@silkweave/auth 2.6.0 → 3.0.0

package/build/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["withTtl","client"],"sources":["../src/errors.ts","../src/extract.ts","../src/metadata.ts","../src/store/memory-store.ts","../src/provider/uri.ts","../src/provider/proxy.ts","../src/provider/google.ts","../src/store/json-store.ts","../src/store/redis-store.ts","../src/validate.ts"],"sourcesContent":["export class AuthError extends Error {\n  constructor(\n    message: string,\n    public readonly code: string,\n    public readonly statusCode = 401\n  ) {\n    super(message)\n    this.name = 'AuthError'\n  }\n}\n\nexport function invalidToken(message = 'Invalid token') {\n  return new AuthError(message, 'invalid_token', 401)\n}\n\nexport function insufficientScope(message = 'Insufficient scope') {\n  return new AuthError(message, 'insufficient_scope', 403)\n}\n","export function extractBearerToken(header: string | null | undefined): string | null {\n  if (!header) { return null }\n  const match = /^Bearer\\s+(.+)$/i.exec(header)\n  return match?.[1] ?? null\n}\n\nexport function buildWWWAuthenticate(\n  error?: string,\n  description?: string,\n  resourceMetadataUrl?: string\n): string {\n  const parts: string[] = []\n  if (error) {\n    parts.push(`error=\"${error}\"`)\n  }\n  if (description) {\n    parts.push(`error_description=\"${description}\"`)\n  }\n  if (resourceMetadataUrl) {\n    parts.push(`resource_metadata=\"${resourceMetadataUrl}\"`)\n  }\n  return parts.length > 0 ? `Bearer ${parts.join(', ')}` : 'Bearer'\n}\n","export interface ProtectedResourceMetadata {\n  resource: string\n  authorization_servers: string[]\n  scopes_supported?: string[]\n  bearer_methods_supported?: string[]\n}\n\nexport function generateProtectedResourceMetadata(\n  resourceUrl: string,\n  authorizationServers: string[]\n): ProtectedResourceMetadata {\n  return {\n    resource: resourceUrl,\n    authorization_servers: authorizationServers,\n    bearer_methods_supported: ['header']\n  }\n}\n","import { AuthCodeData, ClientRegistration, OAuthStore, PendingAuthData, RefreshTokenData } from '../provider/store.js'\n\nfunction withTtl<T extends { expiresAt: number }>(map: Map<string, T>, key: string): T | undefined {\n  const item = map.get(key)\n  if (!item) { return undefined }\n  if (item.expiresAt < Date.now() / 1000) {\n    map.delete(key)\n    return undefined\n  }\n  return item\n}\n\nexport function createMemoryStore(): OAuthStore {\n  const authCodes = new Map<string, AuthCodeData>()\n  const pendingAuths = new Map<string, PendingAuthData>()\n  const pkceVerifiers = new Map<string, { verifier: string; expiresAt: number }>()\n  const clients = new Map<string, ClientRegistration>()\n  const refreshTokens = new Map<string, RefreshTokenData>()\n\n  return {\n    async saveAuthCode(code, data) { authCodes.set(code, data) },\n    async getAuthCode(code) { return withTtl(authCodes, code) },\n    async deleteAuthCode(code) { authCodes.delete(code) },\n\n    async savePendingAuth(state, data) { pendingAuths.set(state, data) },\n    async getPendingAuth(state) { return withTtl(pendingAuths, state) },\n    async deletePendingAuth(state) { pendingAuths.delete(state) },\n\n    async savePkceVerifier(state, verifier) {\n      pkceVerifiers.set(state, { verifier, expiresAt: Date.now() / 1000 + 600 })\n    },\n    async getPkceVerifier(state) {\n      const item = pkceVerifiers.get(state)\n      if (!item) { return undefined }\n      if (item.expiresAt < Date.now() / 1000) {\n        pkceVerifiers.delete(state)\n        return undefined\n      }\n      return item.verifier\n    },\n    async deletePkceVerifier(state) { pkceVerifiers.delete(state) },\n\n    async saveClient(clientId, data) { clients.set(clientId, data) },\n    async getClient(clientId) { return clients.get(clientId) },\n\n    async saveRefreshToken(token, data) { refreshTokens.set(token, data) },\n    async getRefreshToken(token) { return withTtl(refreshTokens, token) },\n    async deleteRefreshToken(token) { refreshTokens.delete(token) }\n  }\n}\n","export function matchRedirectUri(uri: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => {\n    const regex = patternToRegex(pattern)\n    return regex.test(uri)\n  })\n}\n\nfunction patternToRegex(pattern: string): RegExp {\n  const escaped = pattern\n    .replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&')\n    .replace(/\\*/g, '.*')\n  return new RegExp(`^${escaped}$`)\n}\n","import { randomBytes, randomUUID } from 'crypto'\nimport { SignJWT, jwtVerify } from 'jose'\nimport { createMemoryStore } from '../store/memory-store.js'\nimport { OAuthStore } from './store.js'\nimport { AuthInfo, OAuthProvider, OAuthResponse } from './types.js'\nimport { matchRedirectUri } from './uri.js'\n\nexport interface OAuthProxyConfig {\n  authorizeUrl: string\n  tokenUrl: string\n  userinfoUrl?: string\n  clientId: string\n  clientSecret: string\n  resourceUrl: string\n  redirectUris: string[]\n  requiredScopes?: string[]\n  callbackPath?: string\n  signingKey?: string\n  tokenTtl?: number\n  store?: OAuthStore\n}\n\nconst CORS_HEADERS: Record<string, string> = {\n  'Access-Control-Allow-Origin': '*',\n  'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',\n  'Access-Control-Allow-Headers': '*'\n}\n\nfunction generateCode(): string {\n  return randomBytes(32).toString('base64url')\n}\n\nasync function generatePkce(): Promise<{ verifier: string; challenge: string }> {\n  const verifier = randomBytes(32).toString('base64url')\n  const hash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))\n  const challenge = Buffer.from(hash).toString('base64url')\n  return { verifier, challenge }\n}\n\nasync function verifyPkce(verifier: string, challenge: string): Promise<boolean> {\n  const hash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))\n  const computed = Buffer.from(hash).toString('base64url')\n  return computed === challenge\n}\n\nfunction jsonResponse(status: number, body: Record<string, unknown>, headers: Record<string, string> = {}): OAuthResponse {\n  return {\n    status,\n    headers: { 'Content-Type': 'application/json', ...CORS_HEADERS, ...headers },\n    body\n  }\n}\n\nfunction redirectResponse(url: string): OAuthResponse {\n  return {\n    status: 302,\n    headers: { Location: url, ...CORS_HEADERS },\n    body: undefined\n  }\n}\n\nfunction errorResponse(status: number, error: string, description: string): OAuthResponse {\n  return jsonResponse(status, { error, error_description: description })\n}\n\nasync function signAccessToken(\n  key: Uint8Array,\n  opts: { scopes: string[]; email?: string; sub?: string; clientId: string; issuer: