@qlover/oauth-wrapper 0.4.0 → 0.6.2

package/dist/index.js

@@ -1,3 +1,117 @@
+// src/server/services/OAuthClientsService.ts
+var OAuthClientsService = class {
+  constructor(clientsRepo) {
+    this.clientsRepo = clientsRepo;
+  }
+  clientsRepo;
+  /**
+   * List all OAuth clients owned by a user
+   * @override
+   */
+  async listForOwner(ownerUserId) {
+    return this.clientsRepo.listClientByOwner(ownerUserId);
+  }
+  /**
+   * Get detailed information about a specific OAuth client
+   * @override
+   */
+  async getByClientId(ownerUserId, clientId) {
+    const client = await this.clientsRepo.findClientById(clientId);
+    if (!client) {
+      throw new Error("Client not found");
+    }
+    if (client.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    return this.mapToDetail(client);
+  }
+  /**
+   * Create a new OAuth client
+   * @override
+   */
+  async create(ownerUserId, input) {
+    const result = await this.clientsRepo.createClient(ownerUserId, input);
+    return {
+      client_id: result.client.client_id,
+      client_secret: result.clientSecret,
+      confidential: result.client.confidential,
+      client_name: result.client.client_name,
+      client_uri: result.client.client_uri,
+      redirect_uris: result.client.redirect_uris,
+      created_at: result.client.created_at
+    };
+  }
+  /**
+   * Update an existing OAuth client
+   * @override
+   */
+  async update(ownerUserId, clientId, input) {
+    const existing = await this.clientsRepo.findClientById(clientId);
+    if (!existing) {
+      throw new Error("Client not found");
+    }
+    if (existing.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    return this.clientsRepo.updateClient(ownerUserId, clientId, input);
+  }
+  /**
+   * Rotate the client secret
+   * @override
+   */
+  async rotateSecret(ownerUserId, clientId) {
+    const existing = await this.clientsRepo.findClientById(clientId);
+    if (!existing) {
+      throw new Error("Client not found");
+    }
+    if (existing.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    if (!existing.confidential) {
+      throw new Error("Public clients do not have a client_secret");
+    }
+    const result = await this.clientsRepo.rotateClientSecret(
+      ownerUserId,
+      clientId
+    );
+    return {
+      client_id: clientId,
+      client_secret: result.clientSecret
+    };
+  }
+  /**
+   * Delete an OAuth client
+   * @override
+   */
+  async delete(ownerUserId, clientId) {
+    const existing = await this.clientsRepo.findClientById(clientId);
+    if (!existing) {
+      throw new Error("Client not found");
+    }
+    if (existing.owner_user_id !== ownerUserId) {
+      throw new Error("Access denied");
+    }
+    await this.clientsRepo.deleteClient(ownerUserId, clientId);
+  }
+  mapToDetail(row) {
+    return {
+      client_id: row.client_id,
+      client_name: row.client_name,
+      client_uri: row.client_uri,
+      logo_uri: row.logo_uri,
+      redirect_uris: row.redirect_uris,
+      grant_types: row.grant_types,
+      scopes: row.scopes,
+      confidential: row.confidential,
+      created_at: row.created_at,
+      updated_at: row.updated_at
+    };
+  }
+};
+
+// src/server/services/OAuthTokenService.ts
+import { createHash as createHash2, randomBytes } from "crypto";
+
 // src/core/schema/OAuthAuthorizeSchema.ts
 import { z } from "zod";
 function isOAuthRedirectUri(value) {
@@ -138,7 +252,7 @@ var OAuthRefreshTokenSchema = z2.object({
 });
 var OAuthTokenResponseSchema = z2.object({
   access_token: z2.string(),
-  token_type: z2.literal("Bearer"),
+  token_type: z2.string(),
   expires_in: z2.number(),
   refresh_token: z2.string().optional(),
   scope: z2.string().optional()
@@ -234,6 +348,17 @@ function randomOAuthState() {
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
 
+// src/server/utils/OAuthWrapperError.ts
+import { ExecutorError } from "@qlover/fe-corekit";
+var OAuthWrapperError = class extends ExecutorError {
+  constructor(id, status, cause) {
+    super(id, cause);
+    this.status = status;
+  }
+  status;
+  name = "OAuthWrapperError";
+};
+
