@riao/authn-oauth2-client-cred 1.0.0

package/CHANGELOG.md

@@ -0,0 +1 @@
+# auth-template - Changelog

package/LICENSE.md

@@ -0,0 +1,20 @@
+Copyright (c) 2022 auth-template and others
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,308 @@
+# @riao/authn-oauth2-client-cred
+
+OAuth2 Client Credentials (server-to-server) authentication driver for the RIAO Identity and Access Management framework.
+
+## Overview
+
+This driver implements the **OAuth2 Client Credentials flow**, enabling secure server-to-server API authentication. Each client application receives credentials (client_id and client_secret) that it can exchange for short-lived JWT access tokens.
+
+**Key Features:**
+- Client credential management with bcrypt hashing
+- JWT token generation with configurable expiration
+- Token signature verification for security
+- Multiple credentials per principal (user/service)
+- Credential revocation support
+- Principal validation to prevent orphaned credentials
+- Client ID format validation
+- Usage tracking (last exchange time, failed attempt counter)
+- Cryptographically secure secret generation utility
+- Database persistence
+- TypeScript support with full type safety
+
+## Installation
+
+```bash
+npm install @riao/authn-oauth2-client-cred @riao/iam @riao/dbal
+npm install --save-dev @riao/cli
+```
+
+## Quick Start
+
+### 1. Database Setup
+
+Create a migration to import the OAuth2 tables:
+
+```bash
+npx riao migration:create import-oauth2-client-cred-tables
+```
+
+In your migration file:
+
+```typescript
+import { OAuth2ClientCredentialsMigrations } from '@riao/authn-oauth2-client-cred';
+
+export default OAuth2ClientCredentialsMigrations;
+```
+
+Run migrations:
+
+```bash
+npx riao migration:run
+```
+
+### 2. Initialize Authentication
+
+```typescript
+import { OAuth2ClientCredentialsAuthentication } from '@riao/authn-oauth2-client-cred';
+import { Principal } from '@riao/iam/auth';
+
+// Define your principal/user interface
+interface User extends Principal {
+  login: string;
+}
+
+// Create concrete authentication instance
+class UserOAuth2Authentication extends OAuth2ClientCredentialsAuthentication<User> {}
+
+const jwtSecret = process.env.JWT_SECRET;
+if (!jwtSecret || jwtSecret.length < 32) {
+  throw new Error('JWT_SECRET must contain at least 32 characters');
+}
+
+const oauth2 = new UserOAuth2Authentication({
+  db: database,
+  jwtSecret,
+  tokenExpiresIn: 3600, // 1 hour
+});
+
+// Access principals via the inherited principalRepo property
+const userId = 'user-123';
+const principal = await oauth2.principalRepo.findOne({
+  where: { id: userId },
+});
+```
+
+### 3. Create Client Credentials
+
+```typescript
+// Generate a cryptographically secure secret
+import { generateSecret } from '@riao/authn-oauth2-client-cred';
+
+const clientSecret = generateSecret(32); // 32-character random string
+
+// Create credentials for a principal
+await oauth2.createClientCredential({
+  principalId: userId,
+  clientId: 'my-app-client',
+  clientSecret,
+  description: 'My Application',
+});
+```
+
+**Client ID Validation:**
+- Must be 3-255 characters long
+- Can only contain: alphanumeric, hyphens (`-`), underscores (`_`), dots (`.`), colons (`:`)
+- Examples: `my-app`, `service_prod.v2`, `client:region:001`
+
+**Principal Validation:**
+- The principal ID must exist and be active
+- If the principal doesn't exist, credential creation fails with a clear error
+
+**Client Secret Validation:**
+- Client secrets must be at least 32 characters long. Use a cryptographically secure random value such as one returned by `generateSecret()`.
+
+**Throws:** Error if:
+- Client ID format is invalid
+- Client secret is shorter than 32 characters
+- Client ID is already in use (globally unique)
+- Principal doesn't exist or is inactive
+
+### 4. Exchange Credentials for Token
+
+Server-to-server authentication flow:
+
+```typescript
+// Exchange client credentials for access token
+const tokenResponse = await oauth2.exchangeCredentials(
+  'my-app-client',
+  'super-secret-password'
+);
+
+console.log(tokenResponse);
+// {
+//   access_token: 'eyJhbGc...',
+//   token_type: 'Bearer',
+//   expires_in: 3600
+// }
+```
+
+### 5. Verify Access Tokens
+
+On the API side, verify received tokens:
+
+```typescript
+const payload = await oauth2.verifyAccessToken(accessToken);
+
+if (payload) {
+  console.log('Token is valid');
+  console.log('Client ID:', payload.client_id);
+  console.log('Principal ID:', payload.principal_id);
+} else {
+  console.log('Token is invalid or expired');
+}
+```
+
+## API Reference
+
+### `generateSecret(length?)`
+
+Generate a cryptographically secure random secret for client credentials.
+
+**Parameters:**
+- `length` (number, optional) - Length of secret in characters (default: 32)
+
+**Returns:** Alphanumeric random string of specified length
+
+**Example:**
+```typescript
+import { generateSecret } from '@riao/authn-oauth2-client-cred';
+
+const secret = generateSecret(32);
+// 'aBcDeFgHiJkLmNoPqRsTuVwXyZ123456'
+```
+
+### `exchangeCredentials(clientId, clientSecret)`
+
+Exchange client credentials for a JWT access token.
+
+**Parameters:**
+- `clientId` (string) - Unique client identifier
+- `clientSecret` (string) - Client secret (will be compared against bcrypt hash)
+
+**Returns:** Object with `access_token`, `token_type: 'Bearer'`, and `expires_in` (seconds)
+
+**Tracking:**
+- Updates `last_exchange_timestamp` on successful exchange
+- Increments `failed_exchange_count` on failed attempts
+- Resets `failed_exchange_count` to 0 on successful exchange
+
+**Throws:** Error if:
+- Credential not found (`"Invalid credentials"`)
+- Credential is revoked (`"Credential has been revoked"`)
+- Secret doesn't match (`"Invalid credentials"`)
+- Principal not found (rare edge case)
+
+### `verifyAccessToken(token)`
+
+Verify and decode a JWT access token.
+
+**Parameters:**
+- `token` (string) - JWT access token
+
+**Returns:** Token payload with `client_id`, `principal_id`, `iat`, `exp` if valid; null if invalid/expired
+
+### `createClientCredential(options)`
+
+Create new client credentials for a principal.
+
+**Parameters (`options`):**
+- `principalId` - The principal (user/service) ID (must exist and be active)
+- `clientId` - Unique identifier (3-255 chars, alphanumeric + `-`, `_`, `.`, `:`)
+- `clientSecret` - Secret (will be bcrypt hashed, never stored in plain text)
+- `description` - Optional description for the credential
+
+**Returns:** Promise that resolves when credential is created
+
+**Validation:**
+- Principal must exist and be active
+- Client ID must follow format rules
+- Client ID must be globally unique (cannot reuse revoked client IDs)
+
+**Throws:** Error if:
+- Principal doesn't exist or is inactive
+- Client ID format is invalid
+- Client ID is already in use
+
+### `revokeClientCredential(credentialId)`
+
+Revoke a specific credential, preventing future token generation.
+
+### `revokeAllCredentials(principalId)`
+
+Revoke all active credentials for a principal.
+
+### `listCredentials(principalId)`
+
+List all active credentials for a principal (secrets are not included).
+
+## Usage Tracking & Monitoring
+
+Credentials automatically track exchange activity for security monitoring:
+
+### Fields
+
+- **`last_exchange_timestamp`** - When the credential was last used successfully
+- **`failed_exchange_count`** - Number of failed authentication attempts since last success
+
+### Example: Detect Compromised Credentials
+
+```typescript
+const credentials = await oauth2.listCredentials(principalId);
+
+for (const cred of credentials) {
+  // Alert if there are many failed attempts
+  if (cred.failed_exchange_count > 5) {
+    console.warn(`Suspicious activity on ${cred.client_id}: ${cred.failed_exchange_count} failed attempts`);
+    // Consider revoking the credential
+    await oauth2.revokeClientCredential(cred.id);
+  }
+
+  // Alert if not used recently
+  if (cred.last_exchange_timestamp) {
+    const daysSinceUse = (Date.now() - cred.last_exchange_timestamp.getTime()) / (1000 * 60 * 60 * 24);
+    if (daysSinceUse > 30) {
+      console.info(`Credential ${cred.client_id} unused for ${Math.floor(daysSinceUse)} days`);
+    }
+  }
+}
+```
+
+## Security Considerations
+
+### Production Checklist
+
+- ✅ Store `jwtSecret` in environment variables, never in code
+- ✅ Use strong, random JWT secrets (32+ characters)
+- ✅ Set appropriate `tokenExpiresIn` (recommend 1 hour for short-lived tokens)
+- ✅ Keep client secrets confidential—display only when created
+- ✅ Implement credential rotation policies
+- ✅ Monitor and audit credential usage
+- ✅ Revoke credentials when applications are decommissioned
+- ✅ Use HTTPS for all token exchanges
+
+### Token Expiration
+
+- Default: 3600 seconds (1 hour)
+- Short-lived tokens (< 1 hour) recommended
+- Clients should request new tokens before expiration
+- Expired tokens cannot be refreshed—must exchange credentials again
+
+### Secret Hashing
+
+- Client secrets are hashed using bcrypt before storage
+- Secrets are never returned from the API
+- Only the principal who created the credential knows the secret
+
+## Examples
+
+See [examples/](examples/) for complete, runnable examples:
+
+**CLI Example** (`server-example.ts`)
+- Demonstrates all OAuth2 operations
+- Shows credential lifecycle (create, exchange, verify, revoke)
+- Useful for understanding the authentication flow
+- Run: `npm start`
+
+## Contributing & Development
+
+See [CONTRIBUTING.md](docs/contributing/contributing.md) for information on development.

