@silkweave/auth 1.4.1 → 1.6.0

package/build/index.js

@@ -1,818 +0,0 @@
-// src/errors.ts
-var AuthError = class extends Error {
-  constructor(message, code, statusCode = 401) {
-    super(message);
-    this.code = code;
-    this.statusCode = statusCode;
-    this.name = "AuthError";
-  }
-  code;
-  statusCode;
-};
-function invalidToken(message = "Invalid token") {
-  return new AuthError(message, "invalid_token", 401);
-}
-function insufficientScope(message = "Insufficient scope") {
-  return new AuthError(message, "insufficient_scope", 403);
-}
-
-// src/extract.ts
-function extractBearerToken(header) {
-  if (!header) {
-    return null;
-  }
-  const match = /^Bearer\s+(.+)$/i.exec(header);
-  return match?.[1] ?? null;
-}
-function buildWWWAuthenticate(error, description, resourceMetadataUrl) {
-  const parts = [];
-  if (error) {
-    parts.push(`error="${error}"`);
-  }
-  if (description) {
-    parts.push(`error_description="${description}"`);
-  }
-  if (resourceMetadataUrl) {
-    parts.push(`resource_metadata="${resourceMetadataUrl}"`);
-  }
-  return parts.length > 0 ? `Bearer ${parts.join(", ")}` : "Bearer";
-}
-
-// src/metadata.ts
-function generateProtectedResourceMetadata(resourceUrl, authorizationServers) {
-  return {
-    resource: resourceUrl,
-    authorization_servers: authorizationServers,
-    bearer_methods_supported: ["header"]
-  };
-}
-
-// src/provider/proxy.ts
-import { randomBytes, randomUUID } from "crypto";
-import { SignJWT, jwtVerify } from "jose";
-
-// src/store/memory-store.ts
-function withTtl(map, key) {
-  const item = map.get(key);
-  if (!item) {
-    return void 0;
-  }
-  if (item.expiresAt < Date.now() / 1e3) {
-    map.delete(key);
-    return void 0;
-  }
-  return item;
-}
-function createMemoryStore() {
-  const authCodes = /* @__PURE__ */ new Map();
-  const pendingAuths = /* @__PURE__ */ new Map();
-  const pkceVerifiers = /* @__PURE__ */ new Map();
-  const clients = /* @__PURE__ */ new Map();
-  const refreshTokens = /* @__PURE__ */ new Map();
-  return {
-    async saveAuthCode(code, data) {
-      authCodes.set(code, data);
-    },
-    async getAuthCode(code) {
-      return withTtl(authCodes, code);
-    },
-    async deleteAuthCode(code) {
-      authCodes.delete(code);
-    },
-    async savePendingAuth(state, data) {
-      pendingAuths.set(state, data);
-    },
-    async getPendingAuth(state) {
-      return withTtl(pendingAuths, state);
-    },
-    async deletePendingAuth(state) {
-      pendingAuths.delete(state);
-    },
-    async savePkceVerifier(state, verifier) {
-      pkceVerifiers.set(state, { verifier, expiresAt: Date.now() / 1e3 + 600 });
-    },
-    async getPkceVerifier(state) {
-      const item = pkceVerifiers.get(state);
-      if (!item) {
-        return void 0;
-      }
-      if (item.expiresAt < Date.now() / 1e3) {
-        pkceVerifiers.delete(state);
-        return void 0;
-      }
-      return item.verifier;
-    },
-    async deletePkceVerifier(state) {
-      pkceVerifiers.delete(state);
-    },
-    async saveClient(clientId, data) {
-      clients.set(clientId, data);
-    },
-    async getClient(clientId) {
-      return clients.get(clientId);
-    },
-    async saveRefreshToken(token, data) {
-      refreshTokens.set(token, data);
-    },
-    async getRefreshToken(token) {
-      return withTtl(refreshTokens, token);
-    },
-    async deleteRefreshToken(token) {
-      refreshTokens.delete(token);
-    }
-  };
-}
-
-// src/provider/uri.ts
-function matchRedirectUri(uri, patterns) {
-  return patterns.some((pattern) => {
-    const regex = patternToRegex(pattern);
-    return regex.test(uri);
-  });
-}
-function patternToRegex(pattern) {
-  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`);
-}
-
-// src/provider/proxy.ts
-var CORS_HEADERS = {
-  "Access-Control-Allow-Origin": "*",
-  "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-  "Access-Control-Allow-Headers": "*"