string; ttl: number }\n): Promise<string> {\n  const now = Math.floor(Date.now() / 1000)\n  return new SignJWT({ scope: opts.scopes.join(' '), email: opts.email })\n    .setProtectedHeader({ alg: 'HS256' })\n    .setSubject(opts.sub ?? opts.email ?? opts.clientId)\n    .setIssuer(opts.issuer)\n    .setAudience(opts.issuer)\n    .setIssuedAt(now)\n    .setExpirationTime(now + opts.ttl)\n    .sign(key)\n}\n\nasync function handleRegister(\n  req: { body?: Record<string, string> },\n  store: OAuthStore,\n  allowedRedirectUris: string[]\n): Promise<OAuthResponse> {\n  const body = req.body\n  if (!body) { return errorResponse(400, 'invalid_request', 'Missing request body') }\n\n  const redirectUris = body.redirect_uris\n  if (!redirectUris) { return errorResponse(400, 'invalid_request', 'redirect_uris is required') }\n\n  let uris: string[]\n  try {\n    uris = typeof redirectUris === 'string' ? JSON.parse(redirectUris) : redirectUris\n  } catch {\n    uris = [redirectUris]\n  }\n\n  if (!Array.isArray(uris) || uris.length === 0) {\n    return errorResponse(400, 'invalid_request', 'redirect_uris must be a non-empty array')\n  }\n\n  for (const uri of uris) {\n    if (!matchRedirectUri(uri, allowedRedirectUris)) {\n      return errorResponse(400, 'invalid_redirect_uri', `Redirect URI not allowed: ${uri}`)\n    }\n  }\n\n  const clientId = randomUUID()\n  const clientSecret = randomBytes(32).toString('base64url')\n  const registration = {\n    clientId,\n    clientSecret,\n    redirectUris: uris,\n    clientName: body.client_name,\n    createdAt: Date.now() / 1000\n  }\n\n  await store.saveClient(clientId, registration)\n\n  return jsonResponse(201, {\n    client_id: clientId,\n    client_secret: clientSecret,\n    redirect_uris: uris,\n    client_name: body.client_name,\n    token_endpoint_auth_method: 'none'\n  })\n}\n\nasync function resolveClient(\n  clientId: string,\n  store: OAuthStore,\n  allowedRedirectUris: string[]\n): Promise<{ clientId: string; clientSecret: string; redirectUris: string[]; clientName?: string; createdAt: number } | OAuthResponse> {\n  const existing = await store.getClient(clientId)\n  if (existing) { return existing }\n\n  if (!clientId.startsWith('https://')) {\n    return errorResponse(400, 'invalid_client', 'Unknown client_id')\n  }\n\n  try {\n    const metaRes = await fetch(clientId)\n    if (!metaRes.ok) {\n      return errorResponse(400, 'invalid_client', 'Failed to fetch client metadata document')\n    }\n    const meta = await metaRes.json() as Record<string, unknown>\n    const metaRedirectUris = meta.redirect_uris as string[] | undefined\n    if (!Array.isArray(metaRedirectUris) || metaRedirectUris.length === 0) {\n      return errorResponse(400, 'invalid_client', 'Client metadata must include redirect_uris')\n    }\n    for (const uri of metaRedirectUris) {\n      if (!matchRedirectUri(uri, allowedRedirectUris)) {\n        return errorResponse(400, 'invalid_redirect_uri', `Redirect URI not allowed: ${uri}`)\n      }\n    }\n    const client = {\n      clientId,\n      clientSecret: '',\n      redirectUris: metaRedirectUris,\n      clientName: meta.client_name as string | undefined,\n      createdAt: Date.now() / 1000\n    }\n    await store.saveClient(clientId, client)\n    return client\n  } catch {\n    return errorResponse(400, 'invalid_client', 'Failed to fetch client metadata document')\n  }\n}\n\nasync function exchangeUpstreamCode(\n  code: string,\n  config: OAuthProxyConfig,\n  callbackPath: string,\n  pkceVerifier: string\n): Promise<{ accessToken: string; idToken?: string } | OAuthResponse> {\n  const tokenBody = new URLSearchParams({\n    grant_type: 'authorization_code',\n    code,\n    redirect_uri: `${config.resourceUrl}${callbackPath}`,\n    client_id: config.clientId,\n    client_secret: config.clientSecret,\n    code_verifier: pkceVerifier\n  })\n\n  const tokenResponse = await fetch(config.tokenUrl, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: tokenBody.toString()\n  })\n\n  if (!tokenResponse.ok) {\n    const errorBody = await tokenResponse.text()\n    console.error('Upstream token exchange failed:', errorBody)\n    return errorResponse(502, 'upstream_error', 'Failed to exchange code with upstream provider')\n  }\n\n  const tokens = await tokenResponse.json() as Record<string, unknown>\n  return {\n    accessToken: tokens.access_token as string,\n    idToken: tokens.id_token as string | undefined\n  }\n}\n\nasync function fetchUserinfo(\n  userinfoUrl: string | undefined,\n  accessToken: string\n): Promise<{ email?: string; sub?: string }> {\n  if (!userinfoUrl || !accessToken) { return {} }\n  try {\n    const res = await fetch(userinfoUrl, {\n      headers: { Authorization: `Bearer ${accessToken}` }\n    })\n    if (res.ok) {\n      const userinfo = await res.json() as Record<string, unknown>\n      return { email: userinfo.email as string | undefined, sub: userinfo.sub as string | undefined }\n    }\n  } catch {\n    // Userinfo fetch is best-effort\n  }\n  return {}\n}\n\nasync function handleRefreshToken(\n  body: Record<string, string>,\n  store: OAuthStore,\n  getSigningKey: () => Promise<Uint8Array>,\n  config: { resourceUrl: string; tokenTtl: number }\n): Promise<OAuthResponse> {\n  const refreshToken = body.refresh_token\n  if (!refreshToken) {\n    return errorResponse(400, 'invalid_request', 'Missing refresh_token')\n  }\n\n  const tokenData = await store.getRefreshToken(refreshToken)\n  if (!tokenData) {\n    return errorResponse(400, 'invalid_grant', 'Invalid or expired refresh token')\n  }\n\n  const key = await getSigningKey()\n  const accessToken = await signAccessToken(key, {\n    scopes: tokenData.scopes,\n    email: tokenData.email,\n    sub: tokenData.sub,\n    clientId: tokenData.clientId,\n    issuer: config.resourceUrl,\n    ttl: config.tokenTtl\n  })\n\n  return jsonResponse(200, {\n    access_token: accessToken,\n    token_type: 'Bearer',\n    expires_in: config.tokenTtl,\n    scope: tokenData.scopes.join(' '),\n    refresh_token: refreshToken\n  })\n}\n\nasync function handleAuthorizationCode(\n  body: Record<string, string>,\n  store: OAuthStore,\n  getSigningKey: () => Promise<Uint8Array>,\n  config: { resourceUrl: string; tokenTtl: number }\n): Promise<OAuthResponse> {\n  const code = body.code\n  const redirectUri = body.redirect_uri\n  const clientId = body.client_id\n  const codeVerifier = body.code_verifier\n\n  if (!code || !codeVerifier || !clientId) {\n    return errorResponse(400, 'invalid_request', 'Missing required parameters')\n  }\n\n  const authCode = await store.getAuthCode(code)\n  if (!authCode) { return errorResponse(400, 'invalid_grant', 'Invalid or expired authorization code') }\n\n  await store.deleteAuthCode(code)\n\n  if (authCode.clientId !