 // src/server/utils/pkce.ts
 import { createHash, timingSafeEqual } from "crypto";
 var PKCE_VERIFIER_MIN = 43;
@@ -255,391 +380,17 @@ function isValidCodeChallenge(challenge) {
 function computeS256CodeChallenge(verifier) {
   return createHash("sha256").update(verifier).digest("base64url");
 }
-function verifyPkceS256(verifier, challenge) {
-  if (!isValidCodeVerifier(verifier) || !isValidCodeChallenge(challenge)) {
-    return false;
-  }
-  const computed = computeS256CodeChallenge(verifier);
-  try {
-    return timingSafeEqual(Buffer.from(computed), Buffer.from(challenge));
-  } catch {
-    return false;
-  }
-}
-
-// src/server/utils/authorizeUtil.ts
-function validatePkceParams(parsed, confidential) {
-  const hasChallenge = Boolean(parsed.code_challenge?.trim());
-  const hasMethod = Boolean(parsed.code_challenge_method);
-  if (!confidential) {
-    if (!hasChallenge || parsed.code_challenge_method !== "S256") {
-      return {
-        errorKey: OAuthRfcCodes.INVALID_REQUEST,
-        message: "Public clients must send code_challenge and code_challenge_method=S256."
-      };
-    }
-    if (!isValidCodeChallenge(parsed.code_challenge)) {
-      return {
-        errorKey: OAuthRfcCodes.INVALID_REQUEST,
-        message: "Invalid code_challenge."
-      };
-    }
-    return null;
-  }
-  if (hasChallenge !== hasMethod) {
-    return {
-      errorKey: OAuthRfcCodes.INVALID_REQUEST,
-      message: "code_challenge and code_challenge_method must be sent together."
-    };
-  }
-  if (hasChallenge) {
-    if (parsed.code_challenge_method !== "S256") {
-      return {
-        errorKey: OAuthRfcCodes.INVALID_REQUEST,
-        message: "Only code_challenge_method=S256 is supported."
-      };
-    }
-    if (!isValidCodeChallenge(parsed.code_challenge)) {
-      return {
-        errorKey: OAuthRfcCodes.INVALID_REQUEST,
-        message: "Invalid code_challenge."
-      };
-    }
-  }
-  return null;
-}
-function normalizeQuery(raw) {
-  const result = {};
-  for (const [key, value] of Object.entries(raw)) {
-    if (Array.isArray(value)) {
-      result[key] = value[0];
-    } else {
-      result[key] = value;
-    }
-  }
-  if (!result.response_type) {
-    result.response_type = "code";
-  }
-  return result;
-}
-function isRedirectUriAllowed(redirectUri, client) {
-  return client.redirect_uris.includes(redirectUri);
-}
-
-// src/server/utils/oauthRedirectUtils.ts
-function buildOAuthRedirectUrl(redirectUri, params) {
-  const url = new URL(redirectUri);
-  for (const [key, value] of Object.entries(params)) {
-    if (value != null && value !== "") {
-      url.searchParams.set(key, value);
-    }
-  }
-  return url.toString();
-}
-function parseScopeList(scope) {
-  if (!scope?.trim()) {
-    return ["openid", "profile", "email"];
-  }
-  return scope.trim().split(/\s+/).filter(Boolean);
-}
-
-// src/server/services/OAuthAbstractProvider.ts
-import { ExecutorError } from "@qlover/fe-corekit";
-import { randomBytes } from "crypto";
-var OAuthAbstractProvider = class {
-  authCodeTTLMs = 5 * 60 * 1e3;
-  isQuery(query) {
-    return OAuthAuthorizeQuerySchema.safeParse(query).success;
-  }
-  isValidateConsent(value) {
-    return OAuthConsentBodySchema.safeParse(value).success;
-  }
-  generageSessionPayload(userInfo) {
-    return {
-      userId: String(userInfo.id),
-      email: userInfo.email,
-      name: userInfo.name ?? userInfo.email,
-      providerSessionToken: userInfo.sessionToken
-    };
-  }
-  /**
-   * @override
-   */
-  async logout(userId) {
-    const oauthRepo = this.getOAuthRepo();
-    await oauthRepo.revokeRefreshTokensByUserId(userId);
-    await oauthRepo.upsertUserCredentials(userId, {
-      provider_refresh_token: null,
-      provider_session_token: null
-    });
-    await this.clearSession();
-  }
-  /**
-   * @override
-   */
-  async resolveAuthorizePage(rawQuery) {
-    const query = normalizeQuery(rawQuery);
-    if (!this.isQuery(query)) {
-      return {
-        ok: false,
-        error: {
-          errorKey: OAuthRfcCodes.INVALID_REQUEST,
-          message: "Missing or invalid authorization request parameters."
