@qlover/oauth-wrapper 0.2.0

package/dist/index.cjs

@@ -0,0 +1,1043 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server/index.ts
+var server_exports = {};
+__export(server_exports, {
+  OAuthAuthorizationCodeRowSchema: () => OAuthAuthorizationCodeRowSchema,
+  OAuthAuthorizeQuerySchema: () => OAuthAuthorizeQuerySchema,
+  OAuthClientCreateResponseSchema: () => OAuthClientCreateResponseSchema,
+  OAuthClientCreateSchema: () => OAuthClientCreateSchema,
+  OAuthClientDetailSchema: () => OAuthClientDetailSchema,
+  OAuthClientListItemSchema: () => OAuthClientListItemSchema,
+  OAuthClientRowSchema: () => OAuthClientRowSchema,
+  OAuthClientSecretRotateResponseSchema: () => OAuthClientSecretRotateResponseSchema,
+  OAuthClientUpdateSchema: () => OAuthClientUpdateSchema,
+  OAuthClientsService: () => OAuthClientsService,
+  OAuthConsentBodySchema: () => OAuthConsentBodySchema,
+  OAuthRefreshTokenSchema: () => OAuthRefreshTokenSchema,
+  OAuthRfcCodes: () => OAuthRfcCodes,
+  OAuthTokenAuthorizationCodeSchema: () => OAuthTokenAuthorizationCodeSchema,
+  OAuthTokenErrorResponseSchema: () => OAuthTokenErrorResponseSchema,
+  OAuthTokenRefreshSchema: () => OAuthTokenRefreshSchema,
+  OAuthTokenRequestSchema: () => OAuthTokenRequestSchema,
+  OAuthTokenResponseSchema: () => OAuthTokenResponseSchema,
+  OAuthTokenRevokeSchema: () => OAuthTokenRevokeSchema,
+  OAuthTokenService: () => OAuthTokenService,
+  OAuthUserCredentialsSchema: () => OAuthUserCredentialsSchema,
+  OAuthUserInfoErrorResponseSchema: () => OAuthUserInfoErrorResponseSchema,
+  OAuthUserInfoResponseSchema: () => OAuthUserInfoResponseSchema,
+  OAuthWrapperError: () => OAuthWrapperError,
+  OAuthWrapperService: () => OAuthWrapperService,
+  buildOAuthRedirectUrl: () => buildOAuthRedirectUrl,
+  computePkceS256Challenge: () => computePkceS256Challenge,
+  computeS256CodeChallenge: () => computeS256CodeChallenge,
+  generatePkceVerifier: () => generatePkceVerifier,
+  hashClientSecret: () => hashClientSecret,
+  isOAuthRedirectUri: () => isOAuthRedirectUri,
+  isRedirectUriAllowed: () => isRedirectUriAllowed,
+  isValidCodeChallenge: () => isValidCodeChallenge,
+  isValidCodeVerifier: () => isValidCodeVerifier,
+  normalizeQuery: () => normalizeQuery,
+  parseScopeList: () => parseScopeList,
+  randomOAuthState: () => randomOAuthState,
+  validatePkceParams: () => validatePkceParams,
+  verifyClientSecret: () => verifyClientSecret,
+  verifyPkceS256: () => verifyPkceS256
+});
+module.exports = __toCommonJS(server_exports);
+
+// src/server/services/OAuthClientsService.ts
+var OAuthClientsService = class {
+  constructor(clientsRepo) {
+    this.clientsRepo = clientsRepo;
+  }
+  /**
+   * List all OAuth clients owned by a user
+   * @override
+   */
+  async listForOwner(ownerUserId) {
+    return this.clientsRepo.listClientByOwner(ownerUserId);
+  }
+  /**
+   * Get detailed information about a specific OAuth client
+   * @override
+   */
+  async getByClientId(ownerUserId, clientId) {
+    const client = await this.clientsRepo.findClientById(clientId);
+    if (!client) {
+      throw new Error("Client not found");
+    }
+    if (client.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    return this.mapToDetail(client);
+  }
+  /**
+   * Create a new OAuth client
+   * @override
+   */
+  async create(ownerUserId, input) {
+    const result = await this.clientsRepo.createClient(ownerUserId, input);
+    return {
+      client_id: result.client.client_id,
+      client_secret: result.clientSecret,
+      confidential: result.client.confidential,
+      client_name: result.client.client_name,
+      client_uri: result.client.client_uri,
+      redirect_uris: result.client.redirect_uris,
+      created_at: result.client.created_at
+    };
+  }
+  /**
+   * Update an existing OAuth client
+   * @override
+   */
+  async update(ownerUserId, clientId, input) {
+    const existing = await this.clientsRepo.findClientById(clientId);
+    if (!existing) {
+      throw new Error("Client not found");
+    }
