@qlover/oauth-wrapper 0.2.1 → 0.3.0

package/dist/index.js

@@ -1,116 +1,3 @@
-// src/server/services/OAuthClientsService.ts
-var OAuthClientsService = class {
-  constructor(clientsRepo) {
-    this.clientsRepo = clientsRepo;
-  }
-  /**
-   * List all OAuth clients owned by a user
-   * @override
-   */
-  async listForOwner(ownerUserId) {
-    return this.clientsRepo.listClientByOwner(ownerUserId);
-  }
-  /**
-   * Get detailed information about a specific OAuth client
-   * @override
-   */
-  async getByClientId(ownerUserId, clientId) {
-    const client = await this.clientsRepo.findClientById(clientId);
-    if (!client) {
-      throw new Error("Client not found");
-    }
-    if (client.owner_user_id !== ownerUserId) {
-      throw new Error("Access denied");
-    }
-    return this.mapToDetail(client);
-  }
-  /**
-   * Create a new OAuth client
-   * @override
-   */
-  async create(ownerUserId, input) {
-    const result = await this.clientsRepo.createClient(ownerUserId, input);
-    return {
-      client_id: result.client.client_id,
-      client_secret: result.clientSecret,
-      confidential: result.client.confidential,
-      client_name: result.client.client_name,
-      client_uri: result.client.client_uri,
-      redirect_uris: result.client.redirect_uris,
-      created_at: result.client.created_at
-    };
-  }
-  /**
-   * Update an existing OAuth client
-   * @override
-   */
-  async update(ownerUserId, clientId, input) {
-    const existing = await this.clientsRepo.findClientById(clientId);
-    if (!existing) {
-      throw new Error("Client not found");
-    }
-    if (existing.owner_user_id !== ownerUserId) {
-      throw new Error("Access denied");
-    }
-    return this.clientsRepo.updateClient(ownerUserId, clientId, input);
-  }
-  /**
-   * Rotate the client secret
-   * @override
-   */
-  async rotateSecret(ownerUserId, clientId) {
-    const existing = await this.clientsRepo.findClientById(clientId);
-    if (!existing) {
-      throw new Error("Client not found");
-    }
-    if (existing.owner_user_id !== ownerUserId) {
-      throw new Error("Access denied");
-    }
-    if (!existing.confidential) {
-      throw new Error("Public clients do not have a client_secret");
-    }
-    const result = await this.clientsRepo.rotateClientSecret(
-      ownerUserId,
-      clientId
-    );
-    return {
-      client_id: clientId,
-      client_secret: result.clientSecret
-    };
-  }
-  /**
-   * Delete an OAuth client
-   * @override
-   */
-  async delete(ownerUserId, clientId) {
-    const existing = await this.clientsRepo.findClientById(clientId);
-    if (!existing) {
-      throw new Error("Client not found");
-    }
-    if (existing.owner_user_id !== ownerUserId) {
-      throw new Error("Access denied");
-    }
-    await this.clientsRepo.deleteClient(ownerUserId, clientId);
-  }
-  mapToDetail(row) {
-    return {
-      client_id: row.client_id,
-      client_name: row.client_name,
-      client_uri: row.client_uri,
-      logo_uri: row.logo_uri,
-      redirect_uris: row.redirect_uris,
-      grant_types: row.grant_types,
-      scopes: row.scopes,
-      confidential: row.confidential,
-      created_at: row.created_at,
-      updated_at: row.updated_at
-    };
-  }
-};
-
-// src/server/services/OAuthTokenService.ts
-import { createHash as createHash2, randomBytes } from "crypto";
-
 // src/core/schema/OAuthAuthorizeSchema.ts
 import { z } from "zod";
 function isOAuthRedirectUri(value) {
@@ -219,6 +106,18 @@ var OAuthAuthorizationCodeRowSchema = z.object({
   used: z.boolean(),
   created_at: z.string()
 });
+var signWithPhoneOtpSchema = z.object({
+  /** The user's phone number. */
+  phone: z.string(),
+  /** The otp sent to the user's phone number. */
