@silkweave/auth 1.3.0

package/src/provider/proxy.ts

@@ -0,0 +1,444 @@
+import { randomBytes, randomUUID } from 'crypto'
+import { SignJWT, jwtVerify } from 'jose'
+import { createMemoryStore } from '../store/memory-store.js'
+import { AuthInfo } from '../types.js'
+import { OAuthStore } from './store.js'
+import { OAuthProvider, OAuthResponse } from './types.js'
+import { matchRedirectUri } from './uri.js'
+
+export interface OAuthProxyConfig {
+  authorizeUrl: string
+  tokenUrl: string
+  userinfoUrl?: string
+  clientId: string
+  clientSecret: string
+  resourceUrl: string
+  redirectUris: string[]
+  requiredScopes?: string[]
+  callbackPath?: string
+  signingKey?: string
+  tokenTtl?: number
+  store?: OAuthStore
+}
+
+const CORS_HEADERS: Record<string, string> = {
+  'Access-Control-Allow-Origin': '*',
+  'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+  'Access-Control-Allow-Headers': '*'
+}
+
+export function createOAuthProxy(config: OAuthProxyConfig): OAuthProvider {
+  const store = config.store ?? createMemoryStore()
+  const callbackPath = config.callbackPath ?? '/auth/callback'
+  const tokenTtl = config.tokenTtl ?? 3600
+  const scopes = config.requiredScopes ?? []
+
+  let signingKey: Uint8Array | null = null
+
+  async function getSigningKey(): Promise<Uint8Array> {
+    if (signingKey) { return signingKey }
+    if (config.signingKey) {
+      signingKey = new TextEncoder().encode(config.signingKey)
+    } else {
+      signingKey = randomBytes(32)
+    }
+    return signingKey
+  }
+
+  function generateCode(): string {
+    return randomBytes(32).toString('base64url')
+  }
+
+  async function generatePkce(): Promise<{ verifier: string; challenge: string }> {
+    const verifier = randomBytes(32).toString('base64url')
+    const hash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))
+    const challenge = Buffer.from(hash).toString('base64url')
+    return { verifier, challenge }
+  }
+
+  async function verifyPkce(verifier: string, challenge: string): Promise<boolean> {
+    const hash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))
+    const computed = Buffer.from(hash).toString('base64url')
+    return computed === challenge
+  }
+
+  function jsonResponse(status: number, body: Record<string, unknown>, headers: Record<string, string> = {}): OAuthResponse {
+    return {
+      status,
+      headers: { 'Content-Type': 'application/json', ...CORS_HEADERS, ...headers },
+      body
+    }
+  }
+
+  function redirectResponse(url: string): OAuthResponse {
+    return {
+      status: 302,
+      headers: { Location: url, ...CORS_HEADERS },
+      body: undefined
+    }
+  }
+
+  function errorResponse(status: number, error: string, description: string): OAuthResponse {
+    return jsonResponse(status, { error, error_description: description })
+  }
+
+  const provider: OAuthProvider = {
+    metadata(): OAuthResponse {
+      return jsonResponse(200, {
+        issuer: config.resourceUrl,
+        authorization_endpoint: `${config.resourceUrl}/authorize`,
+        token_endpoint: `${config.resourceUrl}/token`,
+        registration_endpoint: `${config.resourceUrl}/register`,
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code', 'refresh_token'],
+        code_challenge_methods_supported: ['S256'],
+        token_endpoint_auth_methods_supported: ['none', 'client_secret_post'],
+        scopes_supported: scopes
+      }, { 'Cache-Control': 'max-age=3600' })
+    },
+
+    async register(req): Promise<OAuthResponse> {
+      const body = req.body
+      if (!body) { return errorResponse(400, 'invalid_request', 'Missing request body') }
+
+      const redirectUris = body.redirect_uris
+      if (!redirectUris) { return errorResponse(400, 'invalid_request', 'redirect_uris is required') }
+
+      let uris: string[]
+      try {
+        uris = typeof redirectUris === 'string' ? JSON.parse(redirectUris) : redirectUris
+      } catch {
+        uris = [redirectUris]
+      }
+
+      if (!Array.isArray(uris) || uris.length === 0) {