+    if (existing.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    return this.clientsRepo.updateClient(ownerUserId, clientId, input);
+  }
+  /**
+   * Rotate the client secret
+   * @override
+   */
+  async rotateSecret(ownerUserId, clientId) {
+    const existing = await this.clientsRepo.findClientById(clientId);
+    if (!existing) {
+      throw new Error("Client not found");
+    }
+    if (existing.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    if (!existing.confidential) {
+      throw new Error("Public clients do not have a client_secret");
+    }
+    const result = await this.clientsRepo.rotateClientSecret(
+      ownerUserId,
+      clientId
+    );
+    return {
+      client_id: clientId,
+      client_secret: result.clientSecret
+    };
+  }
+  /**
+   * Delete an OAuth client
+   * @override
+   */
+  async delete(ownerUserId, clientId) {
+    const existing = await this.clientsRepo.findClientById(clientId);
+    if (!existing) {
+      throw new Error("Client not found");
+    }
+    if (existing.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    await this.clientsRepo.deleteClient(ownerUserId, clientId);
+  }
+  mapToDetail(row) {
+    return {
+      client_id: row.client_id,
+      client_name: row.client_name,
+      client_uri: row.client_uri,
+      logo_uri: row.logo_uri,
+      redirect_uris: row.redirect_uris,
+      grant_types: row.grant_types,
+      scopes: row.scopes,
+      confidential: row.confidential,
+      created_at: row.created_at,
+      updated_at: row.updated_at
+    };
+  }
+};
+
+// src/server/services/OAuthTokenService.ts
+var import_crypto2 = require("crypto");
+
+// src/core/schema/OAuthAuthorizeSchema.ts
+var import_zod = require("zod");
+function isOAuthRedirectUri(value) {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return false;
+  }
+  try {
+    const parsed = new URL(trimmed);
+    return Boolean(parsed.protocol && parsed.protocol.endsWith(":"));
+  } catch {
+    return /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed);
+  }
+}
+var oauthRedirectUriSchema = import_zod.z.string().min(1).refine(isOAuthRedirectUri, { message: "Invalid redirect URI" });
+var OAuthClientRowSchema = import_zod.z.object({
+  id: import_zod.z.number(),
+  client_id: import_zod.z.string(),
+  client_secret_hash: import_zod.z.string().nullable().optional(),
+  client_name: import_zod.z.string(),
+  client_uri: import_zod.z.string().nullable().optional(),
+  logo_uri: import_zod.z.string().nullable().optional(),
+  redirect_uris: import_zod.z.array(import_zod.z.string()),
+  grant_types: import_zod.z.array(import_zod.z.string()),
+  scopes: import_zod.z.array(import_zod.z.string()),
+  confidential: import_zod.z.boolean(),
+  owner_user_id: import_zod.z.number(),
+  created_at: import_zod.z.string(),
+  updated_at: import_zod.z.string()
+});
+var OAuthClientListItemSchema = import_zod.z.object({
+  client_id: import_zod.z.string(),
+  client_name: import_zod.z.string(),
+  client_uri: import_zod.z.string().nullable().optional(),
+  logo_uri: import_zod.z.string().nullable().optional(),
+  redirect_uris: import_zod.z.array(import_zod.z.string()),
+  confidential: import_zod.z.boolean(),
+  created_at: import_zod.z.string(),
+  updated_at: import_zod.z.string()
+});
+var OAuthClientDetailSchema = import_zod.z.object({
+  client_id: import_zod.z.string(),
+  client_name: import_zod.z.string(),
+  client_uri: import_zod.z.string().nullable().optional(),
+  logo_uri: import_zod.z.string().nullable().optional(),
+  redirect_uris: import_zod.z.array(import_zod.z.string()),
+  grant_types: import_zod.z.array(import_zod.z.string()),
+  scopes: import_zod.z.array(import_zod.z.string()),
+  confidential: import_zod.z.boolean(),
+  created_at: import_zod.z.string(),
+  updated_at: import_zod.z.string()
+});
+var OAuthClientCreateSchema = import_zod.z.object({
+  client_name: import_zod.z.string().min(1).max(100),
+  client_uri: import_zod.z.string().url().optional().or(import_zod.z.literal("")),
+  redirect_uris: import_zod.z.array(oauthRedirectUriSchema).min(1),
+  /** `true` = confidential (client_secret); `false` = public (PKCE required). */