+  token: z.string().optional()
+});
+var signWithEmailOtpSchema = z.object({
+  /** The user's email address. */
+  email: z.email(),
+  /** The otp sent to the user's email address. */
+  token: z.string().optional()
+});
 
 // src/core/schema/OAuthClientSchema.ts
 import { z as z2 } from "zod";
@@ -249,12 +148,12 @@ var OAuthTokenResponseSchema = z2.object({
 import { z as z3 } from "zod";
 var OAuthUserInfoResponseSchema = z3.object({
   sub: z3.string(),
-  email: z3.string().email(),
+  email: z3.email(),
   name: z3.string(),
   roles: z3.array(z3.string()).optional()
 });
 var OAuthUserInfoErrorResponseSchema = z3.object({
-  error: z3.literal("invalid_token"),
+  error: z3.string(),
   error_id: z3.string().optional()
 });
 
@@ -335,16 +234,6 @@ function randomOAuthState() {
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
 
-// src/server/utils/OAuthWrapperError.ts
-import { ExecutorError } from "@qlover/fe-corekit";
-var OAuthWrapperError = class extends ExecutorError {
-  constructor(id, status, cause) {
-    super(id, cause);
-    this.status = status;
-  }
-  name = "OAuthWrapperError";
-};
-
 // src/server/utils/pkce.ts
 import { createHash, timingSafeEqual } from "crypto";
 var PKCE_VERIFIER_MIN = 43;
@@ -378,90 +267,467 @@ function verifyPkceS256(verifier, challenge) {
   }
 }
 
-// src/server/services/OAuthTokenService.ts
-function hashOpaqueToken(token) {
-  return createHash2("sha256").update(token).digest("hex");
-}
-var OAuthTokenService = class _OAuthTokenService {
-  constructor(tokenEncryption, userAdapter, oauthRepo) {
-    this.tokenEncryption = tokenEncryption;
-    this.userAdapter = userAdapter;
-    this.oauthRepo = oauthRepo;
-  }
-  static REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1e3;
-  /**
-   * @override
-   */
-  async exchangeToken(rawFields) {
-    let request;
-    try {
-      request = OAuthTokenRequestSchema.parse(rawFields);
-    } catch {
-      throw new OAuthWrapperError(
-        OAuthRfcCodes.INVALID_REQUEST,
-        400,
-        "Malformed token request"
-      );
+// src/server/utils/authorizeUtil.ts
+function validatePkceParams(parsed, confidential) {
+  const hasChallenge = Boolean(parsed.code_challenge?.trim());
+  const hasMethod = Boolean(parsed.code_challenge_method);
+  if (!confidential) {
+    if (!hasChallenge || parsed.code_challenge_method !== "S256") {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Public clients must send code_challenge and code_challenge_method=S256."
+      };
     }
-    let client;
-    try {
-      client = await this.oauthRepo.verifyClientCredentials(
-        request.client_id,
-        request.client_secret
-      );
-    } catch {
-      throw new OAuthWrapperError(OAuthRfcCodes.INVALID_CLIENT, 401);
+    if (!isValidCodeChallenge(parsed.code_challenge)) {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Invalid code_challenge."
+      };
     }
-    if (!client.grant_types.includes(request.grant_type)) {
-      throw new OAuthWrapperError(OAuthRfcCodes.UNSUPPORTED_GRANT_TYPE, 400);
+    return null;
+  }
+  if (hasChallenge !== hasMethod) {
+    return {
+      errorKey: OAuthRfcCodes.INVALID_REQUEST,
+      message: "code_challenge and code_challenge_method must be sent together."
+    };
+  }
+  if (hasChallenge) {
+    if (parsed.code_challenge_method !== "S256") {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Only code_challenge_method=S256 is supported."
+      };
     }
-    if (request.grant_type === "authorization_code") {
-      return await this.exchangeAuthorizationCode(request, client.client_id);
+    if (!isValidCodeChallenge(parsed.code_challenge)) {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Invalid code_challenge."