+        return errorResponse(400, 'invalid_request', 'redirect_uris must be a non-empty array')
+      }
+
+      for (const uri of uris) {
+        if (!matchRedirectUri(uri, config.redirectUris)) {
+          return errorResponse(400, 'invalid_redirect_uri', `Redirect URI not allowed: ${uri}`)
+        }
+      }
+
+      const clientId = randomUUID()
+      const clientSecret = randomBytes(32).toString('base64url')
+      const registration = {
+        clientId,
+        clientSecret,
+        redirectUris: uris,
+        clientName: body.client_name,
+        createdAt: Date.now() / 1000
+      }
+
+      await store.saveClient(clientId, registration)
+
+      return jsonResponse(201, {
+        client_id: clientId,
+        client_secret: clientSecret,
+        redirect_uris: uris,
+        client_name: body.client_name,
+        token_endpoint_auth_method: 'none'
+      })
+    },
+
+    async authorize(req): Promise<OAuthResponse> {
+      const params = req.url.searchParams
+      const responseType = params.get('response_type')
+      const clientId = params.get('client_id')
+      const redirectUri = params.get('redirect_uri')
+      const scope = params.get('scope') ?? ''
+      const clientState = params.get('state') ?? ''
+      const codeChallenge = params.get('code_challenge')
+      const codeChallengeMethod = params.get('code_challenge_method')
+      const resource = params.get('resource')
+
+      if (responseType !== 'code') {
+        return errorResponse(400, 'unsupported_response_type', 'Only response_type=code is supported')
+      }
+      if (!clientId) { return errorResponse(400, 'invalid_request', 'client_id is required') }
+      if (!redirectUri) { return errorResponse(400, 'invalid_request', 'redirect_uri is required') }
+      if (!codeChallenge || codeChallengeMethod !== 'S256') {
+        return errorResponse(400, 'invalid_request', 'PKCE with S256 is required')
+      }
+
+      let client = await store.getClient(clientId)
+
+      if (!client && clientId.startsWith('https://')) {
+        try {
+          const metaRes = await fetch(clientId)
+          if (!metaRes.ok) {
+            return errorResponse(400, 'invalid_client', 'Failed to fetch client metadata document')
+          }
+          const meta = await metaRes.json() as Record<string, unknown>
+          const metaRedirectUris = meta.redirect_uris as string[] | undefined
+          if (!Array.isArray(metaRedirectUris) || metaRedirectUris.length === 0) {
+            return errorResponse(400, 'invalid_client', 'Client metadata must include redirect_uris')
+          }
+          for (const uri of metaRedirectUris) {
+            if (!matchRedirectUri(uri, config.redirectUris)) {
+              return errorResponse(400, 'invalid_redirect_uri', `Redirect URI not allowed: ${uri}`)
+            }
+          }
+          client = {
+            clientId,
+            clientSecret: '',
+            redirectUris: metaRedirectUris,
+            clientName: meta.client_name as string | undefined,
+            createdAt: Date.now() / 1000
+          }
+          await store.saveClient(clientId, client)
+        } catch {
+          return errorResponse(400, 'invalid_client', 'Failed to fetch client metadata document')
+        }
+      }
+
+      if (!client) { return errorResponse(400, 'invalid_client', 'Unknown client_id') }
+
+      if (!client.redirectUris.includes(redirectUri)) {
+        return errorResponse(400, 'invalid_redirect_uri', 'redirect_uri does not match registered URIs')
+      }
+
+      const proxyState = randomUUID()
+      const pkce = await generatePkce()
+
+      await store.savePendingAuth(proxyState, {
+        clientId,
+        redirectUri,
+        codeChallenge,
+        codeChallengeMethod,
+        scope,
+        clientState,
+        resource: resource ?? undefined,
+        expiresAt: Date.now() / 1000 + 600
+      })
+
+      await store.savePkceVerifier(proxyState, pkce.verifier)
+
+      const upstreamScopes = scopes.length > 0 ? scopes.join(' ') : scope
+      const upstreamUrl = new URL(config.authorizeUrl)