-};
-function generateCode() {
-  return randomBytes(32).toString("base64url");
-}
-async function generatePkce() {
-  const verifier = randomBytes(32).toString("base64url");
-  const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-  const challenge = Buffer.from(hash).toString("base64url");
-  return { verifier, challenge };
-}
-async function verifyPkce(verifier, challenge) {
-  const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-  const computed = Buffer.from(hash).toString("base64url");
-  return computed === challenge;
-}
-function jsonResponse(status, body, headers = {}) {
-  return {
-    status,
-    headers: { "Content-Type": "application/json", ...CORS_HEADERS, ...headers },
-    body
-  };
-}
-function redirectResponse(url) {
-  return {
-    status: 302,
-    headers: { Location: url, ...CORS_HEADERS },
-    body: void 0
-  };
-}
-function errorResponse(status, error, description) {
-  return jsonResponse(status, { error, error_description: description });
-}
-async function signAccessToken(key, opts) {
-  const now = Math.floor(Date.now() / 1e3);
-  return new SignJWT({ scope: opts.scopes.join(" "), email: opts.email }).setProtectedHeader({ alg: "HS256" }).setSubject(opts.sub ?? opts.email ?? opts.clientId).setIssuer(opts.issuer).setAudience(opts.issuer).setIssuedAt(now).setExpirationTime(now + opts.ttl).sign(key);
-}
-async function handleRegister(req, store, allowedRedirectUris) {
-  const body = req.body;
-  if (!body) {
-    return errorResponse(400, "invalid_request", "Missing request body");
-  }
-  const redirectUris = body.redirect_uris;
-  if (!redirectUris) {
-    return errorResponse(400, "invalid_request", "redirect_uris is required");
-  }
-  let uris;
-  try {
-    uris = typeof redirectUris === "string" ? JSON.parse(redirectUris) : redirectUris;
-  } catch {
-    uris = [redirectUris];
-  }
-  if (!Array.isArray(uris) || uris.length === 0) {
-    return errorResponse(400, "invalid_request", "redirect_uris must be a non-empty array");
-  }
-  for (const uri of uris) {
-    if (!matchRedirectUri(uri, allowedRedirectUris)) {
-      return errorResponse(400, "invalid_redirect_uri", `Redirect URI not allowed: ${uri}`);
-    }
-  }
-  const clientId = randomUUID();
-  const clientSecret = randomBytes(32).toString("base64url");
-  const registration = {
-    clientId,
-    clientSecret,
-    redirectUris: uris,
-    clientName: body.client_name,
-    createdAt: Date.now() / 1e3
-  };
-  await store.saveClient(clientId, registration);
-  return jsonResponse(201, {
-    client_id: clientId,
-    client_secret: clientSecret,
-    redirect_uris: uris,
-    client_name: body.client_name,
-    token_endpoint_auth_method: "none"
-  });
-}
-async function resolveClient(clientId, store, allowedRedirectUris) {
-  const existing = await store.getClient(clientId);
-  if (existing) {
-    return existing;
-  }
-  if (!clientId.startsWith("https://")) {
-    return errorResponse(400, "invalid_client", "Unknown client_id");
-  }
-  try {
-    const metaRes = await fetch(clientId);
-    if (!metaRes.ok) {
-      return errorResponse(400, "invalid_client", "Failed to fetch client metadata document");
-    }
-    const meta = await metaRes.json();
-    const metaRedirectUris = meta.redirect_uris;
-    if (!Array.isArray(metaRedirectUris) || metaRedirectUris.length === 0) {
-      return errorResponse(400, "invalid_client", "Client metadata must include redirect_uris");
-    }
-    for (const uri of metaRedirectUris) {
-      if (!matchRedirectUri(uri, allowedRedirectUris)) {
-        return errorResponse(400, "invalid_redirect_uri", `Redirect URI not allowed: ${uri}`);
-      }
-    }
-    const client = {
-      clientId,
-      clientSecret: "",
-      redirectUris: metaRedirectUris,
-      clientName: meta.client_name,
-      createdAt: Date.now() / 1e3
-    };