+      };
     }
-    return await this.exchangeRefreshToken(request, client.client_id);
   }
-  async exchangeAuthorizationCode(request, verifiedClientId) {
-    const authCode = await this.oauthRepo.consumeCode(request.code);
-    if (!authCode) {
-      throw new OAuthWrapperError(
-        OAuthRfcCodes.INVALID_GRANT,
-        400,
-        "Authorization code is invalid, expired, or already used"
-      );
-    }
-    if (authCode.client_id !== verifiedClientId) {
-      throw new OAuthWrapperError(
-        OAuthRfcCodes.INVALID_GRANT,
-        400,
-        "client_id mismatch"
-      );
+  return null;
+}
+function normalizeQuery(raw) {
+  const result = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (Array.isArray(value)) {
+      result[key] = value[0];
+    } else {
+      result[key] = value;
     }
-    if (authCode.redirect_uri !== request.redirect_uri) {
-      throw new OAuthWrapperError(
-        OAuthRfcCodes.INVALID_GRANT,
-        400,
-        "redirect_uri mismatch"
-      );
+  }
+  if (!result.response_type) {
+    result.response_type = "code";
+  }
+  return result;
+}
+function isRedirectUriAllowed(redirectUri, client) {
+  return client.redirect_uris.includes(redirectUri);
+}
+
+// src/server/utils/oauthRedirectUtils.ts
+function buildOAuthRedirectUrl(redirectUri, params) {
+  const url = new URL(redirectUri);
+  for (const [key, value] of Object.entries(params)) {
+    if (value != null && value !== "") {
+      url.searchParams.set(key, value);
     }
-    this.assertPkceForAuthorizationCode(request, authCode);
-    const providerTokens = await this.fetchProviderAccessToken(
-      authCode.user_id
-    );
-    const middlewareRefresh = await this.issueMiddlewareRefreshToken(
-      authCode.client_id,
-      authCode.user_id
-    );
-    return {
-      access_token: providerTokens.access_token,
-      token_type: "Bearer",
-      expires_in: providerTokens.expires_in,
-      refresh_token: middlewareRefresh,
-      scope: authCode.scope ?? void 0
-    };
   }
-  assertPkceForAuthorizationCode(request, authCode) {
-    const storedChallenge = authCode.code_challenge?.trim();
-    if (storedChallenge) {
+  return url.toString();
+}
+function parseScopeList(scope) {
+  if (!scope?.trim()) {
+    return ["openid", "profile", "email"];
+  }
+  return scope.trim().split(/\s+/).filter(Boolean);
+}
+
+// src/server/services/OAuthAbstractProvider.ts
+import { ExecutorError } from "@qlover/fe-corekit";
+import { randomBytes } from "crypto";
+var OAuthAbstractProvider = class {
+  authCodeTTLMs = 5 * 60 * 1e3;
+  isQuery(query) {
+    return OAuthAuthorizeQuerySchema.safeParse(query).success;
+  }
+  isValidateConsent(value) {
+    return OAuthConsentBodySchema.safeParse(value).success;
+  }
+  generageSessionPayload(userInfo) {
+    return {
+      userId: String(userInfo.id),
+      email: userInfo.email,
+      name: userInfo.name ?? userInfo.email,
+      providerSessionToken: userInfo.sessionToken
+    };
+  }
+  /**
+   * @override
+   */
+  async logout(userId) {
+    const oauthRepo = this.getOAuthRepo();
+    await oauthRepo.revokeRefreshTokensByUserId(userId);
+    await oauthRepo.upsertUserCredentials(userId, {
+      provider_refresh_token: null,
+      provider_session_token: null
+    });
+    await this.clearSession();
+  }
+  /**
+   * @override
+   */
+  async resolveAuthorizePage(rawQuery) {
+    const query = normalizeQuery(rawQuery);
+    if (!this.isQuery(query)) {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.INVALID_REQUEST,
+          message: "Missing or invalid authorization request parameters."
+        }
+      };
+    }
+    if (query.response_type !== "code") {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.UNSUPPORTED_RESPONSE_TYPE,
+          message: "Only response_type=code is supported."
+        }
+      };
+    }
+    const oauthRepo = this.getOAuthRepo();
+    const client = await oauthRepo.findClientById(query.client_id);
+    if (!client) {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.UNAUTHORIZED_CLIENT,
+          message: "Unknown client_id."
+        }
+      };
+    }
+    if (!isRedirectUriAllowed(query.redirect_uri, client)) {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.UNAUTHORIZED_CLIENT,
+          message: "redirect_uri is not registered for this client."