+  confidential: import_zod.z.boolean().default(true)
+});
+var OAuthClientUpdateSchema = import_zod.z.object({
+  client_name: import_zod.z.string().min(1).max(100),
+  client_uri: import_zod.z.string().url().optional().or(import_zod.z.literal("")),
+  redirect_uris: import_zod.z.array(oauthRedirectUriSchema).min(1)
+});
+var OAuthClientCreateResponseSchema = import_zod.z.object({
+  client_id: import_zod.z.string(),
+  client_secret: import_zod.z.string().optional(),
+  confidential: import_zod.z.boolean(),
+  client_name: import_zod.z.string(),
+  client_uri: import_zod.z.string().nullable().optional(),
+  redirect_uris: import_zod.z.array(import_zod.z.string()),
+  created_at: import_zod.z.string()
+});
+var OAuthClientSecretRotateResponseSchema = import_zod.z.object({
+  client_id: import_zod.z.string(),
+  client_secret: import_zod.z.string()
+});
+var OAuthAuthorizeQuerySchema = import_zod.z.object({
+  response_type: import_zod.z.literal("code"),
+  client_id: import_zod.z.string().min(1),
+  redirect_uri: oauthRedirectUriSchema,
+  scope: import_zod.z.string().optional(),
+  state: import_zod.z.string().optional(),
+  code_challenge: import_zod.z.string().min(43).max(128).optional(),
+  code_challenge_method: import_zod.z.literal("S256").optional()
+});
+var OAuthConsentBodySchema = import_zod.z.object({
+  action: import_zod.z.enum(["allow", "deny"]),
+  client_id: import_zod.z.string().min(1),
+  redirect_uri: oauthRedirectUriSchema,
+  scope: import_zod.z.string().optional(),
+  state: import_zod.z.string().optional(),
+  trust: import_zod.z.boolean().optional(),
+  code_challenge: import_zod.z.string().min(43).max(128).optional(),
+  code_challenge_method: import_zod.z.literal("S256").optional()
+});
+var OAuthAuthorizationCodeRowSchema = import_zod.z.object({
+  code: import_zod.z.string(),
+  client_id: import_zod.z.string(),
+  user_id: import_zod.z.number(),
+  redirect_uri: import_zod.z.string(),
+  scope: import_zod.z.string().nullable().optional(),
+  code_challenge: import_zod.z.string().nullable().optional(),
+  code_challenge_method: import_zod.z.string().nullable().optional(),
+  expires_at: import_zod.z.string(),
+  used: import_zod.z.boolean(),
+  created_at: import_zod.z.string()
+});
+
+// src/core/schema/OAuthClientSchema.ts
+var import_zod2 = require("zod");
+var OAuthUserCredentialsSchema = import_zod2.z.object({
+  user_id: import_zod2.z.number(),
+  provider_refresh_token: import_zod2.z.string().nullable().optional(),
+  provider_session_token: import_zod2.z.string().nullable().optional(),
+  updated_at: import_zod2.z.string()
+});
+var OAuthRefreshTokenSchema = import_zod2.z.object({
+  id: import_zod2.z.number(),
+  refresh_token: import_zod2.z.string(),
+  client_id: import_zod2.z.string(),
+  user_id: import_zod2.z.number(),
+  expires_at: import_zod2.z.string(),
+  revoked: import_zod2.z.boolean(),
+  created_at: import_zod2.z.string()
+});
+var OAuthTokenResponseSchema = import_zod2.z.object({
+  access_token: import_zod2.z.string(),
+  token_type: import_zod2.z.literal("Bearer"),
+  expires_in: import_zod2.z.number(),
+  refresh_token: import_zod2.z.string().optional(),
+  scope: import_zod2.z.string().optional()
+});
+
+// src/core/schema/OAuthUserInfoSchema.ts
+var import_zod3 = require("zod");
+var OAuthUserInfoResponseSchema = import_zod3.z.object({
+  sub: import_zod3.z.string(),
+  email: import_zod3.z.string().email(),
+  name: import_zod3.z.string(),
+  roles: import_zod3.z.array(import_zod3.z.string()).optional()
+});
+var OAuthUserInfoErrorResponseSchema = import_zod3.z.object({
+  error: import_zod3.z.literal("invalid_token"),
+  error_id: import_zod3.z.string().optional()
+});
+
+// src/core/schema/OAuthTokenSchema.ts
+var import_zod4 = require("zod");
+var OAuthTokenAuthorizationCodeSchema = import_zod4.z.object({
+  grant_type: import_zod4.z.literal("authorization_code"),
+  code: import_zod4.z.string().min(1),
+  redirect_uri: import_zod4.z.string().min(1),
+  client_id: import_zod4.z.string().min(1),
+  client_secret: import_zod4.z.string().min(1).optional(),