package/client-credential.d.ts

@@ -0,0 +1,32 @@
+export interface ClientCredential {
+    id: string;
+    principal_id: string;
+    client_id: string;
+    client_secret_hash: string;
+    description?: string | null;
+    create_timestamp: Date;
+    deactivate_timestamp?: Date | null;
+    last_exchange_timestamp?: Date | null;
+    failed_exchange_count: number;
+    locked_until?: Date | null;
+}
+/**
+ * Client ID validation constraints
+ */
+export declare const CLIENT_ID_VALIDATION: {
+    readonly MIN_LENGTH: 3;
+    readonly MAX_LENGTH: 255;
+    readonly PATTERN: RegExp;
+};
+/**
+ * Client secret validation constraints
+ */
+export declare const CLIENT_SECRET_VALIDATION: {
+    readonly MIN_LENGTH: 32;
+};
+/**
+ * Generate a cryptographically secure random secret
+ * @param length Length of secret to generate (default: 32)
+ * @returns Random hexadecimal secret of the requested length
+ */
+export declare function generateSecret(length?: number): string;

package/client-credential.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateSecret = exports.CLIENT_SECRET_VALIDATION = exports.CLIENT_ID_VALIDATION = void 0;
+/**
+ * OAuth2 Client Credential Record
+ * Stored in database to track client credentials and their lifecycle
+ */
+const node_crypto_1 = require("node:crypto");
+/**
+ * Client ID validation constraints
+ */
+exports.CLIENT_ID_VALIDATION = {
+    MIN_LENGTH: 3,
+    MAX_LENGTH: 255,
+    // Alphanumeric, hyphens, underscores, dots, colons
+    PATTERN: /^[a-zA-Z0-9._:-]+$/,
+};
+/**
+ * Client secret validation constraints
+ */
+exports.CLIENT_SECRET_VALIDATION = {
+    MIN_LENGTH: 32,
+};
+/**
+ * Generate a cryptographically secure random secret
+ * @param length Length of secret to generate (default: 32)
+ * @returns Random hexadecimal secret of the requested length
+ */
+function generateSecret(length = 32) {
+    const byteLength = Math.ceil(length / 2);
+    return (0, node_crypto_1.randomBytes)(byteLength).toString('hex').slice(0, length);
+}
+exports.generateSecret = generateSecret;
+//# sourceMappingURL=client-credential.js.map