-        }
-      };
-    }
-    if (query.response_type !== "code") {
-      return {
-        ok: false,
-        error: {
-          errorKey: OAuthRfcCodes.UNSUPPORTED_RESPONSE_TYPE,
-          message: "Only response_type=code is supported."
-        }
-      };
-    }
-    const oauthRepo = this.getOAuthRepo();
-    const client = await oauthRepo.findClientById(query.client_id);
-    if (!client) {
-      return {
-        ok: false,
-        error: {
-          errorKey: OAuthRfcCodes.UNAUTHORIZED_CLIENT,
-          message: "Unknown client_id."
-        }
-      };
-    }
-    if (!isRedirectUriAllowed(query.redirect_uri, client)) {
-      return {
-        ok: false,
-        error: {
-          errorKey: OAuthRfcCodes.UNAUTHORIZED_CLIENT,
-          message: "redirect_uri is not registered for this client."
-        }
-      };
-    }
-    const requestedScopes = parseScopeList(query.scope);
-    const invalidScope = requestedScopes.find(
-      (scope) => !client.scopes.includes(scope)
-    );
-    if (invalidScope) {
-      return {
-        ok: false,
-        error: {
-          errorKey: OAuthRfcCodes.INVALID_SCOPE,
-          message: `Scope "${invalidScope}" is not allowed for this client.`
-        }
-      };
-    }
-    const pkceError = validatePkceParams(query, client.confidential);
-    if (pkceError) {
-      return { ok: false, error: pkceError };
-    }
-    return {
-      ok: true,
-      data: {
-        clientId: client.client_id,
-        clientName: client.client_name,
-        clientUri: client.client_uri ?? null,
-        logoUri: client.logo_uri ?? null,
-        redirectUri: query.redirect_uri,
-        scopes: requestedScopes,
-        state: query.state,
-        responseType: "code",
-        codeChallenge: query.code_challenge,
-        codeChallengeMethod: query.code_challenge_method,
-        confidential: client.confidential
-      }
-    };
-  }
-  /**
-   * @override
-   */
-  async processConsent(requestBody) {
-    if (!this.isValidateConsent(requestBody)) {
-      throw new ExecutorError(
-        OAuthRfcCodes.INVALID_REQUEST,
-        "Invalid consent request body"
-      );
-    }
-    const session = await this.getSession();
-    if (!session) {
-      throw new ExecutorError(
-        OAuthRfcCodes.ACCESS_DENIED,
-        "User session expired. Please sign in again."