+        }
+      };
+    }
+    const requestedScopes = parseScopeList(query.scope);
+    const invalidScope = requestedScopes.find(
+      (scope) => !client.scopes.includes(scope)
+    );
+    if (invalidScope) {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.INVALID_SCOPE,
+          message: `Scope "${invalidScope}" is not allowed for this client.`
+        }
+      };
+    }
+    const pkceError = validatePkceParams(query, client.confidential);
+    if (pkceError) {
+      return { ok: false, error: pkceError };
+    }
+    return {
+      ok: true,
+      data: {
+        clientId: client.client_id,
+        clientName: client.client_name,
+        clientUri: client.client_uri ?? null,
+        logoUri: client.logo_uri ?? null,
+        redirectUri: query.redirect_uri,
+        scopes: requestedScopes,
+        state: query.state,
+        responseType: "code",
+        codeChallenge: query.code_challenge,
+        codeChallengeMethod: query.code_challenge_method,
+        confidential: client.confidential
+      }
+    };
+  }
+  /**
+   * @override
+   */
+  async processConsent(requestBody) {
+    if (!this.isValidateConsent(requestBody)) {
+      throw new ExecutorError(
+        OAuthRfcCodes.INVALID_REQUEST,
+        "Invalid consent request body"
+      );
+    }
+    const session = await this.getSession();
+    if (!session) {
+      throw new ExecutorError(
+        OAuthRfcCodes.ACCESS_DENIED,
+        "User session expired. Please sign in again."
+      );
+    }
+    const pageResult = await this.resolveAuthorizePage({
+      response_type: "code",
+      client_id: requestBody.client_id,
+      redirect_uri: requestBody.redirect_uri,
+      scope: requestBody.scope,
+      state: requestBody.state,
+      code_challenge: requestBody.code_challenge,
+      code_challenge_method: requestBody.code_challenge_method
+    });
+    if (!pageResult.ok) {
+      throw new ExecutorError(
+        pageResult.error.errorKey,
+        pageResult.error.message
+      );
+    }
+    const { data } = pageResult;
+    if (requestBody.action === "deny") {
+      return {
+        redirectUrl: buildOAuthRedirectUrl(data.redirectUri, {
+          error: OAuthRfcCodes.ACCESS_DENIED,
+          error_description: "The resource owner denied the request",
+          state: data.state
+        })
+      };
+    }
+    const code = randomBytes(32).toString("base64url");
+    const expiresAt = new Date(Date.now() + this.authCodeTTLMs).toISOString();
+    const oauthRepo = this.getOAuthRepo();
+    await oauthRepo.create({
+      code,
+      client_id: data.clientId,
+      user_id: session.userId,
+      redirect_uri: data.redirectUri,
+      scope: data.scopes.join(" ") || null,
+      code_challenge: data.codeChallenge ?? null,
+      code_challenge_method: data.codeChallengeMethod ?? null,
+      expires_at: expiresAt
+    });
+    void requestBody.trust;
+    return {
+      redirectUrl: buildOAuthRedirectUrl(data.redirectUri, {
+        code,
+        state: data.state
+      })
+    };
+  }
+};
+
+// src/server/services/OAuthClientsService.ts
+var OAuthClientsService = class {
+  constructor(clientsRepo) {
+    this.clientsRepo = clientsRepo;
+  }
+  clientsRepo;
+  /**
+   * List all OAuth clients owned by a user
+   * @override
+   */
+  async listForOwner(ownerUserId) {
+    return this.clientsRepo.listClientByOwner(ownerUserId);
+  }
+  /**
+   * Get detailed information about a specific OAuth client
+   * @override
+   */
+  async getByClientId(ownerUserId, clientId) {
+    const client = await this.clientsRepo.findClientById(clientId);
+    if (!client) {
+      throw new Error("Client not found");
+    }
+    if (client.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    return this.mapToDetail(client);
+  }
+  /**
+   * Create a new OAuth client
+   * @override
+   */
+  async create(ownerUserId, input) {
+    const result = await this.clientsRepo.createClient(ownerUserId, input);
+    return {
+      client_id: result.client.client_id,
+      client_secret: result.clientSecret,
+      confidential: result.client.confidential,
+      client_name: result.client.client_name,
+      client_uri: result.client.client_uri,
+      redirect_uris: result.client.redirect_uris,
+      created_at: result.client.created_at
+    };
+  }
+  /**