package/client-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credential.js","sourceRoot":"","sources":["../../src/client-credential.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,6CAA0C;AAe1C;;GAEG;AACU,QAAA,oBAAoB,GAAG;IACnC,UAAU,EAAE,CAAC;IACb,UAAU,EAAE,GAAG;IACf,mDAAmD;IACnD,OAAO,EAAE,oBAAoB;CACpB,CAAC;AAEX;;GAEG;AACU,QAAA,wBAAwB,GAAG;IACvC,UAAU,EAAE,EAAE;CACL,CAAC;AAEX;;;;GAIG;AACH,SAAgB,cAAc,CAAC,SAAiB,EAAE;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEzC,OAAO,IAAA,yBAAW,EAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC;AAJD,wCAIC"}

package/index.d.ts

@@ -0,0 +1,3 @@
+export { OAuth2ClientCredentialsAuthentication, OAuth2ClientCredentialsOptions, OAuth2TokenPayload, CreateClientCredentialOptions, } from './oauth2-client-credentials-authentication';
+export { ClientCredential, CLIENT_ID_VALIDATION, CLIENT_SECRET_VALIDATION, generateSecret, } from './client-credential';
+export { OAuth2ClientCredentialsMigrations, } from './oauth2-client-credentials-migrations';

package/index.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2ClientCredentialsMigrations = exports.generateSecret = exports.CLIENT_SECRET_VALIDATION = exports.CLIENT_ID_VALIDATION = exports.OAuth2ClientCredentialsAuthentication = void 0;
+var oauth2_client_credentials_authentication_1 = require("./oauth2-client-credentials-authentication");
+Object.defineProperty(exports, "OAuth2ClientCredentialsAuthentication", { enumerable: true, get: function () { return oauth2_client_credentials_authentication_1.OAuth2ClientCredentialsAuthentication; } });
+var client_credential_1 = require("./client-credential");
+Object.defineProperty(exports, "CLIENT_ID_VALIDATION", { enumerable: true, get: function () { return client_credential_1.CLIENT_ID_VALIDATION; } });
+Object.defineProperty(exports, "CLIENT_SECRET_VALIDATION", { enumerable: true, get: function () { return client_credential_1.CLIENT_SECRET_VALIDATION; } });
+Object.defineProperty(exports, "generateSecret", { enumerable: true, get: function () { return client_credential_1.generateSecret; } });
+var oauth2_client_credentials_migrations_1 = require("./oauth2-client-credentials-migrations");
+Object.defineProperty(exports, "OAuth2ClientCredentialsMigrations", { enumerable: true, get: function () { return oauth2_client_credentials_migrations_1.OAuth2ClientCredentialsMigrations; } });
+//# sourceMappingURL=index.js.map

package/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,uGAKoD;AAJnD,iKAAA,qCAAqC,OAAA;AAKtC,yDAK6B;AAH5B,yHAAA,oBAAoB,OAAA;AACpB,6HAAA,wBAAwB,OAAA;AACxB,mHAAA,cAAc,OAAA;AAEf,+FAEgD;AAD/C,yJAAA,iCAAiC,OAAA"}

package/migrations/001-create-client-credentials-table.d.ts

@@ -0,0 +1,9 @@
+import { Migration } from '@riao/dbal';
+/**
+ * Creates the oauth2_client_credentials table
+ * Stores client credentials for OAuth2 authentication
+ */
+export declare class CreateClientCredentialsTable extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}

package/migrations/001-create-client-credentials-table.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateClientCredentialsTable = void 0;
+const column_pack_1 = require("@riao/dbal/column-pack");
+const dbal_1 = require("@riao/dbal");
+/**
+ * Creates the oauth2_client_credentials table
+ * Stores client credentials for OAuth2 authentication
+ */
+class CreateClientCredentialsTable extends dbal_1.Migration {
+    async up() {
+        await this.ddl.createTable({
+            name: 'oauth2_client_credentials',
+            columns: [
+                column_pack_1.UUIDKeyColumn,
+                {
+                    name: 'principal_id',
+                    type: dbal_1.ColumnType.UUID,
+                    required: true,
+                    fk: {
+                        referencesTable: 'iam_principals',
+                        referencesColumn: 'id',
+                        onDelete: 'CASCADE',
+                    },
+                },
+                {
+                    name: 'client_id',
+                    type: dbal_1.ColumnType.VARCHAR,
+                    length: 255,
+                    required: true,
+                    isUnique: true,
+                },
+                {
+                    name: 'client_secret_hash',
+                    type: dbal_1.ColumnType.VARCHAR,
+                    length: 255,
+                    required: true,
+                },
+                {
+                    name: 'description',
+                    type: dbal_1.ColumnType.VARCHAR,
+                    length: 500,
+                    required: false,
+                },
+                column_pack_1.CreateTimestampColumn,
+                {
+                    name: 'deactivate_timestamp',
+                    type: dbal_1.ColumnType.TIMESTAMP,
+                    required: false,
+                },
+                {
+                    name: 'last_exchange_timestamp',
+                    type: dbal_1.ColumnType.TIMESTAMP,
+                    required: false,
+                },
+                {
+                    name: 'failed_exchange_count',
+                    type: dbal_1.ColumnType.INT,
+                    required: true,
+                    default: 0,
+                },
+                {
+                    name: 'locked_until',
+                    type: dbal_1.ColumnType.TIMESTAMP,
+                    required: false,
+                },
+            ],
+        });
+    }
+    async down() {
+        await this.ddl.dropTable({
+            tables: 'oauth2_client_credentials',
+        });
+    }
+}
+exports.CreateClientCredentialsTable = CreateClientCredentialsTable;
+//# sourceMappingURL=001-create-client-credentials-table.js.map

