400,
-        "Malformed token request"
-      );
-    }
-    let client;
-    try {
-      client = await this.oauthRepo.verifyClientCredentials(
-        request.client_id,
-        request.client_secret
-      );
-    } catch {
-      throw new OAuthWrapperError(OAuthRfcCodes.INVALID_CLIENT, 401);
-    }
-    if (!client.grant_types.includes(request.grant_type)) {
-      throw new OAuthWrapperError(OAuthRfcCodes.UNSUPPORTED_GRANT_TYPE, 400);
+// src/server/utils/authorizeUtil.ts
+function validatePkceParams(parsed, confidential) {
+  const hasChallenge = Boolean(parsed.code_challenge?.trim());
+  const hasMethod = Boolean(parsed.code_challenge_method);
+  if (!confidential) {
+    if (!hasChallenge || parsed.code_challenge_method !== "S256") {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Public clients must send code_challenge and code_challenge_method=S256."
+      };
     }
-    if (request.grant_type === "authorization_code") {
-      return await this.exchangeAuthorizationCode(request, client.client_id);
+    if (!isValidCodeChallenge(parsed.code_challenge)) {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Invalid code_challenge."
+      };
     }
-    return await this.exchangeRefreshToken(request, client.client_id);
+    return null;
   }
-  async exchangeAuthorizationCode(request, verifiedClientId) {
-    const authCode = await this.oauthRepo.consumeCode(request.code);
-    if (!authCode) {
-      throw new OAuthWrapperError(
-        OAuthRfcCodes.INVALID_GRANT,
-        400,
-        "Authorization code is invalid, expired, or already used"
-      );
-    }
-    if (authCode.client_id !== verifiedClientId) {
-      throw new OAuthWrapperError(
-        OAuthRfcCodes.INVALID_GRANT,
-        400,
-        "client_id mismatch"
-      );
-    }
-    if (authCode.redirect_uri !== request.redirect_uri) {
-      throw new OAuthWrapperError(
-        OAuthRfcCodes.INVALID_GRANT,
-        400,
-        "redirect_uri mismatch"
-      );
-    }
-    this.assertPkceForAuthorizationCode(request, authCode);
-    const providerTokens = await this.fetchProviderAccessToken(
-      authCode.user_id
-    );
-    const middlewareRefresh = await this.issueMiddlewareRefreshToken(
-      authCode.client_id,
-      authCode.user_id
-    );
+  if (hasChallenge !== hasMethod) {
     return {
-      access_token: providerTokens.access_token,
-      token_type: "Bearer",
-      expires_in: providerTokens.expires_in,
-      refresh_token: middlewareRefresh,
-      scope: authCode.scope ?? void 0
+      errorKey: OAuthRfcCodes.INVALID_REQUEST,
+      message: "code_challenge and code_challenge_method must be sent together."
     };
   }
-  assertPkceForAuthorizationCode(request, authCode) {
-    const storedChallenge = authCode.code_challenge?.trim();
-    if (storedChallenge) {
-      const verifier = request.code_verifier?.trim();
-      if (!verifier) {
-        throw new OAuthWrapperError(
-          OAuthRfcCodes.INVALID_GRANT,
-          400,
-          "code_verifier is required"
-        );
-      }
-      if (authCode.code_challenge_method !== "S256") {
-        throw new OAuthWrapperError(
-          OAuthRfcCodes.INVALID_GRANT,
-          400,
-          "Unsupported PKCE method"
-        );
-      }
-      if (!verifyPkceS256(verifier, storedChallenge)) {
-        throw new OAuthWrapperError(
-          OAuthRfcCodes.INVALID_GRANT,
-          400,
-          "code_verifier mismatch"
-        );
-      }
-      return;
+  if (hasChallenge) {
+    if (parsed.code_challenge_method !== "S256") {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Only code_challenge_method=S256 is supported."