== clientId) {\n    return errorResponse(400, 'invalid_grant', 'client_id mismatch')\n  }\n  if (redirectUri && authCode.redirectUri !== redirectUri) {\n    return errorResponse(400, 'invalid_grant', 'redirect_uri mismatch')\n  }\n\n  const pkceValid = await verifyPkce(codeVerifier, authCode.codeChallenge)\n  if (!pkceValid) {\n    return errorResponse(400, 'invalid_grant', 'PKCE verification failed')\n  }\n\n  const key = await getSigningKey()\n  const accessToken = await signAccessToken(key, {\n    scopes: authCode.scopes,\n    email: authCode.email,\n    sub: authCode.sub,\n    clientId: authCode.clientId,\n    issuer: config.resourceUrl,\n    ttl: config.tokenTtl\n  })\n\n  const refreshToken = randomBytes(32).toString('base64url')\n  await store.saveRefreshToken(refreshToken, {\n    clientId: authCode.clientId,\n    scopes: authCode.scopes,\n    email: authCode.email,\n    sub: authCode.sub,\n    expiresAt: Math.floor(Date.now() / 1000) + 30 * 24 * 3600\n  })\n\n  return jsonResponse(200, {\n    access_token: accessToken,\n    token_type: 'Bearer',\n    expires_in: config.tokenTtl,\n    scope: authCode.scopes.join(' '),\n    refresh_token: refreshToken\n  })\n}\n\nexport function createOAuthProxy(config: OAuthProxyConfig): OAuthProvider {\n  const store = config.store ?? createMemoryStore()\n  const callbackPath = config.callbackPath ?? '/auth/callback'\n  const tokenTtl = config.tokenTtl ?? 3600\n  const scopes = config.requiredScopes ?? []\n\n  let signingKey: Uint8Array | null = null\n\n  async function getSigningKey(): Promise<Uint8Array> {\n    if (signingKey) { return signingKey }\n    if (config.signingKey) {\n      signingKey = new TextEncoder().encode(config.signingKey)\n    } else {\n      signingKey = randomBytes(32)\n    }\n    return signingKey\n  }\n\n  return {\n    metadata(): OAuthResponse {\n      return jsonResponse(200, {\n        issuer: config.resourceUrl,\n        authorization_endpoint: `${config.resourceUrl}/authorize`,\n        token_endpoint: `${config.resourceUrl}/token`,\n        registration_endpoint: `${config.resourceUrl}/register`,\n        response_types_supported: ['code'],\n        grant_types_supported: ['authorization_code', 'refresh_token'],\n        code_challenge_methods_supported: ['S256'],\n        token_endpoint_auth_methods_supported: ['none', 'client_secret_post'],\n        scopes_supported: scopes\n      }, { 'Cache-Control': 'max-age=3600' })\n    },\n\n    register(req) {\n      return handleRegister(req, store, config.redirectUris)\n    },\n\n    async authorize(req): Promise<OAuthResponse> {\n      const params = req.url.searchParams\n      const responseType = params.get('response_type')\n      const clientId = params.get('client_id')\n      const redirectUri = params.get('redirect_uri')\n      const scope = params.get('scope') ?? ''\n      const clientState = params.get('state') ?? ''\n      const codeChallenge = params.get('code_challenge')\n      const codeChallengeMethod = params.get('code_challenge_method')\n      const resource = params.get('resource')\n\n      if (responseType !== 'code') {\n        return errorResponse(400, 'unsupported_response_type', 'Only response_type=code is supported')\n      }\n      if (!clientId) { return errorResponse(400, 'invalid_request', 'client_id is required') }\n      if (!redirectUri) { return errorResponse(400, 'invalid_request', 'redirect_uri is required') }\n      if (!codeChallenge || codeChallengeMethod !== 'S256') {\n        return errorResponse(400, 'invalid_request', 'PKCE with S256 is required')\n      }\n\n      const result = await resolveClient(clientId, store, config.redirectUris)\n      if ('status' in result) { return result }\n      const client = result\n\n      if (!client.redirectUris.includes(redirectUri)) {\n        return errorResponse(400, 'invalid_redirect_uri', 'redirect_uri does not match registered URIs')\n      }\n\n      const proxyState = randomUUID()\n      const pkce = await generatePkce()\n\n      await store.savePendingAuth(proxyState, {\n        clientId,\n        redirectUri,\n        codeChallenge,\n        codeChallengeMethod,\n        scope,\n        clientState,\n        resource: resource ?? undefined,\n        expiresAt: Date.now() / 1000 + 600\n      })\n\n      await store.savePkceVerifier(proxyState, pkce.verifier)\n\n      const upstreamScopes = scopes.length > 0 ? scopes.join(' ') : scope\n      const upstreamUrl = new URL(config.authorizeUrl)\n      upstreamUrl.searchParams.set('response_type', 'code')\n      upstreamUrl.searchParams.set('client_id', config.clientId)\n      upstreamUrl.searchParams.set('redirect_uri', `${config.resourceUrl}${callbackPath}`)\n      upstreamUrl.searchParams.set('scope', upstreamScopes)\n      upstreamUrl.searchParams.set('state', proxyState)\n      upstreamUrl.searchParams.set('code_challenge', pkce.challenge)\n      upstreamUrl.searchParams.set('code_challenge_method', 'S256')\n      if (params.has('access_type')) {\n        upstreamUrl.searchParams.set('access_type', params.get('access_type')!)\n      }\n\n      return redirectResponse(upstreamUrl.toString())\n    },\n\n    async callback(req): Promise<OAuthResponse> {\n      const params = req.url.searchParams\n      const upstreamCode = params.get('code')\n      const proxyState = params.get('state')\n      const upstreamError = params.get('error')\n\n      if (upstreamError) {\n        return errorResponse(400, 'upstream_error', params.get('error_description') ?? upstreamError)\n      }\n      if (!upstreamCode || !proxyState) {\n        return errorResponse(400, 'invalid_request', 'Missing code or state')\n      }\n\n      const pending = await store.getPendingAuth(proxyState)\n      if (!pending) { return errorResponse(400, 'invalid_request', 'Unknown or expired state') }\n\n      const pkceVerifier = await store.getPkceVerifier(proxyState)\n      if (!pkceVerifier) { return errorResponse(400, 'invalid_request', 'Missing PKCE verifier') }\n\n      await store.deletePendingAuth(proxyState)\n      await store.deletePkceVerifier(proxyState)\n\n      const upstream = await exchangeUpstreamCode(upstreamCode, config, callbackPath, pkceVerifier)\n      if ('status' in upstream) { return upstream }\n\n      const userinfo = await fetchUserinfo(config.userinfoUrl, upstream.accessToken)\n\n      const mcpCode = generateCode()\n      await store.saveAuthCode(mcpCode, {\n        clientId: pending.clientId,\n        redirectUri: pending.redirectUri,\n        codeChallenge: pending.codeChallenge,\n        codeChallengeMethod: pending.codeChallengeMethod,\n        scopes: pending.scope.split(' ').filter(Boolean),\n        upstreamAccessToken: upstream.accessToken,\n        upstreamIdToken: upstream.idToken,\n        email: userinfo.email,\n        sub: userinfo.sub,\n        expiresAt: Date.now() / 1000 + 600\n      })\n\n      const clientRedirect = new URL(pending.redirectUri)\n      clientRedirect.searchParams.set('code', mcpCode)\n      if (pending.clientState) {\n        clientRedirect.searchParams.set('state', pending.clientState)\n      }\n\n      return redirectResponse(clientRedirect.toString())\n    },\n\n    async token(req): Promise<OAuthResponse> {\n      const body = req.body\n      if (!body) { return errorResponse(400, 'invalid_request', 'Missing request body') }\n\n      const tokenConfig = { resourceUrl: config.resourceUrl, tokenTtl }\n\n      if (body.grant_type === 'refresh_token') {\n        return handleRefreshToken(body, store, getSigningKey, tokenConfig)\n      }\n      if (body.grant_type !== 'authorization_code') {\n        return errorResponse(400, 'unsupported_grant_type', 'Supported grant types: authorization_code, refresh_token')\n      }\n      return handleAuthorizationCode(body, store, getSigningKey, tokenConfig)\n    },\n\n    async verifyToken(token): Promise<AuthInfo | undefined> {\n      try {\n        const key = await getSigningKey()\n        const { payload } = await jwtVerify(token, key, {\n          issuer: config.resourceUrl,\n          audience: config.resourceUrl\n        })\n        return {\n          token,\n          clientId: payload.sub ?? undefined,\n          scopes: typeof payload.scope === 'string' ? payload.scope.split(' ').filter(Boolean) : [],\n          expiresAt: payload.exp,\n          email: payload.email as string | undefined\n        }\n      } catch {\n        return undefined\n      }\n    }\n  }\n}\n","import { AuthConfig } from '../types.js'\nimport { createOAuthProxy } from './proxy.js'\nimport { OAuthStore } from './store.js'\n\nexport interface GoogleOAuthOptions {\n  clientId: string\n  clientSecret: string\n  resourceUrl: string\n  redirectUris: string[]\n  requiredScopes?: string[]\n  callbackPath?: string\n  signingKey?: string\n  tokenTtl?: number\n  store?: OAuthStore\n}\n\nexport function google(options: GoogleOAuthOptions): AuthConfig {\n  const provider = createOAuthProxy({\n    authorizeUrl: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUrl: 'https://oauth2.googleapis.com/token',\n    userinfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',\n    clientId: options.clientId,\n    clientSecret: options.clientSecret,\n    resourceUrl: options.resourceUrl,\n    redirectUris: options.redirectUris,\n    requiredScopes: options.requiredScopes ?? ['openid', 'email'],\n    callbackPath: options.callbackPath,\n    signingKey: options.signingKey,\n    tokenTtl: options.tokenTtl,\n    store: options.store\n  })\n\n  return {\n    verifyToken: (token) => provider.verifyToken(token),\n    required: true,\n    resourceUrl: options.resourceUrl,\n    authorizationServers: [options.resourceUrl],\n    provider,\n    callbackPath: options.callbackPath ?? '/auth/callback'\n  }\n}\n","import { existsSync, readFileSync, writeFileSync } from 'fs'\nimport { AuthCodeData, ClientRegistration, OAuthStore, PendingAuthData, RefreshTokenData } from '../provider/store.js'\n\nfunction withTtl<T extends { expiresAt: number }>(obj: Record<string, T>, key: string): T | undefined {\n  const item = obj[key]\n  if (!item) { return undefined }\n  if (item.expiresAt < Date.now() / 1000) {\n    delete obj[key]\n    return undefined\n  }\n  return item\n}\n\ninterface JsonStore {\n  authCodes: Record<string, AuthCodeData>\n  pendingAuths: Record<string, PendingAuthData>\n  pkceVerifiers: Record<string, { verifier: string; expiresAt: number }>\n  clients: Record<string, ClientRegistration>\n  refreshTokens: Record<string, RefreshTokenData>\n}\n\nfunction writeJsonStore(path: string, store: JsonStore) {\n  writeFileSync(path, JSON.stringify(store, null, 2), 'utf-8')\n}\n\nfunction readJsonStore(path: string): JsonStore {\n  if (!existsSync(path)) {\n    return {\n      authCodes: {},\n      pendingAuths: {},\n      pkceVerifiers: {},\n      clients: {},\n      refreshTokens: {}\n    }\n  }\n  const data = JSON.parse(readFileSync(path, 'utf-8'))\n  if (!data.refreshTokens) { data.refreshTokens = {} }\n  return data\n}\n\nexport function createJsonStore(path: string): OAuthStore {\n  const store: JsonStore = readJsonStore(path)\n\n  return {\n    async saveAuthCode(code, data) {\n      store.authCodes[code] = data\n      writeJsonStore(path, store)\n    },\n    async getAuthCode(code) { return withTtl(store.authCodes, code) },\n    async deleteAuthCode(code) {\n      delete store.authCodes[code]\n      writeJsonStore(path, store)\n    },\n    async savePendingAuth(state, data) {\n      store.pendingAuths[state] = data\n      writeJsonStore(path, store)\n    },\n    async getPendingAuth(state) { return withTtl(store.pendingAuths, state) },\n    async deletePendingAuth(state) {\n      delete store.pendingAuths[state]\n      writeJsonStore(path, store)\n    },\n    async savePkceVerifier(state, verifier) {\n      store.pkceVerifiers[state] = { verifier, expiresAt: Date.now() / 1000 + 600 }\n      writeJsonStore(path, store)\n    },\n    async getPkceVerifier(state) {\n      const item = store.pkceVerifiers[state]\n      if (!item) { return undefined }\n      if (item.expiresAt < Date.now() / 1000) {\n        delete store.pkceVerifiers[state]\n        writeJsonStore(path, store)\n        return undefined\n      }\n      return item.verifier\n    },\n    async deletePkceVerifier(state) {\n      delete store.pkceVerifiers[state]\n      writeJsonStore(path, store)\n    },\n    async saveClient(clientId, data) {\n      store.clients[clientId] = data\n      writeJsonStore(path, store)\n    },\n    async getClient(clientId) { return store.clients[clientId] },\n\n    async saveRefreshToken(token, data) {\n      store.refreshTokens[token] = data\n      writeJsonStore(path, store)\n    },\n    async getRefreshToken(token) { return withTtl(store.refreshTokens, token) },\n    async deleteRefreshToken(token) {\n      delete store.refreshTokens[token]\n      writeJsonStore(path, store)\n    }\n  }\n}\n","import type { OAuthStore } from '../provider/store.js'\n\nexport interface RedisClient {\n  get(key: string): Promise<unknown>\n  set(key: string, value: string, options?: { ex?: number }): Promise<unknown>\n  del(key: string): Promise<unknown>\n}\n\nexport interface RedisStoreOptions {\n  client: RedisClient\n  prefix?: string\n}\n\nexport function createRedisStore(options: RedisStoreOptions): OAuthStore {\n  const { client, prefix = 'silkweave:oauth:' } = options\n\n  function key(namespace: string, id: string) {\n    return `${prefix}${namespace}:${id}`\n  }\n\n  function ttlFromExpiry(expiresAt: number): number | undefined {\n    const seconds = Math.floor(expiresAt - Date.now() / 1000)\n    return seconds > 0 ? seconds : undefined\n  }\n\n  async function save<T>(namespace: string, id: string, data: T, expiresAt?: number) {\n    const opts: { ex?: number } = {}\n    const ttl = expiresAt != null ? ttlFromExpiry(expiresAt) : undefined\n    if (ttl != null) { opts.ex = ttl }\n    await client.set(key(namespace, id), JSON.stringify(data), opts)\n  }\n\n  async function load<T>(namespace: string, id: string): Promise<T | undefined> {\n    const raw = await client.get(key(namespace, id))\n    if (raw == null) { return undefined }\n    return (typeof raw === 'string' ? JSON.parse(raw) : raw) as T\n  }\n\n  async function remove(namespace: string, id: string) {\n    await client.del(key(namespace, id))\n  }\n\n  return {\n    async saveAuthCode(code, data) { await save('auth-code', code, data, data.expiresAt) },\n    async getAuthCode(code) { return load('auth-code', code) },\n    async deleteAuthCode(code) { await remove('auth-code', code) },\n\n    async savePendingAuth(state, data) { await save('pending-auth', state, data, data.expiresAt) },\n    async getPendingAuth(state) { return load('pending-auth', state) },\n    async deletePendingAuth(state) { await remove('pending-auth', state) },\n\n    async savePkceVerifier(state, verifier) {\n      const expiresAt = Date.now() / 1000 + 600\n      await save('pkce-verifier', state, { verifier, expiresAt }, expiresAt)\n    },\n    async getPkceVerifier(state) {\n      const item = await load<{ verifier: string; expiresAt: number }>('pkce-verifier', state)\n      return item?.verifier\n    },\n    async deletePkceVerifier(state) { await remove('pkce-verifier', state) },\n\n    async saveClient(clientId, data) { await save('client', clientId, data) },\n    async getClient(clientId) { return load('client', clientId) },\n\n    async saveRefreshToken(token, data) { await save('refresh-token', token, data, data.expiresAt) },\n    async getRefreshToken(token) { return load('refresh-token', token) },\n    async deleteRefreshToken(token) { await remove('refresh-token', token) }\n  }\n}\n","import { SilkweaveContext } from '@silkweave/core'\nimport { AuthError, insufficientScope, invalidToken } from './errors.js'\nimport { buildWWWAuthenticate, extractBearerToken } from './extract.js'\nimport { AuthConfig, AuthInfo } from './types.js'\n\nexport interface ValidateResult {\n  auth?: AuthInfo\n  error?: {\n    statusCode: number\n    headers: Record<string, string>\n    body: { error: string; error_description: string }\n  }\n}\n\nexport async function validateToken(\n  authorizationHeader: string | null | undefined,\n  config: AuthConfig,\n  context: SilkweaveContext\n): Promise<ValidateResult> {\n  const required = config.required ?? true\n  const resourceMetadataUrl = config.resourceUrl\n    ? `${config.resourceUrl}/.well-known/oauth-protected-resource`\n    : undefined\n\n  const token = extractBearerToken(authorizationHeader)\n\n  if (!token) {\n    if (!required) { return {} }\n    return buildChallengeResult(resourceMetadataUrl)\n  }\n\n  let authInfo: AuthInfo | undefined\n  try {\n    authInfo = await config.verifyToken(token, context)\n  } catch (error) {\n    const err = invalidToken(error instanceof Error ? error.message : 'Invalid token')\n    return buildErrorResult(err, resourceMetadataUrl)\n  }\n\n  if (!authInfo) {\n    const err = invalidToken()\n    return buildErrorResult(err, resourceMetadataUrl)\n  }\n\n  if (authInfo.expiresAt && authInfo.expiresAt < Date.now() / 1000) {\n    const err = invalidToken('Token has expired')\n    return buildErrorResult(err, resourceMetadataUrl)\n  }\n\n  if (config.requiredScopes?.length) {\n    const scopes = authInfo.scopes ?? []\n    const hasAll = config.requiredScopes.every((s) => scopes.includes(s))\n    if (!hasAll) {\n      const err = insufficientScope()\n      return buildErrorResult(err, resourceMetadataUrl)\n    }\n  }\n\n  return { auth: authInfo }\n}\n\nfunction buildChallengeResult(resourceMetadataUrl?: string): ValidateResult {\n  return {\n    error: {\n      statusCode: 401,\n      headers: {\n        'WWW-Authenticate': buildWWWAuthenticate(undefined, undefined, resourceMetadataUrl),\n        'Content-Type': 'application/json'\n      },\n      body: { error: 'missing_token', error_description: 'No authorization provided' }\n    }\n  }\n}\n\nfunction buildErrorResult(\n  err: AuthError,\n  resourceMetadataUrl?: string\n): ValidateResult {\n  return {\n    error: {\n      statusCode: err.statusCode,\n      headers: {\n        'WWW-Authenticate': buildWWWAuthenticate(err.code, err.message, resourceMetadataUrl),\n        'Content-Type': 'application/json'\n      },\n      body: { error: err.code, error_description: err.message }\n    }\n  }\n}\n"],"mappings":";;;;AAAA,IAAa,YAAb,cAA+B,MAAM;CACnC,YACE,SACA,MACA,aAA6B,KAC7B;AACA,QAAM,QAAQ;AAHE,OAAA,OAAA;AACA,OAAA,aAAA;AAGhB,OAAK,OAAO;;;AAIhB,SAAgB,aAAa,UAAU,iBAAiB;AACtD,QAAO,IAAI,UAAU,SAAS,iBAAiB,IAAI;;AAGrD,SAAgB,kBAAkB,UAAU,sBAAsB;AAChE,QAAO,IAAI,UAAU,SAAS,sBAAsB,IAAI;;;;AChB1D,SAAgB,mBAAmB,QAAkD;AACnF,KAAI,CAAC,OAAU,QAAO;AAEtB,QADc,mBAAmB,KAAK,OAC1B,GAAG,MAAM;;AAGvB,SAAgB,qBACd,OACA,aACA,qBACQ;CACR,MAAM,QAAkB,EAAE;AAC1B,KAAI,MACF,OAAM,KAAK,UAAU,MAAM,GAAG;AAEhC,KAAI,YACF,OAAM,KAAK,sBAAsB,YAAY,GAAG;AAElD,KAAI,oBACF,OAAM,KAAK,sBAAsB,oBAAoB,GAAG;AAE1D,QAAO,MAAM,SAAS,IAAI,UAAU,MAAM,KAAK,KAAK,KAAK;;;;ACd3D,SAAgB,kCACd,aACA,sBAC2B;AAC3B,QAAO;EACL,UAAU;EACV,uBAAuB;EACvB,0BAA0B,CAAC,SAAS;EACrC;;;;ACbH,SAASA,UAAyC,KAAqB,KAA4B;CACjG,MAAM,OAAO,IAAI,IAAI,IAAI;AACzB,KAAI,CAAC,KAAQ;AACb,KAAI,KAAK,YAAY,KAAK,KAAK,GAAG,KAAM;AACtC,MAAI,OAAO,IAAI;AACf;;AAEF,QAAO;;AAGT,SAAgB,oBAAgC;CAC9C,MAAM,4BAAY,IAAI,KAA2B;CACjD,MAAM,+BAAe,IAAI,KAA8B;CACvD,MAAM,gCAAgB,IAAI,KAAsD;CAChF,MAAM,0BAAU,IAAI,KAAiC;CACrD,MAAM,gCAAgB,IAAI,KAA+B;AAEzD,QAAO;EACL,MAAM,aAAa,MAAM,MAAM;AAAE,aAAU,IAAI,MAAM,KAAK;;EAC1D,MAAM,YAAY,MAAM;AAAE,UAAOA,UAAQ,WAAW,KAAK;;EACzD,MAAM,eAAe,MAAM;AAAE,aAAU,OAAO,KAAK;;EAEnD,MAAM,gBAAgB,OAAO,MAAM;AAAE,gBAAa,IAAI,OAAO,KAAK;;EAClE,MAAM,eAAe,OAAO;AAAE,UAAOA,UAAQ,cAAc,MAAM;;EACjE,MAAM,kBAAkB,OAAO;AAAE,gBAAa,OAAO,MAAM;;EAE3D,MAAM,iBAAiB,OAAO,UAAU;AACtC,iBAAc,IAAI,OAAO;IAAE;IAAU,WAAW,KAAK,KAAK,GAAG,MAAO;IAAK,CAAC;;EAE5E,MAAM,gBAAgB,OAAO;GAC3B,MAAM,OAAO,cAAc,IAAI,MAAM;AACrC,OAAI,CAAC,KAAQ;AACb,OAAI,KAAK,YAAY,KAAK,KAAK,GAAG,KAAM;AACtC,kBAAc,OAAO,MAAM;AAC3B;;AAEF,UAAO,KAAK;;EAEd,MAAM,mBAAmB,OAAO;AAAE,iBAAc,OAAO,MAAM;;EAE7D,MAAM,WAAW,UAAU,MAAM;AAAE,WAAQ,IAAI,UAAU,KAAK;;EAC9D,MAAM,UAAU,UAAU;AAAE,UAAO,QAAQ,IAAI,SAAS;;EAExD,MAAM,iBAAiB,OAAO,MAAM;AAAE,iBAAc,IAAI,OAAO,KAAK;;EACpE,MAAM,gBAAgB,OAAO;AAAE,UAAOA,UAAQ,eAAe,MAAM;;EACnE,MAAM,mBAAmB,OAAO;AAAE,iBAAc,OAAO,MAAM;;EAC9D;;;;AChDH,SAAgB,iBAAiB,KAAa,UAA6B;AACzE,QAAO,SAAS,MAAM,YAAY;AAEhC,SADc,eAAe,QACjB,CAAC,KAAK,IAAI;GACtB;;AAGJ,SAAS,eAAe,SAAyB;CAC/C,MAAM,UAAU,QACb,QAAQ,sBAAsB,OAAO,CACrC,QAAQ,OAAO,KAAK;AACvB,QAAO,IAAI,OAAO,IAAI,QAAQ,GAAG;;;;ACWnC,MAAM,eAAuC;CAC3C,+BAA+B;CAC/B,gCAAgC;CAChC,gCAAgC;CACjC;AAED,SAAS,eAAuB;AAC9B,QAAO,YAAY,GAAG,CAAC,SAAS,YAAY;;AAG9C,eAAe,eAAiE;CAC9E,MAAM,WAAW,YAAY,GAAG,CAAC,SAAS,YAAY;CACtD,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,aAAa,CAAC,OAAO,SAAS,CAAC;AAEtF,QAAO;EAAE;EAAU,WADD,OAAO,KAAK,KAAK,CAAC,SAAS,YACjB;EAAE;;AAGhC,eAAe,WAAW,UAAkB,WAAqC;CAC/E,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,aAAa,CAAC,OAAO,SAAS,CAAC;AAEtF,QADiB,OAAO,KAAK,KAAK,CAAC,SAAS,YAC7B,KAAK;;AAGtB,SAAS,aAAa,QAAgB,MAA+B,UAAkC,EAAE,EAAiB;AACxH,QAAO;EACL;EACA,SAAS;GAAE,gBAAgB;GAAoB,GAAG;GAAc,GAAG;GAAS;EAC5E;EACD;;AAGH,SAAS,iBAAiB,KAA4B;AACpD,QAAO;EACL,QAAQ;EACR,SAAS;GAAE,UAAU;GAAK,GAAG;GAAc;EAC3C,MAAM,KAAA;EACP;;AAGH,SAAS,cAAc,QAAgB,OAAe,aAAoC;AACxF,QAAO,aAAa,QAAQ;EAAE;EAAO,mBAAmB;EAAa,CAAC;;AAGxE,eAAe,gBACb,KACA,MACiB;CACjB,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACzC,QAAO,IAAI,QAAQ;EAAE,OAAO,KAAK,OAAO,KAAK,IAAI;EAAE,OAAO,KAAK;EAAO,CAAC,CACpE,mBAAmB,EAAE,KAAK,SAAS,CAAC,CACpC,WAAW,KAAK,OAAO,KAAK,SAAS,KAAK,SAAS,CACnD,UAAU,KAAK,OAAO,CACtB,YAAY,KAAK,OAAO,CACxB,YAAY,IAAI,CAChB,kBAAkB,MAAM,KAAK,IAAI,CACjC,KAAK,IAAI;;AAGd,eAAe,eACb,KACA,OACA,qBACwB;CACxB,MAAM,OAAO,IAAI;AACjB,KAAI,CAAC,KAAQ,QAAO,cAAc,KAAK,mBAAmB,uBAAuB;CAEjF,MAAM,eAAe,KAAK;AAC1B,KAAI,CAAC,aAAgB,QAAO,cAAc,KAAK,mBAAmB,4BAA4B;CAE9F,IAAI;AACJ,KAAI;AACF,SAAO,OAAO,iBAAiB,WAAW,KAAK,MAAM,aAAa,GAAG;SAC/D;AACN,SAAO,CAAC,aAAa;;AAGvB,KAAI,CAAC,MAAM,QAAQ,KAAK,IAAI,KAAK,WAAW,EAC1C,QAAO,cAAc,KAAK,mBAAmB,0CAA0C;AAGzF,MAAK,MAAM,OAAO,KAChB,KAAI,CAAC,iBAAiB,KAAK,oBAAoB,CAC7C,QAAO,cAAc,KAAK,wBAAwB,6BAA6B,MAAM;CAIzF,MAAM,WAAW,YAAY;CAC7B,MAAM,eAAe,YAAY,GAAG,CAAC,SAAS,YAAY;CAC1D,MAAM,eAAe;EACnB;EACA;EACA,cAAc;EACd,YAAY,KAAK;EACjB,WAAW,KAAK,KAAK,GAAG;EACzB;AAED,OAAM,MAAM,WAAW,UAAU,aAAa;AAE9C,QAAO,aAAa,KAAK;EACvB,WAAW;EACX,eAAe;EACf,eAAe;EACf,aAAa,KAAK;EAClB,4BAA4B;EAC7B,CAAC;;AAGJ,eAAe,cACb,UACA,OACA,qBACqI;CACrI,MAAM,WAAW,MAAM,MAAM,UAAU,SAAS;AAChD,KAAI,SAAY,QAAO;AAEvB,KAAI,CAAC,SAAS,WAAW,WAAW,CAClC,QAAO,cAAc,KAAK,kBAAkB,oBAAoB;AAGlE,KAAI;EACF,MAAM,UAAU,MAAM,MAAM,SAAS;AACrC,MAAI,CAAC,QAAQ,GACX,QAAO,cAAc,KAAK,kBAAkB,2CAA2C;EAEzF,MAAM,OAAO,MAAM,QAAQ,MAAM;EACjC,MAAM,mBAAmB,KAAK;AAC9B,MAAI,CAAC,MAAM,QAAQ,iBAAiB,IAAI,iBAAiB,WAAW,EAClE,QAAO,cAAc,KAAK,kBAAkB,6CAA6C;AAE3F,OAAK,MAAM,OAAO,iBAChB,KAAI,CAAC,iBAAiB,KAAK,oBAAoB,CAC7C,QAAO,cAAc,KAAK,wBAAwB,6BAA6B,MAAM;EAGzF,MAAM,SAAS;GACb;GACA,cAAc;GACd,cAAc;GACd,YAAY,KAAK;GACjB,WAAW,KAAK,KAAK,GAAG;GACzB;AACD,QAAM,MAAM,WAAW,UAAU,OAAO;AACxC,SAAO;SACD;AACN,SAAO,cAAc,KAAK,kBAAkB,2CAA2C;;;AAI3F,eAAe,qBACb,MACA,QACA,cACA,cACoE;CACpE,MAAM,YAAY,IAAI,gBAAgB;EACpC,YAAY;EACZ;EACA,cAAc,GAAG,OAAO,cAAc;EACtC,WAAW,OAAO;EAClB,eAAe,OAAO;EACtB,eAAe;EAChB,CAAC;CAEF,MAAM,gBAAgB,MAAM,MAAM,OAAO,UAAU;EACjD,QAAQ;EACR,SAAS,EAAE,gBAAgB,qCAAqC;EAChE,MAAM,UAAU,UAAU;EAC3B,CAAC;AAEF,KAAI,CAAC,cAAc,IAAI;EACrB,MAAM,YAAY,MAAM,cAAc,MAAM;AAC5C,UAAQ,MAAM,mCAAmC,UAAU;AAC3D,SAAO,cAAc,KAAK,kBAAkB,iDAAiD;;CAG/F,MAAM,SAAS,MAAM,cAAc,MAAM;AACzC,QAAO;EACL,aAAa,OAAO;EACpB,SAAS,OAAO;EACjB;;AAGH,eAAe,cACb,aACA,aAC2C;AAC3C,KAAI,CAAC,eAAe,CAAC,YAAe,QAAO,EAAE;AAC7C,KAAI;EACF,MAAM,MAAM,MAAM,MAAM,aAAa,EACnC,SAAS,EAAE,eAAe,UAAU,eAAe,EACpD,CAAC;AACF,MAAI,IAAI,IAAI;GACV,MAAM,WAAW,MAAM,IAAI,MAAM;AACjC,UAAO;IAAE,OAAO,SAAS;IAA6B,KAAK,SAAS;IAA2B;;SAE3F;AAGR,QAAO,EAAE;;AAGX,eAAe,mBACb,MACA,OACA,eACA,QACwB;CACxB,MAAM,eAAe,KAAK;AAC1B,KAAI,CAAC,aACH,QAAO,cAAc,KAAK,mBAAmB,wBAAwB;CAGvE,MAAM,YAAY,MAAM,MAAM,gBAAgB,aAAa;AAC3D,KAAI,CAAC,UACH,QAAO,cAAc,KAAK,iBAAiB,mCAAmC;AAahF,QAAO,aAAa,KAAK;EACvB,cAAc,MAVU,gBAAgB,MADxB,eAAe,EACc;GAC7C,QAAQ,UAAU;GAClB,OAAO,UAAU;GACjB,KAAK,UAAU;GACf,UAAU,UAAU;GACpB,QAAQ,OAAO;GACf,KAAK,OAAO;GACb,CAAC;EAIA,YAAY;EACZ,YAAY,OAAO;EACnB,OAAO,UAAU,OAAO,KAAK,IAAI;EACjC,eAAe;EAChB,CAAC;;AAGJ,eAAe,wBACb,MACA,OACA,eACA,QACwB;CACxB,MAAM,OAAO,KAAK;CAClB,MAAM,cAAc,KAAK;CACzB,MAAM,WAAW,KAAK;CACtB,MAAM,eAAe,KAAK;AAE1B,KAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAC7B,QAAO,cAAc,KAAK,mBAAmB,8BAA8B;CAG7E,MAAM,WAAW,MAAM,MAAM,YAAY,KAAK;AAC9C,KAAI,CAAC,SAAY,QAAO,cAAc,KAAK,iBAAiB,wCAAwC;AAEpG,OAAM,MAAM,eAAe,KAAK;AAEhC,KAAI,SAAS,aAAa,SACxB,QAAO,cAAc,KAAK,iBAAiB,qBAAqB;AAElE,KAAI,eAAe,SAAS,gBAAgB,YAC1C,QAAO,cAAc,KAAK,iBAAiB,wBAAwB;AAIrE,KAAI,CAAC,MADmB,WAAW,cAAc,SAAS,cAAc,CAEtE,QAAO,cAAc,KAAK,iBAAiB,2BAA2B;CAIxE,MAAM,cAAc,MAAM,gBAAgB,MADxB,eAAe,EACc;EAC7C,QAAQ,SAAS;EACjB,OAAO,SAAS;EAChB,KAAK,SAAS;EACd,UAAU,SAAS;EACnB,QAAQ,OAAO;EACf,KAAK,OAAO;EACb,CAAC;CAEF,MAAM,eAAe,YAAY,GAAG,CAAC,SAAS,YAAY;AAC1D,OAAM,MAAM,iBAAiB,cAAc;EACzC,UAAU,SAAS;EACnB,QAAQ,SAAS;EACjB,OAAO,SAAS;EAChB,KAAK,SAAS;EACd,WAAW,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG,MAAU;EACtD,CAAC;AAEF,QAAO,aAAa,KAAK;EACvB,cAAc;EACd,YAAY;EACZ,YAAY,OAAO;EACnB,OAAO,SAAS,OAAO,KAAK,IAAI;EAChC,eAAe;EAChB,CAAC;;AAGJ,SAAgB,iBAAiB,QAAyC;CACxE,MAAM,QAAQ,OAAO,SAAS,mBAAmB;CACjD,MAAM,eAAe,OAAO,gBAAgB;CAC5C,MAAM,WAAW,OAAO,YAAY;CACpC,MAAM,SAAS,OAAO,kBAAkB,EAAE;CAE1C,IAAI,aAAgC;CAEpC,eAAe,gBAAqC;AAClD,MAAI,WAAc,QAAO;AACzB,MAAI,OAAO,WACT,cAAa,IAAI,aAAa,CAAC,OAAO,OAAO,WAAW;MAExD,cAAa,YAAY,GAAG;AAE9B,SAAO;;AAGT,QAAO;EACL,WAA0B;AACxB,UAAO,aAAa,KAAK;IACvB,QAAQ,OAAO;IACf,wBAAwB,GAAG,OAAO,YAAY;IAC9C,gBAAgB,GAAG,OAAO,YAAY;IACtC,uBAAuB,GAAG,OAAO,YAAY;IAC7C,0BAA0B,CAAC,OAAO;IAClC,uBAAuB,CAAC,sBAAsB,gBAAgB;IAC9D,kCAAkC,CAAC,OAAO;IAC1C,uCAAuC,CAAC,QAAQ,qBAAqB;IACrE,kBAAkB;IACnB,EAAE,EAAE,iBAAiB,gBAAgB,CAAC;;EAGzC,SAAS,KAAK;AACZ,UAAO,eAAe,KAAK,OAAO,OAAO,aAAa;;EAGxD,MAAM,UAAU,KAA6B;GAC3C,MAAM,SAAS,IAAI,IAAI;GACvB,MAAM,eAAe,OAAO,IAAI,gBAAgB;GAChD,MAAM,WAAW,OAAO,IAAI,YAAY;GACxC,MAAM,cAAc,OAAO,IAAI,eAAe;GAC9C,MAAM,QAAQ,OAAO,IAAI,QAAQ,IAAI;GACrC,MAAM,cAAc,OAAO,IAAI,QAAQ,IAAI;GAC3C,MAAM,gBAAgB,OAAO,IAAI,iBAAiB;GAClD,MAAM,sBAAsB,OAAO,IAAI,wBAAwB;GAC/D,MAAM,WAAW,OAAO,IAAI,WAAW;AAEvC,OAAI,iBAAiB,OACnB,QAAO,cAAc,KAAK,6BAA6B,uCAAuC;AAEhG,OAAI,CAAC,SAAY,QAAO,cAAc,KAAK,mBAAmB,wBAAwB;AACtF,OAAI,CAAC,YAAe,QAAO,cAAc,KAAK,mBAAmB,2BAA2B;AAC5F,OAAI,CAAC,iBAAiB,wBAAwB,OAC5C,QAAO,cAAc,KAAK,mBAAmB,6BAA6B;GAG5E,MAAM,SAAS,MAAM,cAAc,UAAU,OAAO,OAAO,aAAa;AACxE,OAAI,YAAY,OAAU,QAAO;AAGjC,OAAI,CAACC,OAAO,aAAa,SAAS,YAAY,CAC5C,QAAO,cAAc,KAAK,wBAAwB,8CAA8C;GAGlG,MAAM,aAAa,YAAY;GAC/B,MAAM,OAAO,MAAM,cAAc;AAEjC