package/migrations/001-create-client-credentials-table.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"001-create-client-credentials-table.js","sourceRoot":"","sources":["../../../src/migrations/001-create-client-credentials-table.ts"],"names":[],"mappings":";;;AAAA,wDAA8E;AAC9E,qCAAmD;AAEnD;;;GAGG;AACH,MAAa,4BAA6B,SAAQ,gBAAS;IACjD,KAAK,CAAC,EAAE;QAChB,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;YAC1B,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE;gBACR,2BAAa;gBACb;oBACC,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,iBAAU,CAAC,IAAI;oBACrB,QAAQ,EAAE,IAAI;oBACd,EAAE,EAAE;wBACH,eAAe,EAAE,gBAAgB;wBACjC,gBAAgB,EAAE,IAAI;wBACtB,QAAQ,EAAE,SAAS;qBACnB;iBACD;gBACD;oBACC,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,iBAAU,CAAC,OAAO;oBACxB,MAAM,EAAE,GAAG;oBACX,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,IAAI;iBACd;gBACD;oBACC,IAAI,EAAE,oBAAoB;oBAC1B,IAAI,EAAE,iBAAU,CAAC,OAAO;oBACxB,MAAM,EAAE,GAAG;oBACX,QAAQ,EAAE,IAAI;iBACd;gBACD;oBACC,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,iBAAU,CAAC,OAAO;oBACxB,MAAM,EAAE,GAAG;oBACX,QAAQ,EAAE,KAAK;iBACf;gBACD,mCAAqB;gBACrB;oBACC,IAAI,EAAE,sBAAsB;oBAC5B,IAAI,EAAE,iBAAU,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK;iBACf;gBACD;oBACC,IAAI,EAAE,yBAAyB;oBAC/B,IAAI,EAAE,iBAAU,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK;iBACf;gBACD;oBACC,IAAI,EAAE,uBAAuB;oBAC7B,IAAI,EAAE,iBAAU,CAAC,GAAG;oBACpB,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE,CAAC;iBACV;gBACD;oBACC,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,iBAAU,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK;iBACf;aACD;SACD,CAAC,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,IAAI;QAClB,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,MAAM,EAAE,2BAA2B;SACnC,CAAC,CAAC;IACJ,CAAC;CACD;AAlED,oEAkEC"}

package/oauth2-client-credentials-authentication.d.ts

@@ -0,0 +1,130 @@
+/**
+ * OAuth2 Client Credentials Authentication
+ */
+import { Jwt, JwtPayload } from '@riao/crypto';
+import ms from 'ms';
+import { DatabaseRecordId, QueryRepository } from '@riao/dbal';
+import { Hash } from '@riao/crypto';
+import { Principal } from '@riao/iam/auth';
+import { Authentication, AuthenticationOptions } from '@riao/iam/authentication';
+import { ClientCredential } from './client-credential';
+/**
+ * OAuth2 Client Credentials Token Payload
+ */
+export interface OAuth2TokenPayload extends JwtPayload {
+    client_id: string;
+    principal_id: string;
+}
+export interface OAuth2ClientCredentialsOptions extends AuthenticationOptions {
+    hash?: Hash;
+    maxFailedAttempts?: number;
+    lockoutDurationMs?: number;
+    /**
+     * JWT secret for signing tokens
+     * In production: use strong, random 32+ character secret
+     */
+    jwtSecret: string;
+    /**
+     * Token expiration time
+     * Can be ms format string ("1h", "30m", "7d") or numeric seconds
+     * Default: "1h" (1 hour)
+     */
+    tokenExpiresIn?: ms.StringValue | number;
+    /**
+     * JWT algorithm for signing
+     * Default: HS256
+     */
+    jwtAlgorithm?: 'HS256' | 'HS512';
+}
+/**
+ * Options for creating a new client credential
+ */
+export interface CreateClientCredentialOptions {
+    principalId: DatabaseRecordId;
+    clientId: string;
+    clientSecret: string;
+    description?: string;
+}
+/**
+ * OAuth2 Client Credentials Authentication
+ * Implements server-to-server authentication using client_id and client_secret
+ *
+ * Features:
+ * - Client credential management with bcrypt hashing
+ * - JWT token generation with configurable expiration
+ * - Token validation and verification
+ * - Multiple credentials per principal
+ * - Credential revocation support
+ */
+export declare abstract class OAuth2ClientCredentialsAuthentication<TPrincipal extends Principal> extends Authentication<TPrincipal> {
+    credentialsRepo: QueryRepository<ClientCredential>;
+    protected hash: Hash;
+    protected jwt: Jwt<OAuth2TokenPayload>;
+    protected tokenExpiresInMs: ms.StringValue;
+    protected tokenExpiresInSeconds: number;
+    protected readonly maxFailedAttempts: number;
+    protected readonly lockoutDurationMs: number;
+    constructor(options: OAuth2ClientCredentialsOptions);
+    /**
+     * Validate client_id format
+     * @param clientId Client identifier to validate
+     * @throws Error if format is invalid
+     */
+    private validateClientId;
+    /**
+     * Create a new client credential for a principal
+     * @param options.principalId The principal ID
+     * @param options.clientId Unique client identifier
+     * @param options.clientSecret Secret (will be hashed before storage)
+     * @param options.description Optional description
+     * @throws Error if principal doesn't exist,
+     * client_id is invalid, or already in use
+     */
+    createClientCredential(options: CreateClientCredentialOptions): Promise<void>;
+    /**
+     * Exchange client credentials for an access token
+     * Implements OAuth2 Client Credentials grant
+     *
+     * @param clientId Client identifier
+     * @param clientSecret Client secret
+     * @returns Access token and expiration info
+     * @throws Error if credentials are invalid or principal not found
+     */
+    exchangeCredentials(clientId: string, clientSecret: string): Promise<{
+        access_token: string;
+        token_type: 'Bearer';
+        expires_in: number;
+    }>;
+    protected recordExchangeFailure(credential: ClientCredential): Promise<void>;
+    /**
+     * Verify and decode an access token
+     * @param token JWT access token
+     * @returns Token payload if valid, null if invalid or expired
+     */
+    verifyAccessToken(token: string): Promise<OAuth2TokenPayload | null>;
+    /**
+     * Revoke a client credential
+     * Prevents future token generation with this credential
+     * @param credentialId The credential ID to revoke
+     */
+    revokeClientCredential(credentialId: DatabaseRecordId): Promise<void>;
+    /**
+     * Revoke all credentials for a principal
+     * @param principalId The principal ID
+     */
+    revokeAllCredentials(principalId: DatabaseRecordId): Promise<void>;
+    /**
+     * List all active credentials for a principal
+     * @param principalId The principal ID
+     * @returns Array of credentials (without secret hashes)
+     */
+    listCredentials(principalId: DatabaseRecordId): Promise<Omit<ClientCredential, 'client_secret_hash'>[]>;
+    /**
+     * Authenticate using OAuth2 token
+     * (For compatibility with Authentication interface)
+     */
+    authenticate(credentials: Partial<TPrincipal & {
+        client_id: string;
+        client_secret: string;
+    }>): Promise<TPrincipal | null>;
+}