+   * Update an existing OAuth client
+   * @override
+   */
+  async update(ownerUserId, clientId, input) {
+    const existing = await this.clientsRepo.findClientById(clientId);
+    if (!existing) {
+      throw new Error("Client not found");
+    }
+    if (existing.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    return this.clientsRepo.updateClient(ownerUserId, clientId, input);
+  }
+  /**
+   * Rotate the client secret
+   * @override
+   */
+  async rotateSecret(ownerUserId, clientId) {
+    const existing = await this.clientsRepo.findClientById(clientId);
+    if (!existing) {
+      throw new Error("Client not found");
+    }
+    if (existing.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    if (!existing.confidential) {
+      throw new Error("Public clients do not have a client_secret");
+    }
+    const result = await this.clientsRepo.rotateClientSecret(
+      ownerUserId,
+      clientId
+    );
+    return {
+      client_id: clientId,
+      client_secret: result.clientSecret
+    };
+  }
+  /**
+   * Delete an OAuth client
+   * @override
+   */
+  async delete(ownerUserId, clientId) {
+    const existing = await this.clientsRepo.findClientById(clientId);
+    if (!existing) {
+      throw new Error("Client not found");
+    }
+    if (existing.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    await this.clientsRepo.deleteClient(ownerUserId, clientId);
+  }
+  mapToDetail(row) {
+    return {
+      client_id: row.client_id,
+      client_name: row.client_name,
+      client_uri: row.client_uri,
+      logo_uri: row.logo_uri,
+      redirect_uris: row.redirect_uris,
+      grant_types: row.grant_types,
+      scopes: row.scopes,
+      confidential: row.confidential,
+      created_at: row.created_at,
+      updated_at: row.updated_at
+    };
+  }
+};
+
+// src/server/services/OAuthTokenService.ts
+import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+
+// src/server/utils/OAuthWrapperError.ts
+import { ExecutorError as ExecutorError2 } from "@qlover/fe-corekit";
+var OAuthWrapperError = class extends ExecutorError2 {
+  constructor(id, status, cause) {
+    super(id, cause);
+    this.status = status;
+  }
+  status;
+  name = "OAuthWrapperError";
+};
+
+// src/server/services/OAuthTokenService.ts
+function hashOpaqueToken(token) {
+  return createHash2("sha256").update(token).digest("hex");
+}
+var OAuthTokenService = class _OAuthTokenService {
+  constructor(tokenEncryption, exchangeProviderAccessToken, oauthRepo) {
+    this.tokenEncryption = tokenEncryption;
+    this.exchangeProviderAccessToken = exchangeProviderAccessToken;
+    this.oauthRepo = oauthRepo;
+  }
+  tokenEncryption;
+  exchangeProviderAccessToken;
+  oauthRepo;
+  static REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1e3;
+  /**
+   * @override
+   */
+  async exchangeToken(rawFields) {
+    let request;
+    try {
+      request = OAuthTokenRequestSchema.parse(rawFields);
+    } catch {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_REQUEST,
+        400,
+        "Malformed token request"
+      );
+    }
+    let client;
+    try {
+      client = await this.oauthRepo.verifyClientCredentials(
+        request.client_id,
+        request.client_secret
+      );
+    } catch {
+      throw new OAuthWrapperError(OAuthRfcCodes.INVALID_CLIENT, 401);
+    }
+    if (!client.grant_types.includes(request.grant_type)) {
+      throw new OAuthWrapperError(OAuthRfcCodes.UNSUPPORTED_GRANT_TYPE, 400);
+    }
+    if (request.grant_type === "authorization_code") {
+      return await this.exchangeAuthorizationCode(request, client.client_id);
+    }
+    return await this.exchangeRefreshToken(request, client.client_id);
+  }
+  async exchangeAuthorizationCode(request, verifiedClientId) {
+    const authCode = await this.oauthRepo.consumeCode(request.code);
+    if (!authCode) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "Authorization code is invalid, expired, or already used"
+      );
+    }
+    if (authCode.client_id !== verifiedClientId) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "client_id mismatch"
+      );
+    }
+    if (authCode.redirect_uri !== request.redirect_uri) {
+      throw new OAuthWrapperError(
+        OAuthRfcCodes.INVALID_GRANT,
+        400,
+        "redirect_uri mismatch"
+      );
+    }