+      };
     }
-    if (!request.client_secret?.trim()) {
-      throw new OAuthWrapperError(
-        OAuthRfcCodes.INVALID_CLIENT,
-        401,
-        "client_secret is required when PKCE is not used"
-      );
-    }
-  }
-  async exchangeRefreshToken(request, verifiedClientId) {
-    const tokenHash = hashOpaqueToken(request.refresh_token);
-    const stored = await this.oauthRepo.findByTokenHash(tokenHash);
-    if (!stored || stored.revoked || stored.client_id !== verifiedClientId || new Date(stored.expires_at) <= /* @__PURE__ */ new Date()) {
-      throw new OAuthWrapperError(
-        OAuthRfcCodes.INVALID_GRANT,
-        400,
-        "Refresh token is invalid"
-      );
-    }
-    const providerTokens = await this.fetchProviderAccessToken(stored.user_id);
-    await this.oauthRepo.revokeByTokenHash(tokenHash);
-    const middlewareRefresh = await this.issueMiddlewareRefreshToken(
-      stored.client_id,
-      stored.user_id
-    );
-    return {
-      access_token: providerTokens.access_token,
-      token_type: "Bearer",
-      expires_in: providerTokens.expires_in,
-      refresh_token: middlewareRefresh
-    };
-  }
-  async fetchProviderAccessToken(userId) {
-    const credentials = await this.oauthRepo.getUserCredentials(userId);
-    const sessionToken = credentials?.provider_session_token?.trim();
-    if (!sessionToken) {
-      throw new OAuthWrapperError(
-        OAuthRfcCodes.INVALID_GRANT,
-        400,
-        "User credentials expired. Re-authorization required."
-      );
-    }
-    try {
-      const access = await this.userAdapter.exchangeAccessToken({
-        token: sessionToken
-      });
-      if (access.refresh_token) {
-        await this.oauthRepo.upsertUserCredentials(userId, {
-          provider_refresh_token: this.tokenEncryption.encrypt(
-            access.refresh_token
-          )
-        });
-      }
-      return {
-        access_token: access.access_token,
-        expires_in: access.expires_in
-      };
-    } catch {
-      throw new OAuthWrapperError(
-        OAuthRfcCodes.INVALID_GRANT,
-        400,
-        "Failed to obtain access token from user provider"
-      );
-    }
-  }
-  async issueMiddlewareRefreshToken(clientId, userId) {
-    const plain = (0, import_crypto2.randomBytes)(32).toString("base64url");
-    const expiresAt = new Date(
-      Date.now() + _OAuthTokenService.REFRESH_TOKEN_TTL_MS
-    ).toISOString();
-    await this.oauthRepo.createRefreshToken({
-      refresh_token: hashOpaqueToken(plain),
-      client_id: clientId,
-      user_id: userId,
-      expires_at: expiresAt
-    });
-    return plain;
-  }
-  /**
-   * @override
-   * RFC 7009 — revoke middleware refresh tokens. Idempotent: unknown tokens are ignored.
-   */
-  async revokeToken(rawFields) {
-    let request;
-    try {
-      request = OAuthTokenRevokeSchema.parse(rawFields);
-    } catch {
-      throw new OAuthWrapperError(
-        OAuthRfcCodes.INVALID_REQUEST,
-        400,
-        "Malformed revocation request"
-      );
-    }
-    try {
-      await this.oauthRepo.verifyClientCredentials(
-        request.client_id,
-        request.client_secret
-      );
-    } catch {
-      throw new OAuthWrapperError(OAuthRfcCodes.INVALID_CLIENT, 401);
-    }
-    if (request.token_type_hint && request.token_type_hint !== "refresh_token") {
-      return;
-    }
-    const tokenHash = hashOpaqueToken(request.token);
-    const stored = await this.oauthRepo.findByTokenHash(tokenHash);
-    if (!stored || stored.client_id !== request.client_id) {
-      return;
-    }
-    await this.oauthRepo.revokeByTokenHash(tokenHash);
-  }
-};
-
-// src/server/services/OAuthWrapperService.ts
-var import_crypto3 = require("crypto");
-var import_fe_corekit2 = require("@qlover/fe-corekit");
-
-// src/server/utils/authorizeUtil.ts
-function validatePkceParams(parsed, confidential) {
-  const hasChallenge = Boolean(parsed.code_challenge?.trim());
-  const hasMethod = Boolean(parsed.code_challenge_method);
-  if (!confidential) {
-    if (!hasChallenge || parsed.code_challenge_method !== "S256") {
-      return {
-        errorKey: OAuthRfcCodes.INVALID_REQUEST,
-        message: "Public clients must send code_challenge and code_challenge_method=S256."