+      upstreamUrl.searchParams.set('response_type', 'code')
+      upstreamUrl.searchParams.set('client_id', config.clientId)
+      upstreamUrl.searchParams.set('redirect_uri', `${config.resourceUrl}${callbackPath}`)
+      upstreamUrl.searchParams.set('scope', upstreamScopes)
+      upstreamUrl.searchParams.set('state', proxyState)
+      upstreamUrl.searchParams.set('code_challenge', pkce.challenge)
+      upstreamUrl.searchParams.set('code_challenge_method', 'S256')
+      if (params.has('access_type')) {
+        upstreamUrl.searchParams.set('access_type', params.get('access_type')!)
+      }
+
+      return redirectResponse(upstreamUrl.toString())
+    },
+
+    async callback(req): Promise<OAuthResponse> {
+      const params = req.url.searchParams
+      const upstreamCode = params.get('code')
+      const proxyState = params.get('state')
+      const upstreamError = params.get('error')
+
+      if (upstreamError) {
+        return errorResponse(400, 'upstream_error', params.get('error_description') ?? upstreamError)
+      }
+      if (!upstreamCode || !proxyState) {
+        return errorResponse(400, 'invalid_request', 'Missing code or state')
+      }
+
+      const pending = await store.getPendingAuth(proxyState)
+      if (!pending) { return errorResponse(400, 'invalid_request', 'Unknown or expired state') }
+
+      const pkceVerifier = await store.getPkceVerifier(proxyState)
+      if (!pkceVerifier) { return errorResponse(400, 'invalid_request', 'Missing PKCE verifier') }
+
+      await store.deletePendingAuth(proxyState)
+      await store.deletePkceVerifier(proxyState)
+
+      const tokenBody = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: upstreamCode,
+        redirect_uri: `${config.resourceUrl}${callbackPath}`,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        code_verifier: pkceVerifier
+      })
+
+      const tokenResponse = await fetch(config.tokenUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: tokenBody.toString()
+      })
+
+      if (!tokenResponse.ok) {
+        const errorBody = await tokenResponse.text()
+        console.error('Upstream token exchange failed:', errorBody)
+        return errorResponse(502, 'upstream_error', 'Failed to exchange code with upstream provider')
+      }
+
+      const tokens = await tokenResponse.json() as Record<string, unknown>
+      const upstreamAccessToken = tokens.access_token as string
+      const upstreamIdToken = tokens.id_token as string | undefined
+
+      let email: string | undefined
+      let sub: string | undefined
+      if (config.userinfoUrl && upstreamAccessToken) {
+        try {
+          const userinfoResponse = await fetch(config.userinfoUrl, {
+            headers: { Authorization: `Bearer ${upstreamAccessToken}` }
+          })
+          if (userinfoResponse.ok) {
+            const userinfo = await userinfoResponse.json() as Record<string, unknown>
+            email = userinfo.email as string | undefined
+            sub = userinfo.sub as string | undefined
+          }
+        } catch {
+          // Userinfo fetch is best-effort
+        }
+      }
+
+      const mcpCode = generateCode()
+      await store.saveAuthCode(mcpCode, {
+        clientId: pending.clientId,
+        redirectUri: pending.redirectUri,
+        codeChallenge: pending.codeChallenge,
+        codeChallengeMethod: pending.codeChallengeMethod,
+        scopes: pending.scope.split(' ').filter(Boolean),
+        upstreamAccessToken,
+        upstreamIdToken,
+        email,
+        sub,
+        expiresAt: Date.now() / 1000 + 600
+      })
+
+      const clientRedirect = new URL(pending.redirectUri)
+      clientRedirect.searchParams.set('code', mcpCode)
+      if (pending.clientState) {
+        clientRedirect.searchParams.set('state', pending.clientState)
+      }
+
+      return redirectResponse(clientRedirect.toString())
+    },
+
+    async token(req): Promise<OAuthResponse> {
+      const body = req.body
+      if (!body) { return errorResponse(400, 'invalid_request', 'Missing request body') }
+
+      const grantType = body.grant_type