+  code_verifier: import_zod4.z.string().min(43).max(128).optional()
+});
+var OAuthTokenRefreshSchema = import_zod4.z.object({
+  grant_type: import_zod4.z.literal("refresh_token"),
+  refresh_token: import_zod4.z.string().min(1),
+  client_id: import_zod4.z.string().min(1),
+  client_secret: import_zod4.z.string().min(1).optional()
+});
+var OAuthTokenRequestSchema = import_zod4.z.discriminatedUnion("grant_type", [
+  OAuthTokenAuthorizationCodeSchema,
+  OAuthTokenRefreshSchema
+]);
+var OAuthTokenErrorResponseSchema = import_zod4.z.object({
+  error: import_zod4.z.string(),
+  error_id: import_zod4.z.string().optional(),
+  error_description: import_zod4.z.string().optional()
+});
+var OAuthTokenRevokeSchema = import_zod4.z.object({
+  token: import_zod4.z.string().min(1),
+  token_type_hint: import_zod4.z.enum(["access_token", "refresh_token"]).optional(),
+  client_id: import_zod4.z.string().min(1),
+  client_secret: import_zod4.z.string().min(1).optional()
+});
+
+// src/core/config.ts
+var OAuthRfcCodes = {
+  INVALID_REQUEST: "invalid_request",
+  INVALID_CLIENT: "invalid_client",
+  INVALID_GRANT: "invalid_grant",
+  INVALID_TOKEN: "invalid_token",
+  UNAUTHORIZED_CLIENT: "unauthorized_client",
+  INVALID_SCOPE: "invalid_scope",
+  ACCESS_DENIED: "access_denied",
+  UNSUPPORTED_RESPONSE_TYPE: "unsupported_response_type",
+  UNSUPPORTED_GRANT_TYPE: "unsupported_grant_type",
+  OAUTH_ERROR: "oauth_error"
+};
+
+// src/core/utils/pkce.ts
+var PKCE_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+function generatePkceVerifier(length = 64) {
+  const size = Math.min(128, Math.max(43, length));
+  const values = new Uint8Array(size);
+  crypto.getRandomValues(values);
+  let result = "";
+  for (let i = 0; i < size; i++) {
+    result += PKCE_CHARSET[values[i] % PKCE_CHARSET.length];
+  }
+  return result;
+}
+function base64UrlEncode(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function computePkceS256Challenge(verifier) {
+  const data = new TextEncoder().encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return base64UrlEncode(digest);
+}
+function randomOAuthState() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// src/server/utils/OAuthWrapperError.ts
+var import_fe_corekit = require("@qlover/fe-corekit");
+var OAuthWrapperError = class extends import_fe_corekit.ExecutorError {
+  constructor(id, status, cause) {
+    super(id, cause);
+    this.status = status;
+  }
+  name = "OAuthWrapperError";
+};
+
+// src/server/utils/pkce.ts
+var import_crypto = require("crypto");
+var PKCE_VERIFIER_MIN = 43;
+var PKCE_VERIFIER_MAX = 128;
+var UNRESERVED = /^[A-Za-z0-9\-._~]+$/;
+function isValidCodeVerifier(verifier) {
+  const len = verifier.length;
+  if (len < PKCE_VERIFIER_MIN || len > PKCE_VERIFIER_MAX) {
+    return false;
+  }
+  return UNRESERVED.test(verifier);
+}
+function isValidCodeChallenge(challenge) {
+  if (challenge.length < PKCE_VERIFIER_MIN || challenge.length > PKCE_VERIFIER_MAX) {
+    return false;
+  }
+  return UNRESERVED.test(challenge);
+}
+function computeS256CodeChallenge(verifier) {
+  return (0, import_crypto.createHash)("sha256").update(verifier).digest("base64url");
+}
+function verifyPkceS256(verifier, challenge) {
+  if (!isValidCodeVerifier(verifier) || !isValidCodeChallenge(challenge)) {
+    return false;
+  }
+  const computed = computeS256CodeChallenge(verifier);
+  try {
+    return (0, import_crypto.timingSafeEqual)(Buffer.from(computed), Buffer.from(challenge));
+  } catch {
+    return false;
+  }
+}
+
+// src/server/services/OAuthTokenService.ts
+function hashOpaqueToken(token) {
+  return (0, import_crypto2.createHash)("sha256").update(token).digest("hex");
+}
+var OAuthTokenService = class _OAuthTokenService {
+  constructor(tokenEncryption, userAdapter, oauthRepo) {
+    this.tokenEncryption = tokenEncryption;
+    this.userAdapter = userAdapter;
+    this.oauthRepo = oauthRepo;
+  }
+  static REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1e3;
+  /**
+   * @override
+   */
+  async exchangeToken(rawFields) {
+    let request;
+    try {