-      };
-    }
-    if (!isValidCodeChallenge(parsed.code_challenge)) {
-      return {
-        errorKey: OAuthRfcCodes.INVALID_REQUEST,
-        message: "Invalid code_challenge."
-      };
-    }
-    return null;
-  }
-  if (hasChallenge !== hasMethod) {
-    return {
-      errorKey: OAuthRfcCodes.INVALID_REQUEST,
-      message: "code_challenge and code_challenge_method must be sent together."
-    };
-  }
-  if (hasChallenge) {
-    if (parsed.code_challenge_method !== "S256") {
-      return {
-        errorKey: OAuthRfcCodes.INVALID_REQUEST,
-        message: "Only code_challenge_method=S256 is supported."
-      };
-    }
-    if (!isValidCodeChallenge(parsed.code_challenge)) {
-      return {
-        errorKey: OAuthRfcCodes.INVALID_REQUEST,
-        message: "Invalid code_challenge."
-      };
+    if (!isValidCodeChallenge(parsed.code_challenge)) {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Invalid code_challenge."
+      };
     }
   }
   return null;
@@ -743,44 +397,36 @@ function parseScopeList(scope) {
   return scope.trim().split(/\s+/).filter(Boolean);
 }
 
-// src/server/services/OAuthWrapperService.ts
-var AUTH_CODE_TTL_MS = 5 * 60 * 1e3;
-var OAuthWrapperService = class {
-  constructor(oauthSession, userAdapter, tokenService, oauthRepo) {
-    this.oauthSession = oauthSession;
-    this.userAdapter = userAdapter;
-    this.tokenService = tokenService;
-    this.oauthRepo = oauthRepo;
-  }
-  /**
-   * @override
-   */
-  getOAuthSession() {
-    return this.oauthSession;
+// src/server/services/OAuthAbstractProvider.ts
+var import_fe_corekit = require("@qlover/fe-corekit");
+var import_crypto2 = require("crypto");
+var OAuthAbstractProvider = class {
+  authCodeTTLMs = 5 * 60 * 1e3;
+  isQuery(query) {
+    return OAuthAuthorizeQuerySchema.safeParse(query).success;
   }
-  /**
-   * @override
-   */
-  getOAuthAdapter() {
-    return this.userAdapter;
+  isValidateConsent(value) {
+    return OAuthConsentBodySchema.safeParse(value).success;
   }
-  /**
-   * @override
-   */
-  getOAuthTokenService() {
-    return this.tokenService;
+  generageSessionPayload(userInfo) {
+    return {
+      userId: String(userInfo.id),
+      email: userInfo.email,
+      name: userInfo.name ?? userInfo.email,
+      providerSessionToken: userInfo.sessionToken
+    };
   }
   /**
    * @override
    */
-  getOAuthRepo() {
-    return this.oauthRepo;
-  }
-  isQuery(query) {
-    return OAuthAuthorizeQuerySchema.safeParse(query).success;
-  }
-  isValidateConsent(value) {
-    return OAuthConsentBodySchema.safeParse(value).success;
+  async logout(userId) {
+    const oauthRepo = this.getOAuthRepo();
+    await oauthRepo.revokeRefreshTokensByUserId(userId);
+    await oauthRepo.upsertUserCredentials(userId, {
+      provider_refresh_token: null,
+      provider_session_token: null
+    });
+    await this.clearSession();
   }
   /**
    * @override
@@ -805,7 +451,8 @@ var OAuthWrapperService = class {
         }
       };
     }
-    const client = await this.oauthRepo.findClientById(query.client_id);
+    const oauthRepo = this.getOAuthRepo();
+    const client = await oauthRepo.findClientById(query.client_id);
     if (!client) {
       return {
         ok: false,
@@ -863,14 +510,14 @@ var OAuthWrapperService = class {
    */
   async processConsent(requestBody) {
     if (!this.isValidateConsent(requestBody)) {
-      throw new import_fe_corekit2.ExecutorError(
+      throw new import_fe_corekit.ExecutorError(
         OAuthRfcCodes.INVALID_REQUEST,
         "Invalid consent request body"
       );
     }
-    const session = await this.oauthSession.getSession();
+    const session = await this.getSession();
     if (!session) {
-      throw new import_fe_corekit2.ExecutorError(
+      throw new import_fe_corekit.ExecutorError(
         OAuthRfcCodes.ACCESS_DENIED,
         "User session expired. Please sign in again."