+    this.assertPkceForAuthorizationCode(request, authCode);
+    const providerTokens = await this.fetchProviderAccessToken(
+      authCode.user_id
+    );
+    const middlewareRefresh = await this.issueMiddlewareRefreshToken(
+      authCode.client_id,
+      authCode.user_id
+    );
+    return {
+      access_token: providerTokens.access_token,
+      token_type: "Bearer",
+      expires_in: providerTokens.expires_in,
+      refresh_token: middlewareRefresh,
+      scope: authCode.scope ?? void 0
+    };
+  }
+  assertPkceForAuthorizationCode(request, authCode) {
+    const storedChallenge = authCode.code_challenge?.trim();
+    if (storedChallenge) {
       const verifier = request.code_verifier?.trim();
       if (!verifier) {
         throw new OAuthWrapperError(
@@ -528,7 +794,7 @@ var OAuthTokenService = class _OAuthTokenService {
       );
     }
     try {
-      const access = await this.userAdapter.exchangeAccessToken({
+      const access = await this.exchangeProviderAccessToken({
         token: sessionToken
       });
       if (access.refresh_token) {
@@ -551,7 +817,7 @@ var OAuthTokenService = class _OAuthTokenService {
     }
   }
   async issueMiddlewareRefreshToken(clientId, userId) {
-    const plain = randomBytes(32).toString("base64url");
+    const plain = randomBytes2(32).toString("base64url");
     const expiresAt = new Date(
       Date.now() + _OAuthTokenService.REFRESH_TOKEN_TTL_MS
     ).toISOString();
@@ -599,111 +865,41 @@ var OAuthTokenService = class _OAuthTokenService {
 };
 
 // src/server/services/OAuthWrapperService.ts
-import { randomBytes as randomBytes2 } from "crypto";
-import { ExecutorError as ExecutorError2 } from "@qlover/fe-corekit";
-
-// src/server/utils/authorizeUtil.ts
-function validatePkceParams(parsed, confidential) {
-  const hasChallenge = Boolean(parsed.code_challenge?.trim());
-  const hasMethod = Boolean(parsed.code_challenge_method);
-  if (!confidential) {
-    if (!hasChallenge || parsed.code_challenge_method !== "S256") {
-      return {
-        errorKey: OAuthRfcCodes.INVALID_REQUEST,
-        message: "Public clients must send code_challenge and code_challenge_method=S256."
-      };
-    }
-    if (!isValidCodeChallenge(parsed.code_challenge)) {
-      return {
-        errorKey: OAuthRfcCodes.INVALID_REQUEST,
-        message: "Invalid code_challenge."
-      };
-    }
-    return null;
-  }
-  if (hasChallenge !== hasMethod) {
-    return {
-      errorKey: OAuthRfcCodes.INVALID_REQUEST,
-      message: "code_challenge and code_challenge_method must be sent together."
-    };
-  }
-  if (hasChallenge) {
-    if (parsed.code_challenge_method !== "S256") {
-      return {
-        errorKey: OAuthRfcCodes.INVALID_REQUEST,
-        message: "Only code_challenge_method=S256 is supported."
-      };
-    }
-    if (!isValidCodeChallenge(parsed.code_challenge)) {
-      return {
-        errorKey: OAuthRfcCodes.INVALID_REQUEST,
-        message: "Invalid code_challenge."
-      };
-    }
-  }
-  return null;
-}
-function normalizeQuery(raw) {
-  const result = {};
-  for (const [key, value] of Object.entries(raw)) {
-    if (Array.isArray(value)) {
-      result[key] = value[0];
-    } else {
-      result[key] = value;
-    }
-  }
-  if (!result.response_type) {
-    result.response_type = "code";
-  }
-  return result;
-}
-function isRedirectUriAllowed(redirectUri, client) {
-  return client.redirect_uris.includes(redirectUri);
-}
-
-// src/server/utils/oauthRedirectUtils.ts
-function buildOAuthRedirectUrl(redirectUri, params) {
-  const url = new URL(redirectUri);
-  for (const [key, value] of Object.entries(params)) {
-    if (value != null && value !== "") {
-      url.searchParams.set(key, value);
-    }
-  }
-  return url.toString();
-}
-function parseScopeList(scope) {
-  if (!scope?.trim()) {
-    return ["openid", "profile", "email"];
-  }
-  return scope.trim().split(/\s+/).filter(Boolean);
-}
-
-// src/server/services/OAuthWrapperService.ts
-var AUTH_CODE_TTL_MS = 5 * 60 * 1e3;
-var OAuthWrapperService = class {
-  constructor(oauthSession, userAdapter, tokenService, oauthRepo) {
+var OAuthWrapperService = class extends OAuthAbstractProvider {
+  constructor(oauthSession, tokenEncryption, oauthRepo) {
+    super();
     this.oauthSession = oauthSession;
-    this.userAdapter = userAdapter;