+      request = OAuthTokenRequestSchema.parse(rawFields);
+    } catch {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_REQUEST,
+        400,
+        "Malformed token request"
+      );
+    }
+    let client;
+    try {
+      client = await this.oauthRepo.verifyClientCredentials(
+        request.client_id,
+        request.client_secret
+      );
+    } catch {
+      throw new OAuthWrapperError(OAuthRfcCodes.INVALID_CLIENT, 401);
+    }
+    if (!client.grant_types.includes(request.grant_type)) {
+      throw new OAuthWrapperError(OAuthRfcCodes.UNSUPPORTED_GRANT_TYPE, 400);
+    }
+    if (request.grant_type === "authorization_code") {
+      return await this.exchangeAuthorizationCode(request, client.client_id);
+    }
+    return await this.exchangeRefreshToken(request, client.client_id);
+  }
+  async exchangeAuthorizationCode(request, verifiedClientId) {
+    const authCode = await this.oauthRepo.consumeCode(request.code);
+    if (!authCode) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "Authorization code is invalid, expired, or already used"
+      );
+    }
+    if (authCode.client_id !== verifiedClientId) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "client_id mismatch"
+      );
+    }
+    if (authCode.redirect_uri !== request.redirect_uri) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "redirect_uri mismatch"
+      );
+    }
+    this.assertPkceForAuthorizationCode(request, authCode);
+    const providerTokens = await this.fetchProviderAccessToken(
+      authCode.user_id
+    );
+    const middlewareRefresh = await this.issueMiddlewareRefreshToken(
+      authCode.client_id,
+      authCode.user_id
+    );
+    return {
+      access_token: providerTokens.access_token,
+      token_type: "Bearer",
+      expires_in: providerTokens.expires_in,
+      refresh_token: middlewareRefresh,
+      scope: authCode.scope ?? void 0
+    };
+  }
+  assertPkceForAuthorizationCode(request, authCode) {
+    const storedChallenge = authCode.code_challenge?.trim();
+    if (storedChallenge) {
+      const verifier = request.code_verifier?.trim();
+      if (!verifier) {
+        throw new OAuthWrapperError(
+          OAuthRfcCodes.INVALID_GRANT,
+          400,
+          "code_verifier is required"
+        );
+      }
+      if (authCode.code_challenge_method !== "S256") {
+        throw new OAuthWrapperError(
+          OAuthRfcCodes.INVALID_GRANT,
+          400,
+          "Unsupported PKCE method"
+        );
+      }
+      if (!verifyPkceS256(verifier, storedChallenge)) {
+        throw new OAuthWrapperError(
+          OAuthRfcCodes.INVALID_GRANT,
+          400,
+          "code_verifier mismatch"
+        );
+      }
+      return;
+    }
+    if (!request.client_secret?.trim()) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_CLIENT,
+        401,
+        "client_secret is required when PKCE is not used"
+      );
+    }
+  }
+  async exchangeRefreshToken(request, verifiedClientId) {
+    const tokenHash = hashOpaqueToken(request.refresh_token);
+    const stored = await this.oauthRepo.findByTokenHash(tokenHash);
+    if (!stored || stored.revoked || stored.client_id !== verifiedClientId || new Date(stored.expires_at) <= /* @__PURE__ */ new Date()) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "Refresh token is invalid"
+      );
+    }
+    const providerTokens = await this.fetchProviderAccessToken(stored.user_id);
+    await this.oauthRepo.revokeByTokenHash(tokenHash);
+    const middlewareRefresh = await this.issueMiddlewareRefreshToken(
+      stored.client_id,
+      stored.user_id
+    );
+    return {
+      access_token: providerTokens.access_token,
+      token_type: "Bearer",
+      expires_in: providerTokens.expires_in,
+      refresh_token: middlewareRefresh
+    };
+  }
+  async fetchProviderAccessToken(userId) {
+    const credentials = await this.oauthRepo.getUserCredentials(userId);
+    const sessionToken = credentials?.provider_session_token?.trim();
+    if (!sessionToken) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "User credentials expired. Re-authorization required."