       );
@@ -885,7 +532,7 @@ var OAuthWrapperService = class {
       code_challenge_method: requestBody.code_challenge_method
     });
     if (!pageResult.ok) {
-      throw new import_fe_corekit2.ExecutorError(
+      throw new import_fe_corekit.ExecutorError(
         pageResult.error.errorKey,
         pageResult.error.message
       );
@@ -900,9 +547,10 @@ var OAuthWrapperService = class {
         })
       };
     }
-    const code = (0, import_crypto3.randomBytes)(32).toString("base64url");
-    const expiresAt = new Date(Date.now() + AUTH_CODE_TTL_MS).toISOString();
-    await this.oauthRepo.create({
+    const code = (0, import_crypto2.randomBytes)(32).toString("base64url");
+    const expiresAt = new Date(Date.now() + this.authCodeTTLMs).toISOString();
+    const oauthRepo = this.getOAuthRepo();
+    await oauthRepo.create({
       code,
       client_id: data.clientId,
       user_id: session.userId,
@@ -920,21 +568,423 @@ var OAuthWrapperService = class {
       })
     };
   }
+};
+
+// src/server/services/OAuthClientsService.ts
+var OAuthClientsService = class {
+  constructor(clientsRepo) {
+    this.clientsRepo = clientsRepo;
+  }
+  clientsRepo;
   /**
+   * List all OAuth clients owned by a user
    * @override
    */
-  async exchangeToken(rawFields) {
-    return await this.tokenService.exchangeToken(rawFields);
+  async listForOwner(ownerUserId) {
+    return this.clientsRepo.listClientByOwner(ownerUserId);
   }
   /**
+   * Get detailed information about a specific OAuth client
    * @override
    */
-  async revokeToken(rawFields) {
-    return await this.tokenService.revokeToken(rawFields);
+  async getByClientId(ownerUserId, clientId) {
+    const client = await this.clientsRepo.findClientById(clientId);
+    if (!client) {
+      throw new Error("Client not found");
+    }
+    if (client.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    return this.mapToDetail(client);
+  }
+  /**
+   * Create a new OAuth client
+   * @override
+   */
+  async create(ownerUserId, input) {
+    const result = await this.clientsRepo.createClient(ownerUserId, input);
+    return {
+      client_id: result.client.client_id,
+      client_secret: result.clientSecret,
+      confidential: result.client.confidential,
+      client_name: result.client.client_name,
+      client_uri: result.client.client_uri,
+      redirect_uris: result.client.redirect_uris,
+      created_at: result.client.created_at
+    };
+  }
+  /**
+   * Update an existing OAuth client
+   * @override
+   */
+  async update(ownerUserId, clientId, input) {
+    const existing = await this.clientsRepo.findClientById(clientId);
+    if (!existing) {
+      throw new Error("Client not found");
+    }
+    if (existing.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    return this.clientsRepo.updateClient(ownerUserId, clientId, input);
+  }
+  /**
+   * Rotate the client secret
+   * @override
+   */
+  async rotateSecret(ownerUserId, clientId) {
+    const existing = await this.clientsRepo.findClientById(clientId);
+    if (!existing) {
+      throw new Error("Client not found");
+    }
+    if (existing.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    if (!existing.confidential) {
+      throw new Error("Public clients do not have a client_secret");
+    }
+    const result = await this.clientsRepo.rotateClientSecret(
+      ownerUserId,
+      clientId
+    );
+    return {
+      client_id: clientId,
+      client_secret: result.clientSecret
+    };
   }
   /**
+   * Delete an OAuth client
    * @override