,SAAM,MAAM,gBAAgB,YAAY;IACtC;IACA;IACA;IACA;IACA;IACA;IACA,UAAU,YAAY,KAAA;IACtB,WAAW,KAAK,KAAK,GAAG,MAAO;IAChC,CAAC;AAEF,SAAM,MAAM,iBAAiB,YAAY,KAAK,SAAS;GAEvD,MAAM,iBAAiB,OAAO,SAAS,IAAI,OAAO,KAAK,IAAI,GAAG;GAC9D,MAAM,cAAc,IAAI,IAAI,OAAO,aAAa;AAChD,eAAY,aAAa,IAAI,iBAAiB,OAAO;AACrD,eAAY,aAAa,IAAI,aAAa,OAAO,SAAS;AAC1D,eAAY,aAAa,IAAI,gBAAgB,GAAG,OAAO,cAAc,eAAe;AACpF,eAAY,aAAa,IAAI,SAAS,eAAe;AACrD,eAAY,aAAa,IAAI,SAAS,WAAW;AACjD,eAAY,aAAa,IAAI,kBAAkB,KAAK,UAAU;AAC9D,eAAY,aAAa,IAAI,yBAAyB,OAAO;AAC7D,OAAI,OAAO,IAAI,cAAc,CAC3B,aAAY,aAAa,IAAI,eAAe,OAAO,IAAI,cAAc,CAAE;AAGzE,UAAO,iBAAiB,YAAY,UAAU,CAAC;;EAGjD,MAAM,SAAS,KAA6B;GAC1C,MAAM,SAAS,IAAI,IAAI;GACvB,MAAM,eAAe,OAAO,IAAI,OAAO;GACvC,MAAM,aAAa,OAAO,IAAI,QAAQ;GACtC,MAAM,gBAAgB,OAAO,IAAI,QAAQ;AAEzC,OAAI,cACF,QAAO,cAAc,KAAK,kBAAkB,OAAO,IAAI,oBAAoB,IAAI,cAAc;AAE/F,OAAI,CAAC,gBAAgB,CAAC,WACpB,QAAO,cAAc,KAAK,mBAAmB,wBAAwB;GAGvE,MAAM,UAAU,MAAM,MAAM,eAAe,WAAW;AACtD,OAAI,CAAC,QAAW,QAAO,cAAc,KAAK,mBAAmB,2BAA2B;GAExF,MAAM,eAAe,MAAM,MAAM,gBAAgB,WAAW;AAC5D,OAAI,CAAC,aAAgB,QAAO,cAAc,KAAK,mBAAmB,wBAAwB;AAE1F,SAAM,MAAM,kBAAkB,WAAW;AACzC,SAAM,MAAM,mBAAmB,WAAW;GAE1C,MAAM,WAAW,MAAM,qBAAqB,cAAc,QAAQ,cAAc,aAAa;AAC7F,OAAI,YAAY,SAAY,QAAO;GAEnC,MAAM,WAAW,MAAM,cAAc,OAAO,aAAa,SAAS,YAAY;GAE9E,MAAM,UAAU,cAAc;AAC9B,SAAM,MAAM,aAAa,SAAS;IAChC,UAAU,QAAQ;IAClB,aAAa,QAAQ;IACrB,eAAe,QAAQ;IACvB,qBAAqB,QAAQ;IAC7B,QAAQ,QAAQ,MAAM,MAAM,IAAI,CAAC,OAAO,QAAQ;IAChD,qBAAqB,SAAS;IAC9B,iBAAiB,SAAS;IAC1B,OAAO,SAAS;IAChB,KAAK,SAAS;IACd,WAAW,KAAK,KAAK,GAAG,MAAO;IAChC,CAAC;GAEF,MAAM,iBAAiB,IAAI,IAAI,QAAQ,YAAY;AACnD,kBAAe,aAAa,IAAI,QAAQ,QAAQ;AAChD,OAAI,QAAQ,YACV,gBAAe,aAAa,IAAI,SAAS,QAAQ,YAAY;AAG/D,UAAO,iBAAiB,eAAe,UAAU,CAAC;;EAGpD,MAAM,MAAM,KAA6B;GACvC,MAAM,OAAO,IAAI;AACjB,OAAI,CAAC,KAAQ,QAAO,cAAc,KAAK,mBAAmB,uBAAuB;GAEjF,MAAM,cAAc;IAAE,aAAa,OAAO;IAAa;IAAU;AAEjE,OAAI,KAAK,eAAe,gBACtB,QAAO,mBAAmB,MAAM,OAAO,eAAe,YAAY;AAEpE,OAAI,KAAK,eAAe,qBACtB,QAAO,cAAc,KAAK,0BAA0B,2DAA2D;AAEjH,UAAO,wBAAwB,MAAM,OAAO,eAAe,YAAY;;EAGzE,MAAM,YAAY,OAAsC;AACtD,OAAI;IAEF,MAAM,EAAE,YAAY,MAAM,UAAU,OAAO,MADzB,eAAe,EACe;KAC9C,QAAQ,OAAO;KACf,UAAU,OAAO;KAClB,CAAC;AACF,WAAO;KACL;KACA,UAAU,QAAQ,OAAO,KAAA;KACzB,QAAQ,OAAO,QAAQ,UAAU,WAAW,QAAQ,MAAM,MAAM,IAAI,CAAC,OAAO,QAAQ,GAAG,EAAE;KACzF,WAAW,QAAQ;KACnB,OAAO,QAAQ;KAChB;WACK;AACN;;;EAGL;;;;ACleH,SAAgB,OAAO,SAAyC;CAC9D,MAAM,WAAW,iBAAiB;EAChC,cAAc;EACd,UAAU;EACV,aAAa;EACb,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,aAAa,QAAQ;EACrB,cAAc,QAAQ;EACtB,gBAAgB,QAAQ,kBAAkB,CAAC,UAAU,QAAQ;EAC7D,cAAc,QAAQ;EACtB,YAAY,QAAQ;EACpB,UAAU,QAAQ;EAClB,OAAO,QAAQ;EAChB,CAAC;AAEF,QAAO;EACL,cAAc,UAAU,SAAS,YAAY,MAAM;EACnD,UAAU;EACV,aAAa,QAAQ;EACrB,sBAAsB,CAAC,QAAQ,YAAY;EAC3C;EACA,cAAc,QAAQ,gBAAgB;EACvC;;;;ACpCH,SAAS,QAAyC,KAAwB,KAA4B;CACpG,MAAM,OAAO,IAAI;AACjB,KAAI,CAAC,KAAQ;AACb,KAAI,KAAK,YAAY,KAAK,KAAK,GAAG,KAAM;AACtC,SAAO,IAAI;AACX;;AAEF,QAAO;;AAWT,SAAS,eAAe,MAAc,OAAkB;AACtD,eAAc,MAAM,KAAK,UAAU,OAAO,MAAM,EAAE,EAAE,QAAQ;;AAG9D,SAAS,cAAc,MAAyB;AAC9C,KAAI,CAAC,WAAW,KAAK,CACnB,QAAO;EACL,WAAW,EAAE;EACb,cAAc,EAAE;EAChB,eAAe,EAAE;EACjB,SAAS,EAAE;EACX,eAAe,EAAE;EAClB;CAEH,MAAM,OAAO,KAAK,MAAM,aAAa,MAAM,QAAQ,CAAC;AACpD,KAAI,CAAC,KAAK,cAAiB,MAAK,gBAAgB,EAAE;AAClD,QAAO;;AAGT,SAAgB,gBAAgB,MAA0B;CACxD,MAAM,QAAmB,cAAc,KAAK;AAE5C,QAAO;EACL,MAAM,aAAa,MAAM,MAAM;AAC7B,SAAM,UAAU,QAAQ;AACxB,kBAAe,MAAM,MAAM;;EAE7B,MAAM,YAAY,MAAM;AAAE,UAAO,QAAQ,MAAM,WAAW,KAAK;;EAC/D,MAAM,eAAe,MAAM;AACzB,UAAO,MAAM,UAAU;AACvB,kBAAe,MAAM,MAAM;;EAE7B,MAAM,gBAAgB,OAAO,MAAM;AACjC,SAAM,aAAa,SAAS;AAC5B,kBAAe,MAAM,MAAM;;EAE7B,MAAM,eAAe,OAAO;AAAE,UAAO,QAAQ,MAAM,cAAc,MAAM;;EACvE,MAAM,kBAAkB,OAAO;AAC7B,UAAO,MAAM,aAAa;AAC1B,kBAAe,MAAM,MAAM;;EAE7B,MAAM,iBAAiB,OAAO,UAAU;AACtC,SAAM,cAAc,SAAS;IAAE;IAAU,WAAW,KAAK,KAAK,GAAG,MAAO;IAAK;AAC7E,kBAAe,MAAM,MAAM;;EAE7B,MAAM,gBAAgB,OAAO;GAC3B,MAAM,OAAO,MAAM,cAAc;AACjC,OAAI,CAAC,KAAQ;AACb,OAAI,KAAK,YAAY,KAAK,KAAK,GAAG,KAAM;AACtC,WAAO,MAAM,cAAc;AAC3B,mBAAe,MAAM,MAAM;AAC3B;;AAEF,UAAO,KAAK;;EAEd,MAAM,mBAAmB,OAAO;AAC9B,UAAO,MAAM,cAAc;AAC3B,kBAAe,MAAM,MAAM;;EAE7B,MAAM,WAAW,UAAU,MAAM;AAC/B,SAAM,QAAQ,YAAY;AAC1B,kBAAe,MAAM,MAAM;;EAE7B,MAAM,UAAU,UAAU;AAAE,UAAO,MAAM,QAAQ;;EAEjD,MAAM,iBAAiB,OAAO,MAAM;AAClC,SAAM,cAAc,SAAS;AAC7B,kBAAe,MAAM,MAAM;;EAE7B,MAAM,gBAAgB,OAAO;AAAE,UAAO,QAAQ,MAAM,eAAe,MAAM;;EACzE,MAAM,mBAAmB,OAAO;AAC9B,UAAO,MAAM,cAAc;AAC3B,kBAAe,MAAM,MAAM;;EAE9B;;;;AClFH,SAAgB,iBAAiB,SAAwC;CACvE,MAAM,EAAE,QAAQ,SAAS,uBAAuB;CAEhD,SAAS,IAAI,WAAmB,IAAY;AAC1C,SAAO,GAAG,SAAS,UAAU,GAAG;;CAGlC,SAAS,cAAc,WAAuC;EAC5D,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,KAAK,GAAG,IAAK;AACzD,SAAO,UAAU,IAAI,UAAU,KAAA;;CAGjC,eAAe,KAAQ,WAAmB,IAAY,MAAS,WAAoB;EACjF,MAAM,OAAwB,EAAE;EAChC,MAAM,MAAM,aAAa,OAAO,cAAc,UAAU,GAAG,KAAA;AAC3D,MAAI,OAAO,KAAQ,MAAK,KAAK;AAC7B,QAAM,OAAO,IAAI,IAAI,WAAW,GAAG,EAAE,KAAK,UAAU,KAAK,EAAE,KAAK;;CAGlE,eAAe,KAAQ,WAAmB,IAAoC;EAC5E,MAAM,MAAM,MAAM,OAAO,IAAI,IAAI,WAAW,GAAG,CAAC;AAChD,MAAI,OAAO,KAAQ;AACnB,SAAQ,OAAO,QAAQ,WAAW,KAAK,MAAM,IAAI,GAAG;;CAGtD,eAAe,OAAO,WAAmB,IAAY;AACnD,QAAM,OAAO,IAAI,IAAI,WAAW,GAAG,CAAC;;AAGtC,QAAO;EACL,MAAM,aAAa,MAAM,MAAM;AAAE,SAAM,KAAK,aAAa,MAAM,MAAM,KAAK,UAAU;;EACpF,MAAM,YAAY,MAAM;AAAE,UAAO,KAAK,aAAa,KAAK;;EACxD,MAAM,eAAe,MAAM;AAAE,SAAM,OAAO,aAAa,KAAK;;EAE5D,MAAM,gBAAgB,OAAO,MAAM;AAAE,SAAM,KAAK,gBAAgB,OAAO,MAAM,KAAK,UAAU;;EAC5F,MAAM,eAAe,OAAO;AAAE,UAAO,KAAK,gBAAgB,MAAM;;EAChE,MAAM,kBAAkB,OAAO;AAAE,SAAM,OAAO,gBAAgB,MAAM;;EAEpE,MAAM,iBAAiB,OAAO,UAAU;GACtC,MAAM,YAAY,KAAK,KAAK,GAAG,MAAO;AACtC,SAAM,KAAK,iBAAiB,OAAO;IAAE;IAAU;IAAW,EAAE,UAAU;;EAExE,MAAM,gBAAgB,OAAO;AAE3B,WAAO,MADY,KAA8C,iBAAiB,MAAM,GAC3E;;EAEf,MAAM,mBAAmB,OAAO;AAAE,SAAM,OAAO,iBAAiB,MAAM;;EAEtE,MAAM,WAAW,UAAU,MAAM;AAAE,SAAM,KAAK,UAAU,UAAU,KAAK;;EACvE,MAAM,UAAU,UAAU;AAAE,UAAO,KAAK,UAAU,SAAS;;EAE3D,MAAM,iBAAiB,OAAO,MAAM;AAAE,SAAM,KAAK,iBAAiB,OAAO,MAAM,KAAK,UAAU;;EAC9F,MAAM,gBAAgB,OAAO;AAAE,UAAO,KAAK,iBAAiB,MAAM;;EAClE,MAAM,mBAAmB,OAAO;AAAE,SAAM,OAAO,iBAAiB,MAAM;;EACvE;;;;ACrDH,eAAsB,cACpB,qBACA,QACA,SACyB;CACzB,MAAM,WAAW,OAAO,YAAY;CACpC,MAAM,sBAAsB,OAAO,cAC/B,GAAG,OAAO,YAAY,yCACtB,KAAA;CAEJ,MAAM,QAAQ,mBAAmB,oBAAoB;AAErD,KAAI,CAAC,OAAO;AACV,MAAI,CAAC,SAAY,QAAO,EAAE;AAC1B,SAAO,qBAAqB,oBAAoB;;CAGlD,IAAI;AACJ,KAAI;AACF,aAAW,MAAM,OAAO,YAAY,OAAO,QAAQ;UAC5C,OAAO;AAEd,SAAO,iBADK,aAAa,iBAAiB,QAAQ,MAAM,UAAU,gBACvC,EAAE,oBAAoB;;AAGnD,KAAI,CAAC,SAEH,QAAO,iBADK,cACe,EAAE,oBAAoB;AAGnD,KAAI,SAAS,aAAa,SAAS,YAAY,KAAK,KAAK,GAAG,IAE1D,QAAO,iBADK,aAAa,oBACE,EAAE,oBAAoB;AAGnD,KAAI,OAAO,gBAAgB,QAAQ;EACjC,MAAM,SAAS,SAAS,UAAU,EAAE;AAEpC,MAAI,CADW,OAAO,eAAe,OAAO,MAAM,OAAO,SAAS,EAAE,CACzD,CAET,QAAO,iBADK,mBACe,EAAE,oBAAoB;;AAIrD,QAAO,EAAE,MAAM,UAAU;;AAG3B,SAAS,qBAAqB,qBAA8C;AAC1E,QAAO,EACL,OAAO;EACL,YAAY;EACZ,SAAS;GACP,oBAAoB,qBAAqB,KAAA,GAAW,KAAA,GAAW,oBAAoB;GACnF,gBAAgB;GACjB;EACD,MAAM;GAAE,OAAO;GAAiB,mBAAmB;GAA6B;EACjF,EACF;;AAGH,SAAS,iBACP,KACA,qBACgB;AAChB,QAAO,EACL,OAAO;EACL,YAAY,IAAI;EAChB,SAAS;GACP,oBAAoB,qBAAqB,IAAI,MAAM,IAAI,SAAS,oBAAoB;GACpF,gBAAgB;GACjB;EACD,MAAM;GAAE,OAAO,IAAI;GAAM,mBAAmB,IAAI;GAAS;EAC1D,EACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/errors.ts","../src/extract.ts","../src/metadata.ts","../src/validate.ts"],"sourcesContent":["export class AuthError extends Error {\n  constructor(\n    message: string,\n    public readonly code: string,\n    public readonly statusCode = 401\n  ) {\n    super(message)\n    this.name = 'AuthError'\n  }\n}\n\nexport function invalidToken(message = 'Invalid token') {\n  return new AuthError(message, 'invalid_token', 401)\n}\n\nexport function insufficientScope(message = 'Insufficient scope') {\n  return new AuthError(message, 'insufficient_scope', 403)\n}\n","export function extractBearerToken(header: string | null | undefined): string | null {\n  if (!header) { return null }\n  const match = /^Bearer\\s+(.