+
+      if (grantType === 'refresh_token') {
+        const refreshToken = body.refresh_token
+        if (!refreshToken) {
+          return errorResponse(400, 'invalid_request', 'Missing refresh_token')
+        }
+
+        const tokenData = await store.getRefreshToken(refreshToken)
+        if (!tokenData) {
+          return errorResponse(400, 'invalid_grant', 'Invalid or expired refresh token')
+        }
+
+        const key = await getSigningKey()
+        const now = Math.floor(Date.now() / 1000)
+        const accessToken = await new SignJWT({
+          scope: tokenData.scopes.join(' '),
+          email: tokenData.email
+        })
+          .setProtectedHeader({ alg: 'HS256' })
+          .setSubject(tokenData.sub ?? tokenData.email ?? tokenData.clientId)
+          .setIssuer(config.resourceUrl)
+          .setAudience(config.resourceUrl)
+          .setIssuedAt(now)
+          .setExpirationTime(now + tokenTtl)
+          .sign(key)
+
+        return jsonResponse(200, {
+          access_token: accessToken,
+          token_type: 'Bearer',
+          expires_in: tokenTtl,
+          scope: tokenData.scopes.join(' '),
+          refresh_token: refreshToken
+        })
+      }
+
+      if (grantType !== 'authorization_code') {
+        return errorResponse(400, 'unsupported_grant_type', 'Supported grant types: authorization_code, refresh_token')
+      }
+
+      const code = body.code
+      const redirectUri = body.redirect_uri
+      const clientId = body.client_id
+      const codeVerifier = body.code_verifier
+
+      if (!code || !codeVerifier || !clientId) {
+        return errorResponse(400, 'invalid_request', 'Missing required parameters')
+      }
+
+      const authCode = await store.getAuthCode(code)
+      if (!authCode) { return errorResponse(400, 'invalid_grant', 'Invalid or expired authorization code') }
+
+      await store.deleteAuthCode(code)
+
+      if (authCode.clientId !== clientId) {
+        return errorResponse(400, 'invalid_grant', 'client_id mismatch')
+      }
+      if (redirectUri && authCode.redirectUri !== redirectUri) {
+        return errorResponse(400, 'invalid_grant', 'redirect_uri mismatch')
+      }
+
+      const pkceValid = await verifyPkce(codeVerifier, authCode.codeChallenge)
+      if (!pkceValid) {
+        return errorResponse(400, 'invalid_grant', 'PKCE verification failed')
+      }
+
+      const key = await getSigningKey()
+      const now = Math.floor(Date.now() / 1000)
+      const accessToken = await new SignJWT({
+        scope: authCode.scopes.join(' '),
+        email: authCode.email
+      })
+        .setProtectedHeader({ alg: 'HS256' })
+        .setSubject(authCode.sub ?? authCode.email ?? authCode.clientId)
+        .setIssuer(config.resourceUrl)
+        .setAudience(config.resourceUrl)
+        .setIssuedAt(now)
+        .setExpirationTime(now + tokenTtl)
+        .sign(key)
+
+      const refreshToken = randomBytes(32).toString('base64url')
+      await store.saveRefreshToken(refreshToken, {
+        clientId: authCode.clientId,
+        scopes: authCode.scopes,
+        email: authCode.email,
+        sub: authCode.sub,
+        expiresAt: now + 30 * 24 * 3600
+      })
+
+      return jsonResponse(200, {
+        access_token: accessToken,
+        token_type: 'Bearer',
+        expires_in: tokenTtl,
+        scope: authCode.scopes.join(' '),
+        refresh_token: refreshToken
+      })
+    },
+
+    async verifyToken(token): Promise<AuthInfo | undefined> {
+      try {
+        const key = await getSigningKey()
+        const { payload } = await jwtVerify(token, key, {
+          issuer: config.resourceUrl,
+          audience: config.resourceUrl
+        })
+        return {
+          token,
+          clientId: payload.sub ?? undefined,
+          scopes: typeof payload.scope === 'string' ? payload.scope.split(' ').filter(Boolean) : [],
+          expiresAt: payload.exp,
+          email: payload.email as string | undefined
+        }
+      } catch {
+        return undefined
+      }
+    }
+  }
+
+  return provider
+}