-      );
-    }
-    const pageResult = await this.resolveAuthorizePage({
-      response_type: "code",
-      client_id: requestBody.client_id,
-      redirect_uri: requestBody.redirect_uri,
-      scope: requestBody.scope,
-      state: requestBody.state,
-      code_challenge: requestBody.code_challenge,
-      code_challenge_method: requestBody.code_challenge_method
-    });
-    if (!pageResult.ok) {
-      throw new ExecutorError(
-        pageResult.error.errorKey,
-        pageResult.error.message
-      );
-    }
-    const { data } = pageResult;
-    if (requestBody.action === "deny") {
-      return {
-        redirectUrl: buildOAuthRedirectUrl(data.redirectUri, {
-          error: OAuthRfcCodes.ACCESS_DENIED,
-          error_description: "The resource owner denied the request",
-          state: data.state
-        })
-      };
-    }
-    const code = randomBytes(32).toString("base64url");
-    const expiresAt = new Date(Date.now() + this.authCodeTTLMs).toISOString();
-    const oauthRepo = this.getOAuthRepo();
-    await oauthRepo.create({
-      code,
-      client_id: data.clientId,
-      user_id: session.userId,
-      redirect_uri: data.redirectUri,
-      scope: data.scopes.join(" ") || null,
-      code_challenge: data.codeChallenge ?? null,
-      code_challenge_method: data.codeChallengeMethod ?? null,
-      expires_at: expiresAt
-    });
-    void requestBody.trust;
-    return {
-      redirectUrl: buildOAuthRedirectUrl(data.redirectUri, {
-        code,
-        state: data.state
-      })
-    };
-  }
-};
-
-// src/server/services/OAuthClientsService.ts
-var OAuthClientsService = class {
-  constructor(clientsRepo) {
-    this.clientsRepo = clientsRepo;
-  }
-  clientsRepo;
-  /**
-   * List all OAuth clients owned by a user
-   * @override
-   */
-  async listForOwner(ownerUserId) {
-    return this.clientsRepo.listClientByOwner(ownerUserId);
-  }
-  /**
-   * Get detailed information about a specific OAuth client
-   * @override
-   */
-  async getByClientId(ownerUserId, clientId) {
-    const client = await this.clientsRepo.findClientById(clientId);
-    if (!client) {
-      throw new Error("Client not found");
-    }
-    if (client.owner_user_id !== ownerUserId) {
-      throw new Error("Access denied");
-    }
-    return this.mapToDetail(client);
-  }
-  /**
-   * Create a new OAuth client
-   * @override
-   */
-  async create(ownerUserId, input) {
-    const result = await this.clientsRepo.createClient(ownerUserId, input);
-    return {
-      client_id: result.client.client_id,
-      client_secret: result.clientSecret,
-      confidential: result.client.confidential,
-      client_name: result.client.client_name,
-      client_uri: result.client.client_uri,
-      redirect_uris: result.client.redirect_uris,
-      created_at: result.client.created_at
-    };
-  }
-  /**
-   * Update an existing OAuth client
-   * @override
-   */
-  async update(ownerUserId, clientId, input) {
-    const existing = await this.clientsRepo.findClientById(clientId);
-    if (!existing) {
-      throw new Error("Client not found");
-    }
-    if (existing.owner_user_id !== ownerUserId) {
-      throw new Error("Access denied");
-    }
-    return this.clientsRepo.updateClient(ownerUserId, clientId, input);
-  }
-  /**
-   * Rotate the client secret
-   * @override
-   */
-  async rotateSecret(ownerUserId, clientId) {
-    const existing = await this.clientsRepo.findClientById(clientId);
-    if (!existing) {
-      throw new Error("Client not found");
-    }
-    if (existing.owner_user_id !== ownerUserId) {
-      throw new Error("Access denied");
-    }
-    if (!existing.confidential) {
-      throw new Error("Public clients do not have a client_secret");
-    }
-    const result = await this.clientsRepo.rotateClientSecret(
-      ownerUserId,
-      clientId
-    );
-    return {
-      client_id: clientId,
-      client_secret: result.clientSecret
-    };
-  }
-  /**
-   * Delete an OAuth client