package/oauth2-client-credentials-authentication.js

@@ -0,0 +1,329 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2ClientCredentialsAuthentication = void 0;
+const tslib_1 = require("tslib");
+/**
+ * OAuth2 Client Credentials Authentication
+ */
+const crypto_1 = require("@riao/crypto");
+const ms_1 = tslib_1.__importDefault(require("ms"));
+const crypto_2 = require("@riao/crypto");
+const authentication_1 = require("@riao/iam/authentication");
+const client_credential_1 = require("./client-credential");
+/**
+ * OAuth2 Client Credentials Authentication
+ * Implements server-to-server authentication using client_id and client_secret
+ *
+ * Features:
+ * - Client credential management with bcrypt hashing
+ * - JWT token generation with configurable expiration
+ * - Token validation and verification
+ * - Multiple credentials per principal
+ * - Credential revocation support
+ */
+class OAuth2ClientCredentialsAuthentication extends authentication_1.Authentication {
+    credentialsRepo;
+    hash;
+    jwt;
+    tokenExpiresInMs;
+    tokenExpiresInSeconds;
+    maxFailedAttempts;
+    lockoutDurationMs;
+    constructor(options) {
+        super(options);
+        this.hash = options.hash ?? new crypto_2.Hash();
+        this.maxFailedAttempts = Math.max(1, options.maxFailedAttempts ?? 5);
+        this.lockoutDurationMs = options.lockoutDurationMs ?? 15 * 60 * 1000;
+        // Convert tokenExpiresIn to ms format and seconds
+        const expiresIn = options.tokenExpiresIn ?? '1h';
+        this.tokenExpiresInMs =
+            typeof expiresIn === 'number' ? `${expiresIn}s` : expiresIn;
+        this.tokenExpiresInSeconds =
+            typeof expiresIn === 'number'
+                ? expiresIn
+                : (0, ms_1.default)(expiresIn) / 1000;
+        // Initialize JWT handler
+        this.jwt = new crypto_1.Jwt({
+            secret: options.jwtSecret,
+            expiresIn: this.tokenExpiresInMs,
+            algorithm: (options.jwtAlgorithm ?? 'HS256'),
+        });
+        this.credentialsRepo = options.db.getQueryRepository({
+            table: 'oauth2_client_credentials',
+            identifiedBy: 'id',
+        });
+    }
+    /**
+     * Validate client_id format
+     * @param clientId Client identifier to validate
+     * @throws Error if format is invalid
+     */
+    validateClientId(clientId) {
+        if (!clientId || clientId.length < client_credential_1.CLIENT_ID_VALIDATION.MIN_LENGTH) {
+            throw new Error('Client ID must be at least '
+                + client_credential_1.CLIENT_ID_VALIDATION.MIN_LENGTH
+                + ' characters');
+        }
+        if (clientId.length > client_credential_1.CLIENT_ID_VALIDATION.MAX_LENGTH) {
+            throw new Error('Client ID cannot exceed '
+                + client_credential_1.CLIENT_ID_VALIDATION.MAX_LENGTH
+                + ' characters');
+        }
+        if (!client_credential_1.CLIENT_ID_VALIDATION.PATTERN.test(clientId)) {
+            throw new Error('Client ID must contain only alphanumeric characters, '
+                + 'hyphens, underscores, dots, and colons');
+        }
+    }
+    /**
+     * Create a new client credential for a principal
+     * @param options.principalId The principal ID
+     * @param options.clientId Unique client identifier
+     * @param options.clientSecret Secret (will be hashed before storage)
+     * @param options.description Optional description
+     * @throws Error if principal doesn't exist,
+     * client_id is invalid, or already in use
+     */
+    async createClientCredential(options) {
+        const { principalId, clientId, clientSecret, description } = options;
+        // Validate client_id format
+        this.validateClientId(clientId);
+        if (clientSecret.length < client_credential_1.CLIENT_SECRET_VALIDATION.MIN_LENGTH) {
+            throw new Error('Client secret must be at least '
+                + client_credential_1.CLIENT_SECRET_VALIDATION.MIN_LENGTH
+                + ' characters');
+        }
+        // Verify principal exists
+        const principal = await this.findActivePrincipal({
+            where: { id: principalId },
+        });
+        if (!principal) {
+            throw new Error('Principal with ID "'
+                + principalId
+                + '" does not exist or is inactive');
+        }
+        // Check if client_id is already in use (active or revoked)
+        const existing = await this.credentialsRepo.findOne({
+            where: { client_id: clientId },
+        });
+        if (existing) {
+            throw new Error(`Client ID "${clientId}" is already in use`);
+        }
+        // Hash the client secret only after inexpensive validation succeeds
+        const secretHash = await this.hash.make(clientSecret);
+        // Store credential
+        await this.credentialsRepo.insertOne({
+            record: {
+                principal_id: principalId,
+                client_id: clientId,
+                client_secret_hash: secretHash,
+                description: description ?? null,
+                create_timestamp: new Date(),
+                failed_exchange_count: 0,
+                locked_until: null,
+            },
+        });
+    }
+    /**
+     * Exchange client credentials for an access token
+     * Implements OAuth2 Client Credentials grant
+     *
+     * @param clientId Client identifier
+     * @param clientSecret Client secret
+     * @returns Access token and expiration info
+     * @throws Error if credentials are invalid or principal not found
+     */
+    async exchangeCredentials(clientId, clientSecret) {
+        const attempt = {
+            scheme: 'oauth2-client-credentials',
+            subject: clientId,
+        };
+        const protection = await this.beforeAuthenticationAttempt(attempt);
+        if (!protection.allowed) {
+            throw new Error('Invalid credentials');
+        }
+        // Find credential by client_id (active or revoked)
+        const credential = await this.credentialsRepo.findOne({
+            where: { client_id: clientId },
+        });
+        // Distinguish between credential not found vs. revoked
+        if (!credential) {
+            await this.recordAuthenticationFailure(attempt);
+            throw new Error('Invalid credentials');