+      );
+    }
+    try {
+      const access = await this.userAdapter.exchangeAccessToken({
+        token: sessionToken
+      });
+      if (access.refresh_token) {
+        await this.oauthRepo.upsertUserCredentials(userId, {
+          provider_refresh_token: this.tokenEncryption.encrypt(
+            access.refresh_token
+          )
+        });
+      }
+      return {
+        access_token: access.access_token,
+        expires_in: access.expires_in
+      };
+    } catch {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "Failed to obtain access token from user provider"
+      );
+    }
+  }
+  async issueMiddlewareRefreshToken(clientId, userId) {
+    const plain = (0, import_crypto2.randomBytes)(32).toString("base64url");
+    const expiresAt = new Date(
+      Date.now() + _OAuthTokenService.REFRESH_TOKEN_TTL_MS
+    ).toISOString();
+    await this.oauthRepo.createRefreshToken({
+      refresh_token: hashOpaqueToken(plain),
+      client_id: clientId,
+      user_id: userId,
+      expires_at: expiresAt
+    });
+    return plain;
+  }
+  /**
+   * @override
+   * RFC 7009 — revoke middleware refresh tokens. Idempotent: unknown tokens are ignored.
+   */
+  async revokeToken(rawFields) {
+    let request;
+    try {
+      request = OAuthTokenRevokeSchema.parse(rawFields);
+    } catch {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_REQUEST,
+        400,
+        "Malformed revocation request"
+      );
+    }
+    try {
+      await this.oauthRepo.verifyClientCredentials(
+        request.client_id,
+        request.client_secret
+      );
+    } catch {
+      throw new OAuthWrapperError(OAuthRfcCodes.INVALID_CLIENT, 401);
+    }
+    if (request.token_type_hint && request.token_type_hint !== "refresh_token") {
+      return;
+    }
+    const tokenHash = hashOpaqueToken(request.token);
+    const stored = await this.oauthRepo.findByTokenHash(tokenHash);
+    if (!stored || stored.client_id !== request.client_id) {
+      return;
+    }
+    await this.oauthRepo.revokeByTokenHash(tokenHash);
+  }
+};
+
+// src/server/services/OAuthWrapperService.ts
+var import_crypto3 = require("crypto");
+var import_fe_corekit2 = require("@qlover/fe-corekit");
+
+// src/server/utils/authorizeUtil.ts
+function validatePkceParams(parsed, confidential) {
+  const hasChallenge = Boolean(parsed.code_challenge?.trim());
+  const hasMethod = Boolean(parsed.code_challenge_method);
+  if (!confidential) {
+    if (!hasChallenge || parsed.code_challenge_method !== "S256") {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Public clients must send code_challenge and code_challenge_method=S256."
+      };
+    }
+    if (!isValidCodeChallenge(parsed.code_challenge)) {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Invalid code_challenge."
+      };
+    }
+    return null;
+  }
+  if (hasChallenge !== hasMethod) {
+    return {
+      errorKey: OAuthRfcCodes.INVALID_REQUEST,
+      message: "code_challenge and code_challenge_method must be sent together."
+    };
+  }
+  if (hasChallenge) {
+    if (parsed.code_challenge_method !== "S256") {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Only code_challenge_method=S256 is supported."
+      };
+    }
+    if (!isValidCodeChallenge(parsed.code_challenge)) {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Invalid code_challenge."
+      };
+    }
+  }
+  return null;
+}
+function normalizeQuery(raw) {
+  const result = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (Array.isArray(value)) {
+      result[key] = value[0];
+    } else {
+      result[key] = value;
+    }
+  }
+  if (!result.response_type) {
+    result.response_type = "code";
+  }
+  return result;
+}
+function isRedirectUriAllowed(redirectUri, client) {
+  return client.redirect_uris.includes(redirectUri);
+}
+
+// src/server/utils/oauthRedirectUtils.ts
+function buildOAuthRedirectUrl(redirectUri, params) {
+  const url = new URL(redirectUri);
+  for (const [key, value] of Object.entries(params)) {
+    if (value != null && value !== "") {
+      url.searchParams.set(key, value);
+    }
+  }
+  return url.toString();
+}
+function parseScopeList(scope) {
+  if (!scope?.trim()) {
+    return ["openid", "profile", "email"];
+  }
+  return scope.trim().split(/\s+/).filter(Boolean);
+}
+
+// src/server/services/OAuthWrapperService.ts
+var AUTH_CODE_TTL_MS = 5 * 60 * 1e3;
+var OAuthWrapperService = class {
+  constructor(oauthSession, userAdapter, tokenService, oauthRepo) {
+    this.oauthSession = oauthSession;
+    this.userAdapter = userAdapter;
+    this.tokenService = tokenService;
+    this.oauthRepo = oauthRepo;
+  }
+  /**
+   * @override
+   */
+  getOAuthSession() {
+    return this.oauthSession;
+  }
+  /**
+   * @override
+   */
+  getOAuthAdapter() {
+    return this.userAdapter;
+  }
+  /**
+   * @override
+   */
+  getOAuthTokenService() {
+    return this.tokenService;
+  }
+  /**
+   * @override
+   */
+  getOAuthRepo() {
+    return this.oauthRepo;
+  }
+  isQuery(query) {
+    return OAuthAuthorizeQuerySchema.safeParse(query).success;
+  }
+  isValidateConsent(value) {
+    return OAuthConsentBodySchema.safeParse(value).success;
+  }
+  /**
+   * @override
+   */
+  async resolveAuthorizePage(rawQuery) {
+    const query = normalizeQuery(rawQuery);
+    if (!this.isQuery(query)) {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.INVALID_REQUEST,
+          message: "Missing or invalid authorization request parameters."