-    await store.saveClient(clientId, client);
-    return client;
-  } catch {
-    return errorResponse(400, "invalid_client", "Failed to fetch client metadata document");
-  }
-}
-async function exchangeUpstreamCode(code, config, callbackPath, pkceVerifier) {
-  const tokenBody = new URLSearchParams({
-    grant_type: "authorization_code",
-    code,
-    redirect_uri: `${config.resourceUrl}${callbackPath}`,
-    client_id: config.clientId,
-    client_secret: config.clientSecret,
-    code_verifier: pkceVerifier
-  });
-  const tokenResponse = await fetch(config.tokenUrl, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: tokenBody.toString()
-  });
-  if (!tokenResponse.ok) {
-    const errorBody = await tokenResponse.text();
-    console.error("Upstream token exchange failed:", errorBody);
-    return errorResponse(502, "upstream_error", "Failed to exchange code with upstream provider");
-  }
-  const tokens = await tokenResponse.json();
-  return {
-    accessToken: tokens.access_token,
-    idToken: tokens.id_token
-  };
-}
-async function fetchUserinfo(userinfoUrl, accessToken) {
-  if (!userinfoUrl || !accessToken) {
-    return {};
-  }
-  try {
-    const res = await fetch(userinfoUrl, {
-      headers: { Authorization: `Bearer ${accessToken}` }
-    });
-    if (res.ok) {
-      const userinfo = await res.json();
-      return { email: userinfo.email, sub: userinfo.sub };
-    }
-  } catch {
-  }
-  return {};
-}
-async function handleRefreshToken(body, store, getSigningKey, config) {
-  const refreshToken = body.refresh_token;
-  if (!refreshToken) {
-    return errorResponse(400, "invalid_request", "Missing refresh_token");
-  }
-  const tokenData = await store.getRefreshToken(refreshToken);
-  if (!tokenData) {
-    return errorResponse(400, "invalid_grant", "Invalid or expired refresh token");
-  }
-  const key = await getSigningKey();
-  const accessToken = await signAccessToken(key, {
-    scopes: tokenData.scopes,
-    email: tokenData.email,
-    sub: tokenData.sub,
-    clientId: tokenData.clientId,
-    issuer: config.resourceUrl,
-    ttl: config.tokenTtl
-  });
-  return jsonResponse(200, {
-    access_token: accessToken,
-    token_type: "Bearer",
-    expires_in: config.tokenTtl,
-    scope: tokenData.scopes.join(" "),
-    refresh_token: refreshToken
-  });
-}
-async function handleAuthorizationCode(body, store, getSigningKey, config) {
-  const code = body.code;
-  const redirectUri = body.redirect_uri;
-  const clientId = body.client_id;
-  const codeVerifier = body.code_verifier;
-  if (!code || !codeVerifier || !clientId) {
-    return errorResponse(400, "invalid_request", "Missing required parameters");
-  }
-  const authCode = await store.getAuthCode(code);
-  if (!authCode) {
-    return errorResponse(400, "invalid_grant", "Invalid or expired authorization code");
-  }
-  await store.deleteAuthCode(code);
-  if (authCode.clientId !== clientId) {
-    return errorResponse(400, "invalid_grant", "client_id mismatch");
-  }
-  if (redirectUri && authCode.redirectUri !== redirectUri) {
-    return errorResponse(400, "invalid_grant", "redirect_uri mismatch");
-  }
-  const pkceValid = await verifyPkce(codeVerifier, authCode.codeChallenge);
-  if (!pkceValid) {
-    return errorResponse(400, "invalid_grant", "PKCE verification failed");
-  }
-  const key = await getSigningKey();
-  const accessToken = await signAccessToken(key, {
-    scopes: authCode.scopes,
-    email: authCode.email,
-    sub: authCode.sub,
-    clientId: authCode.clientId,
-    issuer: config.resourceUrl,
-    ttl: config.tokenTtl
-  });
-  const refreshToken = randomBytes(32).toString("base64url");
-  await store.saveRefreshToken(refreshToken, {
-    clientId: authCode.clientId,
-    scopes: authCode.scopes,
-    email: authCode.email,
-    sub: authCode.sub,
-    expiresAt: Math.floor(Date.now() / 1e3) + 30 * 24 * 3600
-  });
-  return jsonResponse(200, {