-   * @override
-   */
-  async delete(ownerUserId, clientId) {
-    const existing = await this.clientsRepo.findClientById(clientId);
-    if (!existing) {
-      throw new Error("Client not found");
-    }
-    if (existing.owner_user_id !== ownerUserId) {
-      throw new Error("Access denied");
-    }
-    await this.clientsRepo.deleteClient(ownerUserId, clientId);
-  }
-  mapToDetail(row) {
-    return {
-      client_id: row.client_id,
-      client_name: row.client_name,
-      client_uri: row.client_uri,
-      logo_uri: row.logo_uri,
-      redirect_uris: row.redirect_uris,
-      grant_types: row.grant_types,
-      scopes: row.scopes,
-      confidential: row.confidential,
-      created_at: row.created_at,
-      updated_at: row.updated_at
-    };
+function verifyPkceS256(verifier, challenge) {
+  if (!isValidCodeVerifier(verifier) || !isValidCodeChallenge(challenge)) {
+    return false;
   }
-};
-
-// src/server/services/OAuthTokenService.ts
-import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
-
-// src/server/utils/OAuthWrapperError.ts
-import { ExecutorError as ExecutorError2 } from "@qlover/fe-corekit";
-var OAuthWrapperError = class extends ExecutorError2 {
-  constructor(id, status, cause) {
-    super(id, cause);
-    this.status = status;
+  const computed = computeS256CodeChallenge(verifier);
+  try {
+    return timingSafeEqual(Buffer.from(computed), Buffer.from(challenge));
+  } catch {
+    return false;
   }
-  status;
-  name = "OAuthWrapperError";
-};
+}
 
 // src/server/services/OAuthTokenService.ts
 function hashOpaqueToken(token) {
@@ -795,7 +546,9 @@ var OAuthTokenService = class _OAuthTokenService {
     }
     try {
       const access = await this.exchangeProviderAccessToken({
-        token: sessionToken
+        providerRefreshToken: sessionToken,
+        // TODO:
+        userId: ""
       });
       if (access.refresh_token) {
         await this.oauthRepo.upsertUserCredentials(userId, {
@@ -805,6 +558,7 @@ var OAuthTokenService = class _OAuthTokenService {
         });
       }
       return {
+        ...access,
         access_token: access.access_token,
         expires_in: access.expires_in
       };
@@ -817,7 +571,7 @@ var OAuthTokenService = class _OAuthTokenService {
     }
   }
   async issueMiddlewareRefreshToken(clientId, userId) {
-    const plain = randomBytes2(32).toString("base64url");
+    const plain = randomBytes(32).toString("base64url");
     const expiresAt = new Date(
       Date.now() + _OAuthTokenService.REFRESH_TOKEN_TTL_MS
     ).toISOString();
@@ -865,9 +619,88 @@ var OAuthTokenService = class _OAuthTokenService {
 };
 
 // src/server/services/OAuthWrapperService.ts
-var OAuthWrapperService = class extends OAuthAbstractProvider {
+import { ExecutorError as ExecutorError2 } from "@qlover/fe-corekit";
+
+// src/server/utils/authorizeUtil.ts
+function validatePkceParams(parsed, confidential) {
+  const hasChallenge = Boolean(parsed.code_challenge?.trim());
+  const hasMethod = Boolean(parsed.code_challenge_method);
+  if (!confidential) {
+    if (!hasChallenge || parsed.code_challenge_method !== "S256") {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Public clients must send code_challenge and code_challenge_method=S256."
+      };
+    }
+    if (!isValidCodeChallenge(parsed.code_challenge)) {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Invalid code_challenge."
+      };
+    }
+    return null;
+  }
+  if (hasChallenge !== hasMethod) {
+    return {
+      errorKey: OAuthRfcCodes.INVALID_REQUEST,
+      message: "code_challenge and code_challenge_method must be sent together."
+    };
+  }
+  if (hasChallenge) {
+    if (parsed.code_challenge_method !== "S256") {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Only code_challenge_method=S256 is supported."
+      };
+    }
+    if (!isValidCodeChallenge(parsed.code_challenge)) {
+      return {
+        errorKey: OAuthRfcCodes.INVALID_REQUEST,
+        message: "Invalid code_challenge."