package/src/provider/store.ts

@@ -0,0 +1,60 @@
+export interface AuthCodeData {
+  clientId: string
+  redirectUri: string
+  codeChallenge: string
+  codeChallengeMethod: string
+  scopes: string[]
+  upstreamAccessToken: string
+  upstreamIdToken?: string
+  email?: string
+  sub?: string
+  expiresAt: number
+}
+
+export interface PendingAuthData {
+  clientId: string
+  redirectUri: string
+  codeChallenge: string
+  codeChallengeMethod: string
+  scope: string
+  clientState: string
+  resource?: string
+  expiresAt: number
+}
+
+export interface ClientRegistration {
+  clientId: string
+  clientSecret: string
+  redirectUris: string[]
+  clientName?: string
+  createdAt: number
+}
+
+export interface RefreshTokenData {
+  clientId: string
+  scopes: string[]
+  email?: string
+  sub?: string
+  expiresAt: number
+}
+
+export interface OAuthStore {
+  saveAuthCode(code: string, data: AuthCodeData): Promise<void>
+  getAuthCode(code: string): Promise<AuthCodeData | undefined>
+  deleteAuthCode(code: string): Promise<void>
+
+  savePendingAuth(state: string, data: PendingAuthData): Promise<void>
+  getPendingAuth(state: string): Promise<PendingAuthData | undefined>
+  deletePendingAuth(state: string): Promise<void>
+
+  savePkceVerifier(state: string, verifier: string): Promise<void>
+  getPkceVerifier(state: string): Promise<string | undefined>
+  deletePkceVerifier(state: string): Promise<void>
+
+  saveClient(clientId: string, data: ClientRegistration): Promise<void>
+  getClient(clientId: string): Promise<ClientRegistration | undefined>
+
+  saveRefreshToken(token: string, data: RefreshTokenData): Promise<void>
+  getRefreshToken(token: string): Promise<RefreshTokenData | undefined>
+  deleteRefreshToken(token: string): Promise<void>
+}

package/src/provider/types.ts

@@ -0,0 +1,23 @@
+import { AuthInfo } from '../types.js'
+
+export interface OAuthRequest {
+  method: string
+  url: URL
+  headers: Record<string, string | undefined>
+  body?: Record<string, string>
+}
+
+export interface OAuthResponse {
+  status: number
+  headers: Record<string, string>
+  body?: string | Record<string, unknown>
+}
+
+export interface OAuthProvider {
+  authorize(req: OAuthRequest): Promise<OAuthResponse>
+  callback(req: OAuthRequest): Promise<OAuthResponse>
+  token(req: OAuthRequest): Promise<OAuthResponse>
+  register(req: OAuthRequest): Promise<OAuthResponse>
+  metadata(): OAuthResponse
+  verifyToken(token: string): Promise<AuthInfo | undefined>
+}

package/src/provider/uri.ts

@@ -0,0 +1,13 @@
+export function matchRedirectUri(uri: string, patterns: string[]): boolean {
+  return patterns.some((pattern) => {
+    const regex = patternToRegex(pattern)
+    return regex.test(uri)
+  })
+}
+
+function patternToRegex(pattern: string): RegExp {
+  const escaped = pattern
+    .replace(/[.+?^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*/g, '.*')
+  return new RegExp(`^${escaped}$`)
+}