-    access_token: accessToken,
-    token_type: "Bearer",
-    expires_in: config.tokenTtl,
-    scope: authCode.scopes.join(" "),
-    refresh_token: refreshToken
-  });
-}
-function createOAuthProxy(config) {
-  const store = config.store ?? createMemoryStore();
-  const callbackPath = config.callbackPath ?? "/auth/callback";
-  const tokenTtl = config.tokenTtl ?? 3600;
-  const scopes = config.requiredScopes ?? [];
-  let signingKey = null;
-  async function getSigningKey() {
-    if (signingKey) {
-      return signingKey;
-    }
-    if (config.signingKey) {
-      signingKey = new TextEncoder().encode(config.signingKey);
-    } else {
-      signingKey = randomBytes(32);
-    }
-    return signingKey;
-  }
-  return {
-    metadata() {
-      return jsonResponse(200, {
-        issuer: config.resourceUrl,
-        authorization_endpoint: `${config.resourceUrl}/authorize`,
-        token_endpoint: `${config.resourceUrl}/token`,
-        registration_endpoint: `${config.resourceUrl}/register`,
-        response_types_supported: ["code"],
-        grant_types_supported: ["authorization_code", "refresh_token"],
-        code_challenge_methods_supported: ["S256"],
-        token_endpoint_auth_methods_supported: ["none", "client_secret_post"],
-        scopes_supported: scopes
-      }, { "Cache-Control": "max-age=3600" });
-    },
-    register(req) {
-      return handleRegister(req, store, config.redirectUris);
-    },
-    async authorize(req) {
-      const params = req.url.searchParams;
-      const responseType = params.get("response_type");
-      const clientId = params.get("client_id");
-      const redirectUri = params.get("redirect_uri");
-      const scope = params.get("scope") ?? "";
-      const clientState = params.get("state") ?? "";
-      const codeChallenge = params.get("code_challenge");
-      const codeChallengeMethod = params.get("code_challenge_method");
-      const resource = params.get("resource");
-      if (responseType !== "code") {
-        return errorResponse(400, "unsupported_response_type", "Only response_type=code is supported");
-      }
-      if (!clientId) {
-        return errorResponse(400, "invalid_request", "client_id is required");
-      }
-      if (!redirectUri) {
-        return errorResponse(400, "invalid_request", "redirect_uri is required");
-      }
-      if (!codeChallenge || codeChallengeMethod !== "S256") {
-        return errorResponse(400, "invalid_request", "PKCE with S256 is required");
-      }
-      const result = await resolveClient(clientId, store, config.redirectUris);
-      if ("status" in result) {
-        return result;
-      }
-      const client = result;
-      if (!client.redirectUris.includes(redirectUri)) {
-        return errorResponse(400, "invalid_redirect_uri", "redirect_uri does not match registered URIs");
-      }
-      const proxyState = randomUUID();
-      const pkce = await generatePkce();
-      await store.savePendingAuth(proxyState, {
-        clientId,
-        redirectUri,
-        codeChallenge,
-        codeChallengeMethod,
-        scope,
-        clientState,
-        resource: resource ?? void 0,
-        expiresAt: Date.now() / 1e3 + 600
-      });
-      await store.savePkceVerifier(proxyState, pkce.verifier);
-      const upstreamScopes = scopes.length > 0 ? scopes.join(" ") : scope;
-      const upstreamUrl = new URL(config.authorizeUrl);
-      upstreamUrl.searchParams.set("response_type", "code");
-      upstreamUrl.searchParams.set("client_id", config.clientId);
-      upstreamUrl.searchParams.set("redirect_uri", `${config.resourceUrl}${callbackPath}`);
-      upstreamUrl.searchParams.set("scope", upstreamScopes);
-      upstreamUrl.searchParams.set("state", proxyState);
-      upstreamUrl.searchParams.set("code_challenge", pkce.challenge);
-      upstreamUrl.searchParams.set("code_challenge_method", "S256");