+        }
+      };
+    }
+    if (query.response_type !== "code") {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.UNSUPPORTED_RESPONSE_TYPE,
+          message: "Only response_type=code is supported."
+        }
+      };
+    }
+    const client = await this.oauthRepo.findClientById(query.client_id);
+    if (!client) {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.UNAUTHORIZED_CLIENT,
+          message: "Unknown client_id."
+        }
+      };
+    }
+    if (!isRedirectUriAllowed(query.redirect_uri, client)) {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.UNAUTHORIZED_CLIENT,
+          message: "redirect_uri is not registered for this client."
+        }
+      };
+    }
+    const requestedScopes = parseScopeList(query.scope);
+    const invalidScope = requestedScopes.find(
+      (scope) => !client.scopes.includes(scope)
+    );
+    if (invalidScope) {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.INVALID_SCOPE,
+          message: `Scope "${invalidScope}" is not allowed for this client.`
+        }
+      };
+    }
+    const pkceError = validatePkceParams(query, client.confidential);
+    if (pkceError) {
+      return { ok: false, error: pkceError };
+    }
+    return {
+      ok: true,
+      data: {
+        clientId: client.client_id,
+        clientName: client.client_name,
+        clientUri: client.client_uri ?? null,
+        logoUri: client.logo_uri ?? null,
+        redirectUri: query.redirect_uri,
+        scopes: requestedScopes,
+        state: query.state,
+        responseType: "code",
+        codeChallenge: query.code_challenge,
+        codeChallengeMethod: query.code_challenge_method,
+        confidential: client.confidential
+      }
+    };
+  }
+  /**
+   * @override
+   */
+  async processConsent(requestBody) {
+    if (!this.isValidateConsent(requestBody)) {
+      throw new import_fe_corekit2.ExecutorError(
+        OAuthRfcCodes.INVALID_REQUEST,
+        "Invalid consent request body"
+      );
+    }
+    const session = await this.oauthSession.getSession();
+    if (!session) {
+      throw new import_fe_corekit2.ExecutorError(
+        OAuthRfcCodes.ACCESS_DENIED,
+        "User session expired. Please sign in again."
+      );
+    }
+    const pageResult = await this.resolveAuthorizePage({
+      response_type: "code",
+      client_id: requestBody.client_id,
+      redirect_uri: requestBody.redirect_uri,
+      scope: requestBody.scope,
+      state: requestBody.state,
+      code_challenge: requestBody.code_challenge,
+      code_challenge_method: requestBody.code_challenge_method
+    });
+    if (!pageResult.ok) {
+      throw new import_fe_corekit2.ExecutorError(
+        pageResult.error.errorKey,
+        pageResult.error.message
+      );
+    }
+    const { data } = pageResult;
+    if (requestBody.action === "deny") {
+      return {
+        redirectUrl: buildOAuthRedirectUrl(data.redirectUri, {
+          error: OAuthRfcCodes.ACCESS_DENIED,
+          error_description: "The resource owner denied the request",
+          state: data.state
+        })
+      };
+    }
+    const code = (0, import_crypto3.randomBytes)(32).toString("base64url");
+    const expiresAt = new Date(Date.now() + AUTH_CODE_TTL_MS).toISOString();
+    await this.oauthRepo.create({
+      code,
+      client_id: data.clientId,
+      user_id: session.userId,
+      redirect_uri: data.redirectUri,
+      scope: data.scopes.join(" ") || null,
+      code_challenge: data.codeChallenge ?? null,
+      code_challenge_method: data.codeChallengeMethod ?? null,
+      expires_at: expiresAt
+    });
+    void requestBody.trust;
+    return {