+        }
+        if (credential.deactivate_timestamp !== null) {
+            throw new Error('Credential has been revoked');
+        }
+        if (credential.locked_until &&
+            credential.locked_until <= new Date()) {
+            await this.credentialsRepo.update({
+                set: {
+                    failed_exchange_count: 0,
+                    locked_until: null,
+                },
+                where: { id: credential.id },
+            });
+        }
+        else if (credential.locked_until &&
+            credential.locked_until > new Date()) {
+            throw new Error('Invalid credentials');
+        }
+        // Verify secret and track failed attempts
+        const isValid = await this.hash.check(clientSecret, credential.client_secret_hash);
+        if (!isValid) {
+            await this.recordAuthenticationFailure(attempt);
+            await this.recordExchangeFailure(credential);
+            throw new Error('Invalid credentials');
+        }
+        // Get principal details
+        const principal = await this.findActivePrincipal({
+            where: { id: credential.principal_id },
+        });
+        if (!principal) {
+            throw new Error('Principal not found');
+        }
+        // Generate JWT token using @riao/crypto
+        const payload = {
+            client_id: clientId,
+            principal_id: credential.principal_id,
+        };
+        const tokenResult = await this.jwt.generateToken(payload);
+        // Update last exchange timestamp and reset failed attempts on success
+        await this.credentialsRepo.update({
+            set: {
+                last_exchange_timestamp: new Date(),
+                failed_exchange_count: 0,
+                locked_until: null,
+            },
+            where: { id: credential.id },
+        });
+        await this.recordAuthenticationSuccess(attempt);
+        return {
+            access_token: tokenResult.token,
+            token_type: 'Bearer',
+            expires_in: this.tokenExpiresInSeconds,
+        };
+    }
+    async recordExchangeFailure(credential) {
+        if (credential.locked_until &&
+            credential.locked_until <= new Date()) {
+            await this.credentialsRepo.update({
+                set: {
+                    failed_exchange_count: 0,
+                    locked_until: null,
+                },
+                where: { id: credential.id },
+            });
+        }
+        await this.credentialsRepo.increment({
+            column: 'failed_exchange_count',
+            where: { id: credential.id },
+        });
+        const updatedCredential = await this.credentialsRepo.findOne({
+            where: { id: credential.id },
+        });
+        if (updatedCredential &&
+            (updatedCredential.failed_exchange_count || 0) >=
+                this.maxFailedAttempts) {
+            await this.credentialsRepo.update({
+                set: {
+                    locked_until: new Date(Date.now() + this.lockoutDurationMs),
+                },
+                where: { id: credential.id },
+            });
+        }
+    }
+    /**
+     * Verify and decode an access token
+     * @param token JWT access token
+     * @returns Token payload if valid, null if invalid or expired
+     */
+    async verifyAccessToken(token) {
+        let payload = null;
+        try {
+            payload = await this.jwt.decodeToken(token);
+        }
+        catch (error) {
+            return null;
+        }
+        // Verify credential is still active
+        const credential = await this.credentialsRepo.findOne({
+            where: {
+                client_id: payload.client_id,
+                principal_id: payload.principal_id,
+                deactivate_timestamp: null,
+            },
+        });
+        if (!credential) {
+            return null;
+        }
+        const principal = await this.findActivePrincipal({
+            where: { id: payload.principal_id },
+        });
+        if (!principal) {
+            return null;
+        }
+        return payload;
+    }
+    /**
+     * Revoke a client credential
+     * Prevents future token generation with this credential
+     * @param credentialId The credential ID to revoke
+     */
+    async revokeClientCredential(credentialId) {
+        await this.credentialsRepo.update({
+            set: { deactivate_timestamp: new Date() },
+            where: {
+                id: credentialId,
+            },
+        });
+    }
+    /**
+     * Revoke all credentials for a principal
+     * @param principalId The principal ID
+     */
+    async revokeAllCredentials(principalId) {
+        await this.credentialsRepo.update({
+            set: { deactivate_timestamp: new Date() },
+            where: {
+                principal_id: principalId,
+                deactivate_timestamp: null,
+            },
+        });
+    }
+    /**
+     * List all active credentials for a principal
+     * @param principalId The principal ID
+     * @returns Array of credentials (without secret hashes)
+     */
+    async listCredentials(principalId) {
+        const credentials = await this.credentialsRepo.find({
+            where: {
+                principal_id: principalId,
+                deactivate_timestamp: null,
+            },
+        });
+        // Remove sensitive hashes before returning
+        return credentials.map((credential) => {
+            const safe = { ...credential };
+            delete safe.client_secret_hash;
+            return safe;
+        });
+    }
+    /**
+     * Authenticate using OAuth2 token
+     * (For compatibility with Authentication interface)
+     */
+    async authenticate(credentials) {
+        const token = await this.exchangeCredentials(credentials.client_id, credentials.client_secret);
+        const payload = await this.verifyAccessToken(token.access_token);
+        if (!payload) {
+            return null;
+        }
+        const principal = await this.findActivePrincipal({
+            where: { id: payload.principal_id },
+        });
+        return principal;
+    }
+}
+exports.OAuth2ClientCredentialsAuthentication = OAuth2ClientCredentialsAuthentication;
+//# sourceMappingURL=oauth2-client-credentials-authentication.js.map