    */
+  async delete(ownerUserId, clientId) {
+    const existing = await this.clientsRepo.findClientById(clientId);
+    if (!existing) {
+      throw new Error("Client not found");
+    }
+    if (existing.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    await this.clientsRepo.deleteClient(ownerUserId, clientId);
+  }
+  mapToDetail(row) {
+    return {
+      client_id: row.client_id,
+      client_name: row.client_name,
+      client_uri: row.client_uri,
+      logo_uri: row.logo_uri,
+      redirect_uris: row.redirect_uris,
+      grant_types: row.grant_types,
+      scopes: row.scopes,
+      confidential: row.confidential,
+      created_at: row.created_at,
+      updated_at: row.updated_at
+    };
+  }
+};
+
+// src/server/services/OAuthTokenService.ts
+var import_crypto3 = require("crypto");
+
+// src/server/utils/OAuthWrapperError.ts
+var import_fe_corekit2 = require("@qlover/fe-corekit");
+var OAuthWrapperError = class extends import_fe_corekit2.ExecutorError {
+  constructor(id, status, cause) {
+    super(id, cause);
+    this.status = status;
+  }
+  status;
+  name = "OAuthWrapperError";
+};
+
+// src/server/services/OAuthTokenService.ts
+function hashOpaqueToken(token) {
+  return (0, import_crypto3.createHash)("sha256").update(token).digest("hex");
+}
+var OAuthTokenService = class _OAuthTokenService {
+  constructor(tokenEncryption, exchangeProviderAccessToken, oauthRepo) {
+    this.tokenEncryption = tokenEncryption;
+    this.exchangeProviderAccessToken = exchangeProviderAccessToken;
+    this.oauthRepo = oauthRepo;
+  }
+  tokenEncryption;
+  exchangeProviderAccessToken;
+  oauthRepo;
+  static REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1e3;
+  /**
+   * @override
+   */
+  async exchangeToken(rawFields) {
+    let request;
+    try {
+      request = OAuthTokenRequestSchema.parse(rawFields);
+    } catch {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_REQUEST,
+        400,
+        "Malformed token request"
+      );
+    }
+    let client;
+    try {
+      client = await this.oauthRepo.verifyClientCredentials(
+        request.client_id,
+        request.client_secret
+      );
+    } catch {
+      throw new OAuthWrapperError(OAuthRfcCodes.INVALID_CLIENT, 401);
+    }
+    if (!client.grant_types.includes(request.grant_type)) {
+      throw new OAuthWrapperError(OAuthRfcCodes.UNSUPPORTED_GRANT_TYPE, 400);
+    }
+    if (request.grant_type === "authorization_code") {
+      return await this.exchangeAuthorizationCode(request, client.client_id);
+    }
+    return await this.exchangeRefreshToken(request, client.client_id);
+  }
+  async exchangeAuthorizationCode(request, verifiedClientId) {
+    const authCode = await this.oauthRepo.consumeCode(request.code);
+    if (!authCode) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "Authorization code is invalid, expired, or already used"
+      );
+    }
+    if (authCode.client_id !== verifiedClientId) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "client_id mismatch"
+      );
+    }
+    if (authCode.redirect_uri !== request.redirect_uri) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "redirect_uri mismatch"
+      );
+    }
+    this.assertPkceForAuthorizationCode(request, authCode);
+    const providerTokens = await this.fetchProviderAccessToken(
+      authCode.user_id
+    );
+    const middlewareRefresh = await this.issueMiddlewareRefreshToken(
+      authCode.client_id,
+      authCode.user_id
+    );
+    return {
+      access_token: providerTokens.access_token,