package/src/store/json-store.ts

@@ -0,0 +1,97 @@
+import { existsSync, readFileSync, writeFileSync } from 'fs'
+import { AuthCodeData, ClientRegistration, OAuthStore, PendingAuthData, RefreshTokenData } from '../provider/store.js'
+
+function withTtl<T extends { expiresAt: number }>(obj: Record<string, T>, key: string): T | undefined {
+  const item = obj[key]
+  if (!item) { return undefined }
+  if (item.expiresAt < Date.now() / 1000) {
+    delete obj[key]
+    return undefined
+  }
+  return item
+}
+
+interface JsonStore {
+  authCodes: Record<string, AuthCodeData>
+  pendingAuths: Record<string, PendingAuthData>
+  pkceVerifiers: Record<string, { verifier: string; expiresAt: number }>
+  clients: Record<string, ClientRegistration>
+  refreshTokens: Record<string, RefreshTokenData>
+}
+
+function writeJsonStore(path: string, store: JsonStore) {
+  writeFileSync(path, JSON.stringify(store, null, 2), 'utf-8')
+}
+
+function readJsonStore(path: string): JsonStore {
+  if (!existsSync(path)) {
+    return {
+      authCodes: {},
+      pendingAuths: {},
+      pkceVerifiers: {},
+      clients: {},
+      refreshTokens: {}
+    }
+  }
+  const data = JSON.parse(readFileSync(path, 'utf-8'))
+  if (!data.refreshTokens) { data.refreshTokens = {} }
+  return data
+}
+
+export function createJsonStore(path: string): OAuthStore {
+  const store: JsonStore = readJsonStore(path)
+
+  return {
+    async saveAuthCode(code, data) {
+      store.authCodes[code] = data
+      writeJsonStore(path, store)
+    },
+    async getAuthCode(code) { return withTtl(store.authCodes, code) },
+    async deleteAuthCode(code) {
+      delete store.authCodes[code]
+      writeJsonStore(path, store)
+    },
+    async savePendingAuth(state, data) {
+      store.pendingAuths[state] = data
+      writeJsonStore(path, store)
+    },
+    async getPendingAuth(state) { return withTtl(store.pendingAuths, state) },
+    async deletePendingAuth(state) {
+      delete store.pendingAuths[state]
+      writeJsonStore(path, store)
+    },
+    async savePkceVerifier(state, verifier) {
+      store.pkceVerifiers[state] = { verifier, expiresAt: Date.now() / 1000 + 600 }
+      writeJsonStore(path, store)
+    },
+    async getPkceVerifier(state) {
+      const item = store.pkceVerifiers[state]
+      if (!item) { return undefined }
+      if (item.expiresAt < Date.now() / 1000) {
+        delete store.pkceVerifiers[state]
+        writeJsonStore(path, store)
+        return undefined
+      }
+      return item.verifier
+    },
+    async deletePkceVerifier(state) {
+      delete store.pkceVerifiers[state]
+      writeJsonStore(path, store)
+    },
+    async saveClient(clientId, data) {
+      store.clients[clientId] = data
+      writeJsonStore(path, store)
+    },
+    async getClient(clientId) { return store.clients[clientId] },
+
+    async saveRefreshToken(token, data) {
+      store.refreshTokens[token] = data
+      writeJsonStore(path, store)
+    },
+    async getRefreshToken(token) { return withTtl(store.refreshTokens, token) },
+    async deleteRefreshToken(token) {
+      delete store.refreshTokens[token]
+      writeJsonStore(path, store)
+    }
+  }
+}

package/src/store/memory-store.ts

@@ -0,0 +1,50 @@
+import { AuthCodeData, ClientRegistration, OAuthStore, PendingAuthData, RefreshTokenData } from '../provider/store.js'
+
+function withTtl<T extends { expiresAt: number }>(map: Map<string, T>, key: string): T | undefined {
+  const item = map.get(key)
+  if (!item) { return undefined }
+  if (item.expiresAt < Date.now() / 1000) {
+    map.delete(key)
+    return undefined
+  }
+  return item
+}
+
+export function createMemoryStore(): OAuthStore {
+  const authCodes = new Map<string, AuthCodeData>()
+  const pendingAuths = new Map<string, PendingAuthData>()
+  const pkceVerifiers = new Map<string, { verifier: string; expiresAt: number }>()
+  const clients = new Map<string, ClientRegistration>()
+  const refreshTokens = new Map<string, RefreshTokenData>()
+
+  return {
+    async saveAuthCode(code, data) { authCodes.set(code, data) },
+    async getAuthCode(code) { return withTtl(authCodes, code) },
+    async deleteAuthCode(code) { authCodes.delete(code) },
+
+    async savePendingAuth(state, data) { pendingAuths.set(state, data) },
+    async getPendingAuth(state) { return withTtl(pendingAuths, state) },
+    async deletePendingAuth(state) { pendingAuths.delete(state) },
+
+    async savePkceVerifier(state, verifier) {
+      pkceVerifiers.set(state, { verifier, expiresAt: Date.now() / 1000 + 600 })
+    },
+    async getPkceVerifier(state) {
+      const item = pkceVerifiers.get(state)
+      if (!item) { return undefined }
+      if (item.expiresAt < Date.now() / 1000) {
+        pkceVerifiers.delete(state)
+        return undefined
+      }
+      return item.verifier
+    },
+    async deletePkceVerifier(state) { pkceVerifiers.delete(state) },
+
+    async saveClient(clientId, data) { clients.set(clientId, data) },
+    async getClient(clientId) { return clients.get(clientId) },
+
+    async saveRefreshToken(token, data) { refreshTokens.set(token, data) },
+    async getRefreshToken(token) { return withTtl(refreshTokens, token) },
+    async deleteRefreshToken(token) { refreshTokens.delete(token) }
+  }
+}