-      if (params.has("access_type")) {
-        upstreamUrl.searchParams.set("access_type", params.get("access_type"));
-      }
-      return redirectResponse(upstreamUrl.toString());
-    },
-    async callback(req) {
-      const params = req.url.searchParams;
-      const upstreamCode = params.get("code");
-      const proxyState = params.get("state");
-      const upstreamError = params.get("error");
-      if (upstreamError) {
-        return errorResponse(400, "upstream_error", params.get("error_description") ?? upstreamError);
-      }
-      if (!upstreamCode || !proxyState) {
-        return errorResponse(400, "invalid_request", "Missing code or state");
-      }
-      const pending = await store.getPendingAuth(proxyState);
-      if (!pending) {
-        return errorResponse(400, "invalid_request", "Unknown or expired state");
-      }
-      const pkceVerifier = await store.getPkceVerifier(proxyState);
-      if (!pkceVerifier) {
-        return errorResponse(400, "invalid_request", "Missing PKCE verifier");
-      }
-      await store.deletePendingAuth(proxyState);
-      await store.deletePkceVerifier(proxyState);
-      const upstream = await exchangeUpstreamCode(upstreamCode, config, callbackPath, pkceVerifier);
-      if ("status" in upstream) {
-        return upstream;
-      }
-      const userinfo = await fetchUserinfo(config.userinfoUrl, upstream.accessToken);
-      const mcpCode = generateCode();
-      await store.saveAuthCode(mcpCode, {
-        clientId: pending.clientId,
-        redirectUri: pending.redirectUri,
-        codeChallenge: pending.codeChallenge,
-        codeChallengeMethod: pending.codeChallengeMethod,
-        scopes: pending.scope.split(" ").filter(Boolean),
-        upstreamAccessToken: upstream.accessToken,
-        upstreamIdToken: upstream.idToken,
-        email: userinfo.email,
-        sub: userinfo.sub,
-        expiresAt: Date.now() / 1e3 + 600
-      });
-      const clientRedirect = new URL(pending.redirectUri);
-      clientRedirect.searchParams.set("code", mcpCode);
-      if (pending.clientState) {
-        clientRedirect.searchParams.set("state", pending.clientState);
-      }
-      return redirectResponse(clientRedirect.toString());
-    },
-    async token(req) {
-      const body = req.body;
-      if (!body) {
-        return errorResponse(400, "invalid_request", "Missing request body");
-      }
-      const tokenConfig = { resourceUrl: config.resourceUrl, tokenTtl };
-      if (body.grant_type === "refresh_token") {
-        return handleRefreshToken(body, store, getSigningKey, tokenConfig);
-      }
-      if (body.grant_type !== "authorization_code") {
-        return errorResponse(400, "unsupported_grant_type", "Supported grant types: authorization_code, refresh_token");
-      }
-      return handleAuthorizationCode(body, store, getSigningKey, tokenConfig);
-    },
-    async verifyToken(token) {
-      try {
-        const key = await getSigningKey();
-        const { payload } = await jwtVerify(token, key, {
-          issuer: config.resourceUrl,
-          audience: config.resourceUrl
-        });
-        return {
-          token,
-          clientId: payload.sub ?? void 0,
-          scopes: typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : [],
-          expiresAt: payload.exp,
-          email: payload.email
-        };
-      } catch {
-        return void 0;
-      }
-    }
-  };
-}
-
-// src/provider/google.ts
-function google(options) {
-  const provider = createOAuthProxy({
-    authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-    tokenUrl: "https://oauth2.googleapis.com/token",
-    userinfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
-    clientId: options.clientId,
-    clientSecret: options.clientSecret,
-    resourceUrl: options.resourceUrl,
-    redirectUris: options.redirectUris,
-    requiredScopes: options.requiredScopes ?? ["openid", "email"],