+      };
+    }
+  }
+  return null;
+}
+function normalizeQuery(raw) {
+  const result = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (Array.isArray(value)) {
+      result[key] = value[0];
+    } else {
+      result[key] = value;
+    }
+  }
+  if (!result.response_type) {
+    result.response_type = "code";
+  }
+  return result;
+}
+function isRedirectUriAllowed(redirectUri, client) {
+  return client.redirect_uris.includes(redirectUri);
+}
+
+// src/server/utils/oauthRedirectUtils.ts
+function buildOAuthRedirectUrl(redirectUri, params) {
+  const url = new URL(redirectUri);
+  for (const [key, value] of Object.entries(params)) {
+    if (value != null && value !== "") {
+      url.searchParams.set(key, value);
+    }
+  }
+  return url.toString();
+}
+function parseScopeList(scope) {
+  if (!scope?.trim()) {
+    return ["openid", "profile", "email"];
+  }
+  return scope.trim().split(/\s+/).filter(Boolean);
+}
+
+// src/server/services/OAuthWrapperService.ts
+import { randomBytes as randomBytes2 } from "crypto";
+var OAuthWrapperService = class {
   constructor(oauthSession, tokenEncryption, oauthRepo) {
-    super();
     this.oauthSession = oauthSession;
     this.oauthRepo = oauthRepo;
     this.tokenService = new OAuthTokenService(
@@ -878,26 +711,29 @@ var OAuthWrapperService = class extends OAuthAbstractProvider {
   }
   oauthSession;
   oauthRepo;
+  authCodeTTLMs = 5 * 60 * 1e3;
   tokenService;
   /**
    * @override
    */
   async login(params) {
-    const credentials = await this.providerLogin(params);
-    const sessionToken = credentials.token;
+    const session = await this.providerLogin(params);
+    const sessionToken = session.providerRefreshToken;
     if (!sessionToken) {
       throw new Error("User provider login did not return a session token");
     }
     const userInfo = await this.providerGetUserInfo(sessionToken);
-    const sessionPayload = this.generageSessionPayload({
-      email: params.email,
-      ...userInfo,
-      sessionToken
-    });
+    const sessionPayload = {
+      ...session,
+      user: {
+        ...session.user,
+        ...userInfo
+      }
+    };
     this.oauthSession.setSession(sessionPayload);
     const oauthrepo = this.getOAuthRepo();
     await oauthrepo.upsertUserCredentials(sessionPayload.userId, {
-      provider_session_token: sessionPayload.providerSessionToken
+      provider_session_token: sessionPayload.providerRefreshToken
     });
     return sessionPayload;
   }
@@ -945,26 +781,170 @@ var OAuthWrapperService = class extends OAuthAbstractProvider {
   async getUserInfoWithAccessToken(accessToken) {
     try {
       const profile = await this.providerGetUserInfoByAccessToken(accessToken);
-      return this.toUserInfoResponse(profile);
+      return this.toUser(profile);
     } catch {
       throw new OAuthWrapperError(OAuthRfcCodes.INVALID_TOKEN, 401);
     }
   }
-  toUserInfoResponse(profile) {
-    const sub = String(profile.id);
-    if (!sub || sub === "NaN") {
-      throw new OAuthWrapperError(OAuthRfcCodes.INVALID_TOKEN, 401);
+  toUser(profile) {
+    return profile;
+  }
+  isQuery(query) {
+    return OAuthAuthorizeQuerySchema.safeParse(query).success;
+  }
+  isValidateConsent(value) {
+    return OAuthConsentBodySchema.safeParse(value).success;
+  }
+  /**
+   * @override
+   */
+  async logout(userId) {
+    const oauthRepo = this.getOAuthRepo();
+    await oauthRepo.revokeRefreshTokensByUserId(userId);
+    await oauthRepo.upsertUserCredentials(userId, {
+      provider_refresh_token: null,
+      provider_session_token: null
+    });
+    await this.clearSession();
+  }
+  /**
+   * @override
+   */
+  async resolveAuthorizePage(rawQuery) {
+    const query = normalizeQuery(rawQuery);
+    if (!this.isQuery(query)) {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.INVALID_REQUEST,
+          message: "Missing or invalid authorization request parameters."
+        }
+      };
     }
-    const email = profile.email?.trim();
-    if (!email) {
-      throw new OAuthWrapperError(OAuthRfcCodes.INVALID_TOKEN, 401);
+    if (query.response_type !== "code") {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.UNSUPPORTED_RESPONSE_TYPE,
+          message: "Only response_type=code is supported."