package/oauth2-client-credentials-authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-client-credentials-authentication.js","sourceRoot":"","sources":["../../src/oauth2-client-credentials-authentication.ts"],"names":[],"mappings":";;;;AAAA;;GAEG;AACH,yCAA+C;AAC/C,oDAAoB;AAEpB,yCAAoC;AAEpC,6DAIkC;AAClC,2DAI6B;AA0C7B;;;;;;;;;;GAUG;AACH,MAAsB,qCAEpB,SAAQ,+BAA0B;IAC5B,eAAe,CAAoC;IAChD,IAAI,CAAO;IACX,GAAG,CAA0B;IAC7B,gBAAgB,CAAiB;IACjC,qBAAqB,CAAS;IACrB,iBAAiB,CAAS;IAC1B,iBAAiB,CAAS;IAE7C,YAAmB,OAAuC;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,aAAI,EAAE,CAAC;QACvC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAChC,CAAC,EACD,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAC9B,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAErE,kDAAkD;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QACjD,IAAI,CAAC,gBAAgB;YACpB,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,IAAI,CAAC,qBAAqB;YACzB,OAAO,SAAS,KAAK,QAAQ;gBAC5B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAE,IAAA,YAAE,EAAC,SAAS,CAAY,GAAG,IAAI,CAAC;QAErC,yBAAyB;QACzB,IAAI,CAAC,GAAG,GAAG,IAAI,YAAG,CAAqB;YACtC,MAAM,EAAE,OAAO,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,gBAAgB;YAChC,SAAS,EAAE,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAsB;SACjE,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAmB;YACtE,KAAK,EAAE,2BAA2B;YAClC,YAAY,EAAE,IAAI;SAClB,CAAC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,QAAgB;QACxC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,wCAAoB,CAAC,UAAU,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACd,6BAA6B;kBAC3B,wCAAoB,CAAC,UAAU;kBAC/B,aAAa,CACf,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,wCAAoB,CAAC,UAAU,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACd,0BAA0B;kBACxB,wCAAoB,CAAC,UAAU;kBAC/B,aAAa,CACf,CAAC;QACH,CAAC;QAED,IAAI,CAAC,wCAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACd,uDAAuD;kBACrD,wCAAwC,CAC1C,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,sBAAsB,CAClC,OAAsC;QAEtC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QAErE,4BAA4B;QAC5B,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,YAAY,CAAC,MAAM,GAAG,4CAAwB,CAAC,UAAU,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACd,iCAAiC;kBAC/B,4CAAwB,CAAC,UAAU;kBACnC,aAAa,CACf,CAAC;QACH,CAAC;QAED,0BAA0B;QAC1B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC;YAChD,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAgB;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACd,qBAAqB;kBACnB,WAAW;kBACX,iCAAiC,CACnC,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YACnD,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;SAC9B,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,cAAc,QAAQ,qBAAqB,CAAC,CAAC;QAC9D,CAAC;QAED,oEAAoE;QACpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAEtD,mBAAmB;QACnB,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;YACpC,MAAM,EAAE;gBACP,YAAY,EAAE,WAAqB;gBACnC,SAAS,EAAE,QAAQ;gBACnB,kBAAkB,EAAE,UAAU;gBAC9B,WAAW,EAAE,WAAW,IAAI,IAAI;gBAChC,gBAAgB,EAAE,IAAI,IAAI,EAAE;gBAC5B,qBAAqB,EAAE,CAAC;gBACxB,YAAY,EAAE,IAAI;aAClB;SACD,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,mBAAmB,CAC/B,QAAgB,EAChB,YAAoB;QAMpB,MAAM,OAAO,GAA0B;YACtC,MAAM,EAAE,2BAA2B;YACnC,OAAO,EAAE,QAAQ;SACjB,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAEnE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QAED,mDAAmD;QACnD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YACrD,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;SAC9B,CAAC,CAAC;QAEH,uDAAuD;QACvD,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,UAAU,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAChD,CAAC;QAED,IACC,UAAU,CAAC,YAAY;YACvB,UAAU,CAAC,YAAY,IAAI,IAAI,IAAI,EAAE,EACpC,CAAC;YACF,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;gBACjC,GAAG,EAAE;oBACJ,qBAAqB,EAAE,CAAC;oBACxB,YAAY,EAAE,IAAI;iBAClB;gBACD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE;aAC5B,CAAC,CAAC;QACJ,CAAC;aACI,IACJ,UAAU,CAAC,YAAY;YACvB,UAAU,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,EACnC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QAED,0CAA0C;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC,YAAY,EACZ,UAAU,CAAC,kBAAkB,CAC7B,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QAED,wBAAwB;QACxB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC;YAChD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,YAAY,EAAgB;SACpD,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QAED,wCAAwC;QACxC,MAAM,OAAO,GAAuB;YACnC,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,UAAU,CAAC,YAAY;SACrC,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAE1D,sEAAsE;QACtE,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACjC,GAAG,EAAE;gBACJ,uBAAuB,EAAE,IAAI,IAAI,EAAE;gBACnC,qBAAqB,EAAE,CAAC;gBACxB,YAAY,EAAE,IAAI;aAClB;YACD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE;SAC5B,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAEhD,OAAO;YACN,YAAY,EAAE,WAAW,CAAC,KAAK;YAC/B,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,qBAAqB;SACtC,CAAC;IACH,CAAC;IAES,KAAK,CAAC,qBAAqB,CACpC,UAA4B;QAE5B,IACC,UAAU,CAAC,YAAY;YACvB,UAAU,CAAC,YAAY,IAAI,IAAI,IAAI,EAAE,EACpC,CAAC;YACF,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;gBACjC,GAAG,EAAE;oBACJ,qBAAqB,EAAE,CAAC;oBACxB,YAAY,EAAE,IAAI;iBAClB;gBACD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE;aAC5B,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;YACpC,MAAM,EAAE,uBAAuB;YAC/B,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE;SAC5B,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAC5D,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE;SAC5B,CAAC,CAAC;QAEH,IACC,iBAAiB;YACjB,CAAC,iBAAiB,CAAC,qBAAqB,IAAI,CAAC,CAAC;gBAC7C,IAAI,CAAC,iBAAiB,EACtB,CAAC;YACF,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;gBACjC,GAAG,EAAE;oBACJ,YAAY,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC;iBAC3D;gBACD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE;aAC5B,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,iBAAiB,CAC7B,KAAa;QAEb,IAAI,OAAO,GAA8B,IAAI,CAAC;QAC9C,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACb,CAAC;QAED,oCAAoC;QACpC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YACrD,KAAK,EAAE;gBACN,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,oBAAoB,EAAE,IAAI;aAC1B;SACD,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC;YAChD,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,YAAY,EAAgB;SACjD,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,sBAAsB,CAClC,YAA8B;QAE9B,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACjC,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,IAAI,EAAE,EAAE;YACzC,KAAK,EAAE;gBACN,EAAE,EAAE,YAAsB;aAC1B;SACD,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,oBAAoB,CAChC,WAA6B;QAE7B,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACjC,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,IAAI,EAAE,EAAE;YACzC,KAAK,EAAE;gBACN,YAAY,EAAE,WAAqB;gBACnC,oBAAoB,EAAE,IAAI;aAC1B;SACD,CAAC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,eAAe,CAC3B,WAA6B;QAE7B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YACnD,KAAK,EAAE;gBACN,YAAY,EAAE,WAAqB;gBACnC,oBAAoB,EAAE,IAAI;aAC1B;SACD,CAAC,CAAC;QAEH,2CAA2C;QAC3C,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAA+B,CAAC;YAC5D,OAAO,IAAI,CAAC,kBAAkB,CAAC;YAC/B,OAAO,IAAoD,CAAC;QAC7D,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,YAAY,CACxB,WAEC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC3C,WAAW,CAAC,SAAmB,EAC/B,WAAW,CAAC,aAAuB,CACnC,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAEjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC;YAChD,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,YAAY,EAAgB;SACjD,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IAClB,CAAC;CACD;AApZD,sFAoZC"}