-    this.tokenService = tokenService;
     this.oauthRepo = oauthRepo;
+    this.tokenService = new OAuthTokenService(
+      tokenEncryption,
+      (params) => this.providerExchangeAccessToken(params),
+      oauthRepo
+    );
   }
+  oauthSession;
+  oauthRepo;
+  tokenService;
   /**
    * @override
    */
-  getOAuthSession() {
-    return this.oauthSession;
-  }
-  /**
-   * @override
-   */
-  getOAuthAdapter() {
-    return this.userAdapter;
-  }
-  /**
-   * @override
-   */
-  getOAuthTokenService() {
-    return this.tokenService;
+  async login(params) {
+    const credentials = await this.providerLogin(params);
+    const sessionToken = credentials.token;
+    if (!sessionToken) {
+      throw new Error("User provider login did not return a session token");
+    }
+    const userInfo = await this.providerGetUserInfo(sessionToken);
+    const sessionPayload = this.generageSessionPayload({
+      email: params.email,
+      ...userInfo,
+      sessionToken
+    });
+    this.oauthSession.setSession(sessionPayload);
+    const oauthrepo = this.getOAuthRepo();
+    await oauthrepo.upsertUserCredentials(sessionPayload.userId, {
+      provider_session_token: sessionPayload.providerSessionToken
+    });
+    return sessionPayload;
   }
   /**
    * @override
@@ -711,155 +907,23 @@ var OAuthWrapperService = class {
   getOAuthRepo() {
     return this.oauthRepo;
   }
-  isQuery(query) {
-    return OAuthAuthorizeQuerySchema.safeParse(query).success;
-  }
-  isValidateConsent(value) {
-    return OAuthConsentBodySchema.safeParse(value).success;
-  }
   /**
    * @override
    */
-  async resolveAuthorizePage(rawQuery) {
-    const query = normalizeQuery(rawQuery);
-    if (!this.isQuery(query)) {
-      return {
-        ok: false,
-        error: {
-          errorKey: OAuthRfcCodes.INVALID_REQUEST,
-          message: "Missing or invalid authorization request parameters."
-        }
-      };
-    }
-    if (query.response_type !== "code") {
-      return {
-        ok: false,
-        error: {
-          errorKey: OAuthRfcCodes.UNSUPPORTED_RESPONSE_TYPE,
-          message: "Only response_type=code is supported."
-        }
-      };
-    }
-    const client = await this.oauthRepo.findClientById(query.client_id);
-    if (!client) {
-      return {
-        ok: false,
-        error: {
-          errorKey: OAuthRfcCodes.UNAUTHORIZED_CLIENT,
-          message: "Unknown client_id."
-        }
-      };
-    }
-    if (!isRedirectUriAllowed(query.redirect_uri, client)) {
-      return {
-        ok: false,
-        error: {
-          errorKey: OAuthRfcCodes.UNAUTHORIZED_CLIENT,
-          message: "redirect_uri is not registered for this client."
-        }
-      };
-    }
-    const requestedScopes = parseScopeList(query.scope);
-    const invalidScope = requestedScopes.find(
-      (scope) => !client.scopes.includes(scope)
-    );
-    if (invalidScope) {
-      return {
-        ok: false,
-        error: {
-          errorKey: OAuthRfcCodes.INVALID_SCOPE,
-          message: `Scope "${invalidScope}" is not allowed for this client.`
-        }
-      };
-    }
-    const pkceError = validatePkceParams(query, client.confidential);
-    if (pkceError) {
-      return { ok: false, error: pkceError };
-    }
-    return {
-      ok: true,
-      data: {
-        clientId: client.client_id,
-        clientName: client.client_name,
-        clientUri: client.client_uri ?? null,
-        logoUri: client.logo_uri ?? null,
-        redirectUri: query.redirect_uri,
-        scopes: requestedScopes,
-        state: query.state,
-        responseType: "code",
-        codeChallenge: query.code_challenge,
-        codeChallengeMethod: query.code_challenge_method,
-        confidential: client.confidential
-      }
-    };
+  async exchangeToken(rawFields) {
+    return await this.tokenService.exchangeToken(rawFields);
   }
   /**
    * @override
    */
-  async processConsent(requestBody) {
-    if (!this.isValidateConsent(requestBody)) {
-      throw new ExecutorError2(
-        OAuthRfcCodes.INVALID_REQUEST,
-        "Invalid consent request body"
-      );
-    }
-    const session = await this.oauthSession.getSession();
-    if (!session) {
-      throw new ExecutorError2(
-        OAuthRfcCodes.ACCESS_DENIED,
-        "User session expired. Please sign in again."