+      token_type: "Bearer",
+      expires_in: providerTokens.expires_in,
+      refresh_token: middlewareRefresh,
+      scope: authCode.scope ?? void 0
+    };
+  }
+  assertPkceForAuthorizationCode(request, authCode) {
+    const storedChallenge = authCode.code_challenge?.trim();
+    if (storedChallenge) {
+      const verifier = request.code_verifier?.trim();
+      if (!verifier) {
+        throw new OAuthWrapperError(
+          OAuthRfcCodes.INVALID_GRANT,
+          400,
+          "code_verifier is required"
+        );
+      }
+      if (authCode.code_challenge_method !== "S256") {
+        throw new OAuthWrapperError(
+          OAuthRfcCodes.INVALID_GRANT,
+          400,
+          "Unsupported PKCE method"
+        );
+      }
+      if (!verifyPkceS256(verifier, storedChallenge)) {
+        throw new OAuthWrapperError(
+          OAuthRfcCodes.INVALID_GRANT,
+          400,
+          "code_verifier mismatch"
+        );
+      }
+      return;
+    }
+    if (!request.client_secret?.trim()) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_CLIENT,
+        401,
+        "client_secret is required when PKCE is not used"
+      );
+    }
+  }
+  async exchangeRefreshToken(request, verifiedClientId) {
+    const tokenHash = hashOpaqueToken(request.refresh_token);
+    const stored = await this.oauthRepo.findByTokenHash(tokenHash);
+    if (!stored || stored.revoked || stored.client_id !== verifiedClientId || new Date(stored.expires_at) <= /* @__PURE__ */ new Date()) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "Refresh token is invalid"
+      );
+    }
+    const providerTokens = await this.fetchProviderAccessToken(stored.user_id);
+    await this.oauthRepo.revokeByTokenHash(tokenHash);
+    const middlewareRefresh = await this.issueMiddlewareRefreshToken(
+      stored.client_id,
+      stored.user_id
+    );
+    return {
+      access_token: providerTokens.access_token,
+      token_type: "Bearer",
+      expires_in: providerTokens.expires_in,
+      refresh_token: middlewareRefresh
+    };
+  }
+  async fetchProviderAccessToken(userId) {
+    const credentials = await this.oauthRepo.getUserCredentials(userId);
+    const sessionToken = credentials?.provider_session_token?.trim();
+    if (!sessionToken) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "User credentials expired. Re-authorization required."
+      );
+    }
+    try {
+      const access = await this.exchangeProviderAccessToken({
+        token: sessionToken
+      });
+      if (access.refresh_token) {
+        await this.oauthRepo.upsertUserCredentials(userId, {
+          provider_refresh_token: this.tokenEncryption.encrypt(
+            access.refresh_token
+          )
+        });
+      }
+      return {
+        access_token: access.access_token,
+        expires_in: access.expires_in
+      };
+    } catch {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "Failed to obtain access token from user provider"
+      );
+    }
+  }
+  async issueMiddlewareRefreshToken(clientId, userId) {
+    const plain = (0, import_crypto3.randomBytes)(32).toString("base64url");
+    const expiresAt = new Date(
+      Date.now() + _OAuthTokenService.REFRESH_TOKEN_TTL_MS
+    ).toISOString();
+    await this.oauthRepo.createRefreshToken({
+      refresh_token: hashOpaqueToken(plain),
+      client_id: clientId,
+      user_id: userId,
+      expires_at: expiresAt
+    });
+    return plain;
+  }
+  /**
+   * @override
+   * RFC 7009 — revoke middleware refresh tokens. Idempotent: unknown tokens are ignored.