-    callbackPath: options.callbackPath,
-    signingKey: options.signingKey,
-    tokenTtl: options.tokenTtl,
-    store: options.store
-  });
-  return {
-    verifyToken: (token) => provider.verifyToken(token),
-    required: true,
-    resourceUrl: options.resourceUrl,
-    authorizationServers: [options.resourceUrl],
-    provider,
-    callbackPath: options.callbackPath ?? "/auth/callback"
-  };
-}
-
-// src/store/json-store.ts
-import { existsSync, readFileSync, writeFileSync } from "fs";
-function withTtl2(obj, key) {
-  const item = obj[key];
-  if (!item) {
-    return void 0;
-  }
-  if (item.expiresAt < Date.now() / 1e3) {
-    delete obj[key];
-    return void 0;
-  }
-  return item;
-}
-function writeJsonStore(path, store) {
-  writeFileSync(path, JSON.stringify(store, null, 2), "utf-8");
-}
-function readJsonStore(path) {
-  if (!existsSync(path)) {
-    return {
-      authCodes: {},
-      pendingAuths: {},
-      pkceVerifiers: {},
-      clients: {},
-      refreshTokens: {}
-    };
-  }
-  const data = JSON.parse(readFileSync(path, "utf-8"));
-  if (!data.refreshTokens) {
-    data.refreshTokens = {};
-  }
-  return data;
-}
-function createJsonStore(path) {
-  const store = readJsonStore(path);
-  return {
-    async saveAuthCode(code, data) {
-      store.authCodes[code] = data;
-      writeJsonStore(path, store);
-    },
-    async getAuthCode(code) {
-      return withTtl2(store.authCodes, code);
-    },
-    async deleteAuthCode(code) {
-      delete store.authCodes[code];
-      writeJsonStore(path, store);
-    },
-    async savePendingAuth(state, data) {
-      store.pendingAuths[state] = data;
-      writeJsonStore(path, store);
-    },
-    async getPendingAuth(state) {
-      return withTtl2(store.pendingAuths, state);
-    },
-    async deletePendingAuth(state) {
-      delete store.pendingAuths[state];
-      writeJsonStore(path, store);
-    },
-    async savePkceVerifier(state, verifier) {
-      store.pkceVerifiers[state] = { verifier, expiresAt: Date.now() / 1e3 + 600 };
-      writeJsonStore(path, store);
-    },
-    async getPkceVerifier(state) {
-      const item = store.pkceVerifiers[state];
-      if (!item) {
-        return void 0;
-      }
-      if (item.expiresAt < Date.now() / 1e3) {
-        delete store.pkceVerifiers[state];
-        writeJsonStore(path, store);
-        return void 0;
-      }
-      return item.verifier;
-    },
-    async deletePkceVerifier(state) {
-      delete store.pkceVerifiers[state];
-      writeJsonStore(path, store);
-    },
-    async saveClient(clientId, data) {
-      store.clients[clientId] = data;
-      writeJsonStore(path, store);
-    },
-    async getClient(clientId) {
-      return store.clients[clientId];
-    },
-    async saveRefreshToken(token, data) {
-      store.refreshTokens[token] = data;
-      writeJsonStore(path, store);
-    },
-    async getRefreshToken(token) {
-      return withTtl2(store.refreshTokens, token);
-    },
-    async deleteRefreshToken(token) {
-      delete store.refreshTokens[token];
-      writeJsonStore(path, store);
-    }
-  };
-}
-
-// src/store/redis-store.ts
-function createRedisStore(options) {
-  const { client, prefix = "silkweave:oauth:" } = options;
-  function key(namespace, id) {
-    return `${prefix}${namespace}:${id}`;
-  }
-  function ttlFromExpiry(expiresAt) {
-    const seconds = Math.floor(expiresAt - Date.now() / 1e3);
-    return seconds > 0 ? seconds : void 0;
-  }
-  async function save(namespace, id, data, expiresAt) {
-    const opts = {};
-    const ttl = expiresAt != null ? ttlFromExpiry(expiresAt) : void 0;
-    if (ttl != null) {
-      opts.ex = ttl;
-    }
-    await client.set(key(namespace, id), JSON.stringify(data), opts);
-  }
-  async function load(namespace, id) {
-    const raw = await client.get(key(namespace, id));
-    if (raw == null) {
-      return void 0;
-    }