-      );
-    }
-    const pageResult = await this.resolveAuthorizePage({
-      response_type: "code",
-      client_id: requestBody.client_id,
-      redirect_uri: requestBody.redirect_uri,
-      scope: requestBody.scope,
-      state: requestBody.state,
-      code_challenge: requestBody.code_challenge,
-      code_challenge_method: requestBody.code_challenge_method
-    });
-    if (!pageResult.ok) {
-      throw new ExecutorError2(
-        pageResult.error.errorKey,
-        pageResult.error.message
-      );
-    }
-    const { data } = pageResult;
-    if (requestBody.action === "deny") {
-      return {
-        redirectUrl: buildOAuthRedirectUrl(data.redirectUri, {
-          error: OAuthRfcCodes.ACCESS_DENIED,
-          error_description: "The resource owner denied the request",
-          state: data.state
-        })
-      };
-    }
-    const code = randomBytes2(32).toString("base64url");
-    const expiresAt = new Date(Date.now() + AUTH_CODE_TTL_MS).toISOString();
-    await this.oauthRepo.create({
-      code,
-      client_id: data.clientId,
-      user_id: session.userId,
-      redirect_uri: data.redirectUri,
-      scope: data.scopes.join(" ") || null,
-      code_challenge: data.codeChallenge ?? null,
-      code_challenge_method: data.codeChallengeMethod ?? null,
-      expires_at: expiresAt
-    });
-    void requestBody.trust;
-    return {
-      redirectUrl: buildOAuthRedirectUrl(data.redirectUri, {
-        code,
-        state: data.state
-      })
-    };
+  getSession() {
+    return this.oauthSession.getSession();
   }
   /**
    * @override
    */
-  async exchangeToken(rawFields) {
-    return await this.tokenService.exchangeToken(rawFields);
+  clearSession() {
+    return this.oauthSession.clearSession();
   }
   /**
    * @override
@@ -867,9 +931,6 @@ var OAuthWrapperService = class {
   async revokeToken(rawFields) {
     return await this.tokenService.revokeToken(rawFields);
   }
-  /**
-   * @override
-   */
   async logoutUser(userId) {
     await this.oauthRepo.revokeRefreshTokensByUserId(userId);
     await this.oauthRepo.upsertUserCredentials(userId, {
@@ -881,9 +942,9 @@ var OAuthWrapperService = class {
   /**
    * @override
    */
-  async getUserInfo(accessToken) {
+  async getUserInfoWithAccessToken(accessToken) {
     try {
-      const profile = await this.userAdapter.getUserInfoByAccessToken(accessToken);
+      const profile = await this.providerGetUserInfoByAccessToken(accessToken);
       return this.toUserInfoResponse(profile);
     } catch {
       throw new OAuthWrapperError(OAuthRfcCodes.INVALID_TOKEN, 401);
@@ -898,8 +959,7 @@ var OAuthWrapperService = class {
     if (!email) {
       throw new OAuthWrapperError(OAuthRfcCodes.INVALID_TOKEN, 401);
     }
-    const nameFromParts = [profile.first_name, profile.last_name].filter(Boolean).join(" ");
-    const name = profile.name?.trim() || nameFromParts || email;
+    const name = profile.name?.trim() || email;
     return {
       sub,
       email,
@@ -934,6 +994,7 @@ async function verifyClientSecret(secret, storedHash) {
   return timingSafeEqual2(derived, expected);
 }
 export {
+  OAuthAbstractProvider,
   OAuthAuthorizationCodeRowSchema,
   OAuthAuthorizeQuerySchema,
   OAuthClientCreateResponseSchema,
@@ -971,6 +1032,8 @@ export {
   normalizeQuery,
   parseScopeList,
   randomOAuthState,
+  signWithEmailOtpSchema,
+  signWithPhoneOtpSchema,
   validatePkceParams,
   verifyClientSecret,
   verifyPkceS256