+   */
+  async revokeToken(rawFields) {
+    let request;
+    try {
+      request = OAuthTokenRevokeSchema.parse(rawFields);
+    } catch {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_REQUEST,
+        400,
+        "Malformed revocation request"
+      );
+    }
+    try {
+      await this.oauthRepo.verifyClientCredentials(
+        request.client_id,
+        request.client_secret
+      );
+    } catch {
+      throw new OAuthWrapperError(OAuthRfcCodes.INVALID_CLIENT, 401);
+    }
+    if (request.token_type_hint && request.token_type_hint !== "refresh_token") {
+      return;
+    }
+    const tokenHash = hashOpaqueToken(request.token);
+    const stored = await this.oauthRepo.findByTokenHash(tokenHash);
+    if (!stored || stored.client_id !== request.client_id) {
+      return;
+    }
+    await this.oauthRepo.revokeByTokenHash(tokenHash);
+  }
+};
+
+// src/server/services/OAuthWrapperService.ts
+var OAuthWrapperService = class extends OAuthAbstractProvider {
+  constructor(oauthSession, tokenEncryption, oauthRepo) {
+    super();
+    this.oauthSession = oauthSession;
+    this.oauthRepo = oauthRepo;
+    this.tokenService = new OAuthTokenService(
+      tokenEncryption,
+      (params) => this.providerExchangeAccessToken(params),
+      oauthRepo
+    );
+  }
+  oauthSession;
+  oauthRepo;
+  tokenService;
+  /**
+   * @override
+   */
+  async login(params) {
+    const credentials = await this.providerLogin(params);
+    const sessionToken = credentials.token;
+    if (!sessionToken) {
+      throw new Error("User provider login did not return a session token");
+    }
+    const userInfo = await this.providerGetUserInfo(sessionToken);
+    const sessionPayload = this.generageSessionPayload({
+      email: params.email,
+      ...userInfo,
+      sessionToken
+    });
+    this.oauthSession.setSession(sessionPayload);
+    const oauthrepo = this.getOAuthRepo();
+    await oauthrepo.upsertUserCredentials(sessionPayload.userId, {
+      provider_session_token: sessionPayload.providerSessionToken
+    });
+    return sessionPayload;
+  }
+  /**
+   * @override
+   */
+  getOAuthRepo() {
+    return this.oauthRepo;
+  }
+  /**
+   * @override
+   */
+  async exchangeToken(rawFields) {
+    return await this.tokenService.exchangeToken(rawFields);
+  }
+  /**
+   * @override
+   */
+  getSession() {
+    return this.oauthSession.getSession();
+  }
+  /**
+   * @override
+   */
+  clearSession() {
+    return this.oauthSession.clearSession();
+  }
+  /**
+   * @override
+   */
+  async revokeToken(rawFields) {
+    return await this.tokenService.revokeToken(rawFields);
+  }
   async logoutUser(userId) {
     await this.oauthRepo.revokeRefreshTokensByUserId(userId);
     await this.oauthRepo.upsertUserCredentials(userId, {
@@ -946,9 +996,9 @@ var OAuthWrapperService = class {
   /**
    * @override
    */
-  async getUserInfo(accessToken) {
+  async getUserInfoWithAccessToken(accessToken) {
     try {
-      const profile = await this.userAdapter.getUserInfoByAccessToken(accessToken);
+      const profile = await this.providerGetUserInfoByAccessToken(accessToken);
       return this.toUserInfoResponse(profile);
     } catch {
       throw new OAuthWrapperError(OAuthRfcCodes.INVALID_TOKEN, 401);
@@ -963,8 +1013,7 @@ var OAuthWrapperService = class {
     if (!email) {
       throw new OAuthWrapperError(OAuthRfcCodes.INVALID_TOKEN, 401);
     }
-    const nameFromParts = [profile.first_name, profile.last_name].filter(Boolean).join(" ");
-    const name = profile.name?.trim() || nameFromParts || email;
+    const name = profile.name?.trim() || email;
     return {
       sub,
       email,
@@ -1000,6 +1049,7 @@ async function verifyClientSecret(secret, storedHash) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  OAuthAbstractProvider,
   OAuthAuthorizationCodeRowSchema,
   OAuthAuthorizeQuerySchema,
   OAuthClientCreateResponseSchema,