package/oauth2-client-credentials-migrations.d.ts

@@ -0,0 +1,17 @@
+import { MigrationPackage, PackagedMigrations } from '@riao/dbal';
+/**
+ * OAuth2 Client Credentials Authentication Migrations
+ * Provides database schema for storing client credentials with:
+ * - Principal foreign key with cascade delete
+ * - Globally unique client_id constraint
+ * - Bcrypt-hashed client secrets
+ * - Usage tracking (last exchange timestamp,
+ *   failed attempt counter)
+ * - Credential lifecycle management
+ *   (create, deactivate timestamps)
+ */
+export declare class OAuth2ClientCredentialsMigrations extends MigrationPackage {
+    package: string;
+    name: string;
+    getMigrations(): Promise<PackagedMigrations>;
+}

package/oauth2-client-credentials-migrations.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2ClientCredentialsMigrations = void 0;
+const dbal_1 = require("@riao/dbal");
+const _001_create_client_credentials_table_1 = require("./migrations/001-create-client-credentials-table");
+/**
+ * OAuth2 Client Credentials Authentication Migrations
+ * Provides database schema for storing client credentials with:
+ * - Principal foreign key with cascade delete
+ * - Globally unique client_id constraint
+ * - Bcrypt-hashed client secrets
+ * - Usage tracking (last exchange timestamp,
+ *   failed attempt counter)
+ * - Credential lifecycle management
+ *   (create, deactivate timestamps)
+ */
+class OAuth2ClientCredentialsMigrations extends dbal_1.MigrationPackage {
+    package = '@riao/' + 'authn-oauth2-client-cred';
+    name = '@riao/' + 'authn-oauth2-client-cred';
+    async getMigrations() {
+        return {
+            'create-client-credentials-table': _001_create_client_credentials_table_1.CreateClientCredentialsTable,
+        };
+    }
+}
+exports.OAuth2ClientCredentialsMigrations = OAuth2ClientCredentialsMigrations;
+//# sourceMappingURL=oauth2-client-credentials-migrations.js.map

package/oauth2-client-credentials-migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-client-credentials-migrations.js","sourceRoot":"","sources":["../../src/oauth2-client-credentials-migrations.ts"],"names":[],"mappings":";;;AAAA,qCAAkE;AAClE,2GAE0D;AAE1D;;;;;;;;;;GAUG;AACH,MAAa,iCAAkC,SAAQ,uBAAgB;IAC7D,OAAO,GAAG,QAAQ,GAAG,0BAA0B,CAAC;IAChD,IAAI,GAAG,QAAQ,GAAG,0BAA0B,CAAC;IAE7C,KAAK,CAAC,aAAa;QAC3B,OAAO;YACN,iCAAiC,EAAE,mEAA4B;SAC9B,CAAC;IACpC,CAAC;CACD;AATD,8EASC"}

package/package.json

@@ -0,0 +1,30 @@
+{
+	"name": "@riao/authn-oauth2-client-cred",
+	"version": "1.0.0",
+	"description": "@riao/authn-oauth2-client-cred",
+	"typescript-template": {
+		"base": "1.0.1",
+		"jasmine": "1.0.0",
+		"library": "1.0.0"
+	},
+	"scripts": {},
+	"dependencies": {
+		"@riao/crypto": "^1.1.1",
+		"@riao/dbal": "^3.12.0",
+		"@riao/iam": "^4.0.0",
+		"ms": "^2.1.3"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/@riao/authn-oauth2-client-cred/@riao/authn-oauth2-client-cred.git"
+	},
+	"author": "@riao/authn-oauth2-client-cred",
+	"license": "MIT",
+	"bugs": {
+		"url": "https://github.com/@riao/authn-oauth2-client-cred/@riao/authn-oauth2-client-cred/issues"
+	},
+	"homepage": "https://github.com/@riao/authn-oauth2-client-cred/@riao/authn-oauth2-client-cred#readme",
+	"keywords": [],
+	"main": "index.js",
+	"types": "index.d.ts"
+}