@schemavaults/auth-common 0.26.1 → 0.26.2

package/dist/oidc/index.d.ts

@@ -1,4 +1,4 @@
-export { OIDC_OPENID_SCOPE, OIDC_SUPPORTED_SCOPES, DEFAULT_AUTH_SCOPE, OIDC_SCOPE_REGEX, oidcScopeSchema, parseAndGrantScopes, serializeOidcScopes, } from "./scope";
+export { OIDC_OPENID_SCOPE, OIDC_SUPPORTED_SCOPES, DEFAULT_AUTH_SCOPE, OIDC_SCOPE_REGEX, oidcScopeSchema, parseAndGrantScopes, serializeOidcScopes, serializeOidcScopesOrNull, } from "./scope";
 export type { OidcSupportedScope, OidcScope, ParsedOidcScopes, } from "./scope";
 export { oidcNonceSchema, OIDC_NONCE_VSCHAR_REGEX, parseOidcNonce, OidcNonceValidationError, } from "./nonce";
 export type { OidcNonce } from "./nonce";

package/dist/oidc/index.js

@@ -1,4 +1,4 @@
-export { OIDC_OPENID_SCOPE, OIDC_SUPPORTED_SCOPES, DEFAULT_AUTH_SCOPE, OIDC_SCOPE_REGEX, oidcScopeSchema, parseAndGrantScopes, serializeOidcScopes, } from "./scope";
+export { OIDC_OPENID_SCOPE, OIDC_SUPPORTED_SCOPES, DEFAULT_AUTH_SCOPE, OIDC_SCOPE_REGEX, oidcScopeSchema, parseAndGrantScopes, serializeOidcScopes, serializeOidcScopesOrNull, } from "./scope";
 export { oidcNonceSchema, OIDC_NONCE_VSCHAR_REGEX, parseOidcNonce, OidcNonceValidationError, } from "./nonce";
 export { OIDC_SUB_CLAIM_DELIMITER, formatOidcSubClaim, parseOidcSubClaim, } from "./sub-claim";
 export { buildOidcProfileClaims } from "./profile-claims";

package/dist/oidc/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oidc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAOjB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAM1D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGtE,OAAO,EACL,yBAAyB,EACzB,uCAAuC,EACvC,iCAAiC,EACjC,kCAAkC,EAClC,wCAAwC,EACxC,yCAAyC,EACzC,iCAAiC,GAClC,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oidc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,SAAS,CAAC;AAOjB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAM1D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGtE,OAAO,EACL,yBAAyB,EACzB,uCAAuC,EACvC,iCAAiC,EACjC,kCAAkC,EAClC,wCAAwC,EACxC,yCAAyC,EACzC,iCAAiC,GAClC,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/oidc/scope.d.ts

@@ -3,11 +3,20 @@
  *
  * The platform's own authorization model is audience-based
  * (see audience-schema.ts / APP_TO_API_PERMISSIONS); OAuth2 scopes exist
- * only on the OIDC surface, where `openid` is mandatory (OIDC Core §3.1.2.1)
- * and `email`/`profile` gate which claims the id_token and /userinfo
- * response carry. Unknown scopes are silently dropped per RFC 6749 §3.3
- * (the granted set is echoed back in the token response, so RPs that
- * hardcode e.g. "openid profile email address" still interoperate).
+ * only on the OIDC surface, where `openid` turns an authorization
+ * request into an OpenID Connect authentication request (OIDC Core
+ * §3.1.2.1: an id_token is minted and /userinfo opens up) and
+ * `email`/`profile` gate which claims the id_token and /userinfo
+ * response carry. A request WITHOUT `openid` — including one with no
+ * `scope` at all (OPTIONAL per RFC 6749 §3.3) — is a plain OAuth 2.1
+ * authorization grant: it yields access + refresh tokens only, no
+ * id_token, and no identity claims (OIDC Core §3.1.2.1 leaves such
+ * requests to OAuth 2.0 semantics). That is what OAuth-only clients such
+ * as MCP clients send; they want a token for a resource server, not an
+ * identity. Unknown scopes are silently dropped per RFC 6749 §3.3 (the
+ * granted set is echoed back in the token response, so RPs that
+ * hardcode e.g. "openid profile email address" still interoperate, and
+ * a request naming only unknown scopes degrades to a plain OAuth grant).
  */
 import { z } from "zod";
 export declare const OIDC_OPENID_SCOPE: "openid";
@@ -47,13 +56,19 @@ export interface ParsedOidcScopes {
      * OIDC_SUPPORTED_SCOPES, deduplicated, in request order.
      */
     granted: OidcSupportedScope[];
-    /** Whether the request included the mandatory `openid` scope. */
+    /**
+     * Whether the request included the `openid` scope, i.e. whether it is
+     * an OpenID Connect authentication request (id_token + userinfo) as
+     * opposed to a plain OAuth 2.1 authorization grant.
+     */
     hasOpenid: boolean;
 }
 /**
  * Parses a raw `scope` request parameter (space-delimited per
- * RFC 6749 §3.3) into the granted subset. Non-string or empty input
- * grants nothing (callers reject missing `openid` via `hasOpenid`).
+ * RFC 6749 §3.3) into the granted subset. Non-string, empty, or
+ * malformed input grants nothing — an empty granted set is a valid
+ * outcome (a plain OAuth 2.1 grant); callers that need to distinguish a
+ * malformed value from an absent one check `oidcScopeSchema` first.
  */
 export declare function parseAndGrantScopes(raw: unknown): ParsedOidcScopes;
 /**
@@ -61,3 +76,10 @@ export declare function parseAndGrantScopes(raw: unknown): ParsedOidcScopes;
  * the token response `scope` field and the AUTHORIZATION_CODES row.
  */
 export declare function serializeOidcScopes(scopes: readonly string[]): string;
+/**
+ * Serializes a granted set to its stored form on the AUTHORIZATION_CODES
+ * row / MFA challenge / token claims: `null` when nothing was granted (a
+ * plain OAuth 2.1 grant carries no `scope` — the wire format has no
+ * representation for an empty list), else the space-delimited list.
+ */
+export declare function serializeOidcScopesOrNull(scopes: readonly string[]): string | null;