-    return typeof raw === "string" ? JSON.parse(raw) : raw;
-  }
-  async function remove(namespace, id) {
-    await client.del(key(namespace, id));
-  }
-  return {
-    async saveAuthCode(code, data) {
-      await save("auth-code", code, data, data.expiresAt);
-    },
-    async getAuthCode(code) {
-      return load("auth-code", code);
-    },
-    async deleteAuthCode(code) {
-      await remove("auth-code", code);
-    },
-    async savePendingAuth(state, data) {
-      await save("pending-auth", state, data, data.expiresAt);
-    },
-    async getPendingAuth(state) {
-      return load("pending-auth", state);
-    },
-    async deletePendingAuth(state) {
-      await remove("pending-auth", state);
-    },
-    async savePkceVerifier(state, verifier) {
-      const expiresAt = Date.now() / 1e3 + 600;
-      await save("pkce-verifier", state, { verifier, expiresAt }, expiresAt);
-    },
-    async getPkceVerifier(state) {
-      const item = await load("pkce-verifier", state);
-      return item?.verifier;
-    },
-    async deletePkceVerifier(state) {
-      await remove("pkce-verifier", state);
-    },
-    async saveClient(clientId, data) {
-      await save("client", clientId, data);
-    },
-    async getClient(clientId) {
-      return load("client", clientId);
-    },
-    async saveRefreshToken(token, data) {
-      await save("refresh-token", token, data, data.expiresAt);
-    },
-    async getRefreshToken(token) {
-      return load("refresh-token", token);
-    },
-    async deleteRefreshToken(token) {
-      await remove("refresh-token", token);
-    }
-  };
-}
-
-// src/validate.ts
-async function validateToken(authorizationHeader, config, context) {
-  const required = config.required ?? true;
-  const resourceMetadataUrl = config.resourceUrl ? `${config.resourceUrl}/.well-known/oauth-protected-resource` : void 0;
-  const token = extractBearerToken(authorizationHeader);
-  if (!token) {
-    if (!required) {
-      return {};
-    }
-    return buildChallengeResult(resourceMetadataUrl);
-  }
-  let authInfo;
-  try {
-    authInfo = await config.verifyToken(token, context);
-  } catch (_e) {
-    const err = invalidToken();
-    return buildErrorResult(err, resourceMetadataUrl);
-  }
-  if (!authInfo) {
-    const err = invalidToken();
-    return buildErrorResult(err, resourceMetadataUrl);
-  }
-  if (authInfo.expiresAt && authInfo.expiresAt < Date.now() / 1e3) {
-    const err = invalidToken("Token has expired");
-    return buildErrorResult(err, resourceMetadataUrl);
-  }
-  if (config.requiredScopes?.length) {
-    const scopes = authInfo.scopes ?? [];
-    const hasAll = config.requiredScopes.every((s) => scopes.includes(s));
-    if (!hasAll) {
-      const err = insufficientScope();
-      return buildErrorResult(err, resourceMetadataUrl);
-    }
-  }
-  return { auth: authInfo };
-}
-function buildChallengeResult(resourceMetadataUrl) {
-  return {
-    error: {
-      statusCode: 401,
-      headers: {
-        "WWW-Authenticate": buildWWWAuthenticate(void 0, void 0, resourceMetadataUrl),
-        "Content-Type": "application/json"
-      },
-      body: { error: "missing_token", error_description: "No authorization provided" }
-    }
-  };
-}
-function buildErrorResult(err, resourceMetadataUrl) {
-  return {
-    error: {
-      statusCode: err.statusCode,
-      headers: {
-        "WWW-Authenticate": buildWWWAuthenticate(err.code, err.message, resourceMetadataUrl),
-        "Content-Type": "application/json"
-      },
-      body: { error: err.code, error_description: err.message }
-    }
-  };
-}
-export {
-  AuthError,
-  buildWWWAuthenticate,
-  createJsonStore,
-  createMemoryStore,
-  createOAuthProxy,
-  createRedisStore,
-  extractBearerToken,
-  generateProtectedResourceMetadata,
-  google,
-  insufficientScope,
-  invalidToken,
-  matchRedirectUri,
-  validateToken
-};
-//# sourceMappingURL=index.js.map