+        }
+      };
+    }
+    const oauthRepo = this.getOAuthRepo();
+    const client = await oauthRepo.findClientById(query.client_id);
+    if (!client) {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.UNAUTHORIZED_CLIENT,
+          message: "Unknown client_id."
+        }
+      };
+    }
+    if (!isRedirectUriAllowed(query.redirect_uri, client)) {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.UNAUTHORIZED_CLIENT,
+          message: "redirect_uri is not registered for this client."
+        }
+      };
+    }
+    const requestedScopes = parseScopeList(query.scope);
+    const invalidScope = requestedScopes.find(
+      (scope) => !client.scopes.includes(scope)
+    );
+    if (invalidScope) {
+      return {
+        ok: false,
+        error: {
+          errorKey: OAuthRfcCodes.INVALID_SCOPE,
+          message: `Scope "${invalidScope}" is not allowed for this client.`
+        }
+      };
+    }
+    const pkceError = validatePkceParams(query, client.confidential);
+    if (pkceError) {
+      return { ok: false, error: pkceError };
+    }
+    return {
+      ok: true,
+      data: {
+        clientId: client.client_id,
+        clientName: client.client_name,
+        clientUri: client.client_uri ?? null,
+        logoUri: client.logo_uri ?? null,
+        redirectUri: query.redirect_uri,
+        scopes: requestedScopes,
+        state: query.state,
+        responseType: "code",
+        codeChallenge: query.code_challenge,
+        codeChallengeMethod: query.code_challenge_method,
+        confidential: client.confidential
+      }
+    };
+  }
+  /**
+   * @override
+   */
+  async processConsent(requestBody) {
+    if (!this.isValidateConsent(requestBody)) {
+      throw new ExecutorError2(
+        OAuthRfcCodes.INVALID_REQUEST,
+        "Invalid consent request body"
+      );
+    }
+    const session = await this.getSession();
+    if (!session) {
+      throw new ExecutorError2(
+        OAuthRfcCodes.ACCESS_DENIED,
+        "User session expired. Please sign in again."
+      );
+    }
+    const pageResult = await this.resolveAuthorizePage({
+      response_type: "code",
+      client_id: requestBody.client_id,
+      redirect_uri: requestBody.redirect_uri,
+      scope: requestBody.scope,
+      state: requestBody.state,
+      code_challenge: requestBody.code_challenge,
+      code_challenge_method: requestBody.code_challenge_method
+    });
+    if (!pageResult.ok) {
+      throw new ExecutorError2(
+        pageResult.error.errorKey,
+        pageResult.error.message
+      );
+    }
+    const { data } = pageResult;
+    if (requestBody.action === "deny") {
+      return {
+        redirectUrl: buildOAuthRedirectUrl(data.redirectUri, {
+          error: OAuthRfcCodes.ACCESS_DENIED,
+          error_description: "The resource owner denied the request",
+          state: data.state
+        })
+      };
     }
-    const name = profile.name?.trim() || email;
+    const code = randomBytes2(32).toString("base64url");
+    const expiresAt = new Date(Date.now() + this.authCodeTTLMs).toISOString();
+    const oauthRepo = this.getOAuthRepo();
+    await oauthRepo.create({
+      code,
+      client_id: data.clientId,
+      user_id: session.userId,
+      redirect_uri: data.redirectUri,
+      scope: data.scopes.join(" ") || null,
+      code_challenge: data.codeChallenge ?? null,
+      code_challenge_method: data.codeChallengeMethod ?? null,
+      expires_at: expiresAt
+    });
+    void requestBody.trust;
     return {
-      sub,
-      email,
-      name,
-      ...profile.roles?.length ? { roles: profile.roles } : {}
+      redirectUrl: buildOAuthRedirectUrl(data.redirectUri, {
+        code,
+        state: data.state
+      })
     };
   }
 };
@@ -994,7 +974,6 @@ async function verifyClientSecret(secret, storedHash) {
   return timingSafeEqual2(derived, expected);
 }
 export {
-  OAuthAbstractProvider,
   OAuthAuthorizationCodeRowSchema,
   OAuthAuthorizeQuerySchema,
   OAuthClientCreateResponseSchema,