+      redirectUrl: buildOAuthRedirectUrl(data.redirectUri, {
+        code,
+        state: data.state
+      })
+    };
+  }
+  /**
+   * @override
+   */
+  async exchangeToken(rawFields) {
+    return await this.tokenService.exchangeToken(rawFields);
+  }
+  /**
+   * @override
+   */
+  async revokeToken(rawFields) {
+    return await this.tokenService.revokeToken(rawFields);
+  }
+  /**
+   * @override
+   */
+  async logoutUser(userId) {
+    await this.oauthRepo.revokeRefreshTokensByUserId(userId);
+    await this.oauthRepo.upsertUserCredentials(userId, {
+      provider_refresh_token: null,
+      provider_session_token: null
+    });
+    await this.oauthSession.clearSession();
+  }
+  /**
+   * @override
+   */
+  async getUserInfo(accessToken) {
+    try {
+      const profile = await this.userAdapter.getUserInfoByAccessToken(accessToken);
+      return this.toUserInfoResponse(profile);
+    } catch {
+      throw new OAuthWrapperError(OAuthRfcCodes.INVALID_TOKEN, 401);
+    }
+  }
+  toUserInfoResponse(profile) {
+    const sub = String(profile.id);
+    if (!sub || sub === "NaN") {
+      throw new OAuthWrapperError(OAuthRfcCodes.INVALID_TOKEN, 401);
+    }
+    const email = profile.email?.trim();
+    if (!email) {
+      throw new OAuthWrapperError(OAuthRfcCodes.INVALID_TOKEN, 401);
+    }
+    const nameFromParts = [profile.first_name, profile.last_name].filter(Boolean).join(" ");
+    const name = profile.name?.trim() || nameFromParts || email;
+    return {
+      sub,
+      email,
+      name,
+      ...profile.roles?.length ? { roles: profile.roles } : {}
+    };
+  }
+};
+
+// src/server/utils/clientSecretHash.ts
+var import_crypto4 = require("crypto");
+var import_util = require("util");
+var scryptAsync = (0, import_util.promisify)(import_crypto4.scrypt);
+var PREFIX = "scrypt";
+var KEY_LEN = 64;
+async function hashClientSecret(secret) {
+  const salt = (0, import_crypto4.randomBytes)(16);
+  const derived = await scryptAsync(secret, salt, KEY_LEN);
+  return `${PREFIX}$${salt.toString("base64")}$${derived.toString("base64")}`;
+}
+async function verifyClientSecret(secret, storedHash) {
+  const parts = storedHash.split("$");
+  if (parts.length !== 3 || parts[0] !== PREFIX) {
+    return false;
+  }
+  const salt = Buffer.from(parts[1], "base64");
+  const expected = Buffer.from(parts[2], "base64");
+  const derived = await scryptAsync(secret, salt, expected.length);
+  if (derived.length !== expected.length) {
+    return false;
+  }
+  return (0, import_crypto4.timingSafeEqual)(derived, expected);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OAuthAuthorizationCodeRowSchema,
+  OAuthAuthorizeQuerySchema,
+  OAuthClientCreateResponseSchema,
+  OAuthClientCreateSchema,
+  OAuthClientDetailSchema,
+  OAuthClientListItemSchema,
+  OAuthClientRowSchema,
+  OAuthClientSecretRotateResponseSchema,
+  OAuthClientUpdateSchema,
+  OAuthClientsService,
+  OAuthConsentBodySchema,
+  OAuthRefreshTokenSchema,
+  OAuthRfcCodes,
+  OAuthTokenAuthorizationCodeSchema,
+  OAuthTokenErrorResponseSchema,
+  OAuthTokenRefreshSchema,
+  OAuthTokenRequestSchema,
+  OAuthTokenResponseSchema,
+  OAuthTokenRevokeSchema,
+  OAuthTokenService,
+  OAuthUserCredentialsSchema,
+  OAuthUserInfoErrorResponseSchema,
+  OAuthUserInfoResponseSchema,
+  OAuthWrapperError,
+  OAuthWrapperService,
+  buildOAuthRedirectUrl,
+  computePkceS256Challenge,
+  computeS256CodeChallenge,
+  generatePkceVerifier,
+  hashClientSecret,
+  isOAuthRedirectUri,
+  isRedirectUriAllowed,
+  isValidCodeChallenge,
+  isValidCodeVerifier,
+  normalizeQuery,
+  parseScopeList,
+  randomOAuthState,
+  validatePkceParams,
+  verifyClientSecret,
+  verifyPkceS256
+});