package/dist/oidc/scope.js

@@ -3,11 +3,20 @@
  *
  * The platform's own authorization model is audience-based
  * (see audience-schema.ts / APP_TO_API_PERMISSIONS); OAuth2 scopes exist
- * only on the OIDC surface, where `openid` is mandatory (OIDC Core §3.1.2.1)
- * and `email`/`profile` gate which claims the id_token and /userinfo
- * response carry. Unknown scopes are silently dropped per RFC 6749 §3.3
- * (the granted set is echoed back in the token response, so RPs that
- * hardcode e.g. "openid profile email address" still interoperate).
+ * only on the OIDC surface, where `openid` turns an authorization
+ * request into an OpenID Connect authentication request (OIDC Core
+ * §3.1.2.1: an id_token is minted and /userinfo opens up) and
+ * `email`/`profile` gate which claims the id_token and /userinfo
+ * response carry. A request WITHOUT `openid` — including one with no
+ * `scope` at all (OPTIONAL per RFC 6749 §3.3) — is a plain OAuth 2.1
+ * authorization grant: it yields access + refresh tokens only, no
+ * id_token, and no identity claims (OIDC Core §3.1.2.1 leaves such
+ * requests to OAuth 2.0 semantics). That is what OAuth-only clients such
+ * as MCP clients send; they want a token for a resource server, not an
+ * identity. Unknown scopes are silently dropped per RFC 6749 §3.3 (the
+ * granted set is echoed back in the token response, so RPs that
+ * hardcode e.g. "openid profile email address" still interoperate, and
+ * a request naming only unknown scopes degrades to a plain OAuth grant).
  */
 import { z } from "zod";
 export const OIDC_OPENID_SCOPE = "openid";
@@ -54,8 +63,10 @@ function isSupportedOidcScope(scope) {
 }
 /**
  * Parses a raw `scope` request parameter (space-delimited per
- * RFC 6749 §3.3) into the granted subset. Non-string or empty input
- * grants nothing (callers reject missing `openid` via `hasOpenid`).
+ * RFC 6749 §3.3) into the granted subset. Non-string, empty, or
+ * malformed input grants nothing — an empty granted set is a valid
+ * outcome (a plain OAuth 2.1 grant); callers that need to distinguish a
+ * malformed value from an absent one check `oidcScopeSchema` first.
  */
 export function parseAndGrantScopes(raw) {
     if (typeof raw !== "string") {
@@ -81,4 +92,13 @@ export function parseAndGrantScopes(raw) {
 export function serializeOidcScopes(scopes) {
     return scopes.join(" ");
 }
+/**
+ * Serializes a granted set to its stored form on the AUTHORIZATION_CODES
+ * row / MFA challenge / token claims: `null` when nothing was granted (a
+ * plain OAuth 2.1 grant carries no `scope` — the wire format has no
+ * representation for an empty list), else the space-delimited list.
+ */
+export function serializeOidcScopesOrNull(scopes) {
+    return scopes.length === 0 ? null : serializeOidcScopes(scopes);
+}
 //# sourceMappingURL=scope.js.map

package/dist/oidc/scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/oidc/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAiB,CAAC;AAEnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAA+B,CAAC;AAElE,MAAM,qBAAqB,GAAG,GAAY,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,4DAA4D,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,qBAAqB,CAAC;KAC1B,KAAK,CAAC,gBAAgB,EAAE;IACvB,OAAO,EACL,sEAAsE;CACzE,CAAC,CAAC;AAgBL,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,OAAQ,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,SAAS,CAAC,+BAA+B;QACrD,IAAI,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/oidc/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAiB,CAAC;AAEnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAA+B,CAAC;AAElE,MAAM,qBAAqB,GAAG,GAAY,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,4DAA4D,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,qBAAqB,CAAC;KAC1B,KAAK,CAAC,gBAAgB,EAAE;IACvB,OAAO,EACL,sEAAsE;CACzE,CAAC,CAAC;AAoBL,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,OAAQ,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,SAAS,CAAC,+BAA+B;QACrD,IAAI,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB;IAEzB,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-common",
   "description": "Types and utility functions for authentication and authorization",
-  "version": "0.26.1",
+  "version": "0.26.2",
   "license": "UNLICENSED",
   "private": false,
   "repository": {