+)$/i.exec(header)\n  return match?.[1] ?? null\n}\n\nexport function buildWWWAuthenticate(\n  error?: string,\n  description?: string,\n  resourceMetadataUrl?: string,\n  scope?: string\n): string {\n  const parts: string[] = []\n  if (error) {\n    parts.push(`error=\"${error}\"`)\n  }\n  if (description) {\n    parts.push(`error_description=\"${description}\"`)\n  }\n  if (resourceMetadataUrl) {\n    parts.push(`resource_metadata=\"${resourceMetadataUrl}\"`)\n  }\n  // The scopes the client must obtain to step up (RFC 9470 / SEP-2350).\n  if (scope) {\n    parts.push(`scope=\"${scope}\"`)\n  }\n  return parts.length > 0 ? `Bearer ${parts.join(', ')}` : 'Bearer'\n}\n","export interface ProtectedResourceMetadata {\n  resource: string\n  authorization_servers: string[]\n  scopes_supported?: string[]\n  bearer_methods_supported?: string[]\n}\n\nexport function generateProtectedResourceMetadata(\n  resourceUrl: string,\n  authorizationServers: string[],\n  scopesSupported?: string[]\n): ProtectedResourceMetadata {\n  return {\n    resource: resourceUrl,\n    authorization_servers: authorizationServers,\n    ...(scopesSupported?.length ? { scopes_supported: scopesSupported } : {}),\n    bearer_methods_supported: ['header']\n  }\n}\n","import { SilkweaveContext } from '@silkweave/core'\nimport { AuthError, insufficientScope, invalidToken } from './errors.js'\nimport { buildWWWAuthenticate, extractBearerToken } from './extract.js'\nimport { AuthConfig, AuthInfo } from './types.js'\n\nexport interface ValidateResult {\n  auth?: AuthInfo\n  error?: {\n    statusCode: number\n    headers: Record<string, string>\n    body: { error: string; error_description: string }\n  }\n}\n\nexport async function validateToken(\n  authorizationHeader: string | null | undefined,\n  config: AuthConfig,\n  context: SilkweaveContext\n): Promise<ValidateResult> {\n  const required = config.required ?? true\n  const resourceMetadataUrl = config.resourceUrl\n    ? `${config.resourceUrl}/.well-known/oauth-protected-resource`\n    : undefined\n\n  const token = extractBearerToken(authorizationHeader)\n\n  if (!token) {\n    if (!required) { return {} }\n    return buildChallengeResult(resourceMetadataUrl)\n  }\n\n  let authInfo: AuthInfo | undefined\n  try {\n    authInfo = await config.verifyToken(token, context)\n  } catch (error) {\n    const err = invalidToken(error instanceof Error ? error.message : 'Invalid token')\n    return buildErrorResult(err, resourceMetadataUrl)\n  }\n\n  if (!authInfo) {\n    const err = invalidToken()\n    return buildErrorResult(err, resourceMetadataUrl)\n  }\n\n  if (authInfo.expiresAt && authInfo.expiresAt < Date.now() / 1000) {\n    const err = invalidToken('Token has expired')\n    return buildErrorResult(err, resourceMetadataUrl)\n  }\n\n  // Issuer binding (RFC 9207 / SEP-2468): reject a token minted by an\n  // authorization server other than the expected one.\n  if (config.issuer && typeof authInfo.iss === 'string' && authInfo.iss !== config.issuer) {\n    return buildErrorResult(invalidToken('Token issuer mismatch'), resourceMetadataUrl)\n  }\n\n  // Audience binding (RFC 8707 / SEP-2352): reject a token whose `aud` does not\n  // include this resource - the resource-server confused-deputy defence.\n  const expectedAudience = config.audience === false ? undefined : (config.audience ?? config.resourceUrl)\n  if (expectedAudience !== undefined && !audienceMatches(authInfo.aud, expectedAudience)) {\n    return buildErrorResult(invalidToken('Token audience mismatch'), resourceMetadataUrl)\n  }\n\n  if (config.requiredScopes?.length) {\n    const scopes = authInfo.scopes ?? []\n    const hasAll = config.requiredScopes.every((s) => scopes.includes(s))\n    if (!hasAll) {\n      // Advertise the scopes to step up to (SEP-2350).\n      return buildErrorResult(insufficientScope(), resourceMetadataUrl, config.requiredScopes.join(' '))\n    }\n  }\n\n  return { auth: authInfo }\n}\n\n/**\n * True when the token's `aud` claim includes one of the expected values. A token\n * with no `aud` is allowed (the verifier may have bound the audience already);\n * a present-but-mismatched `aud` is rejected.\n */\nfunction audienceMatches(tokenAud: unknown, expected: string | string[]): boolean {\n  if (tokenAud === undefined || tokenAud === null) { return true }\n  const have = Array.isArray(tokenAud) ? tokenAud : [tokenAud]\n  const want = Array.isArray(expected) ? expected : [expected]\n  return have.some((a) => want.includes(a as string))\n}\n\nfunction buildChallengeResult(resourceMetadataUrl?: string): ValidateResult {\n  return {\n    error: {\n      statusCode: 401,\n      headers: {\n        'WWW-Authenticate': buildWWWAuthenticate(undefined, undefined, resourceMetadataUrl),\n        'Content-Type': 'application/json'\n      },\n      body: { error: 'missing_token', error_description: 'No authorization provided' }\n    }\n  }\n}\n\nfunction buildErrorResult(\n  err: AuthError,\n  resourceMetadataUrl?: string,\n  scope?: string\n): ValidateResult {\n  return {\n    error: {\n      statusCode: err.statusCode,\n      headers: {\n        'WWW-Authenticate': buildWWWAuthenticate(err.code, err.message, resourceMetadataUrl, scope),\n        'Content-Type': 'application/json'\n      },\n      body: { error: err.code, error_description: err.message }\n    }\n  }\n}\n"],"mappings":";AAAA,IAAa,YAAb,cAA+B,MAAM;CACnC,YACE,SACA,MACA,aAA6B,KAC7B;AACA,QAAM,QAAQ;AAHE,OAAA,OAAA;AACA,OAAA,aAAA;AAGhB,OAAK,OAAO;;;AAIhB,SAAgB,aAAa,UAAU,iBAAiB;AACtD,QAAO,IAAI,UAAU,SAAS,iBAAiB,IAAI;;AAGrD,SAAgB,kBAAkB,UAAU,sBAAsB;AAChE,QAAO,IAAI,UAAU,SAAS,sBAAsB,IAAI;;;;AChB1D,SAAgB,mBAAmB,QAAkD;AACnF,KAAI,CAAC,OAAU,QAAO;AAEtB,QADc,mBAAmB,KAAK,OAC1B,GAAG,MAAM;;AAGvB,SAAgB,qBACd,OACA,aACA,qBACA,OACQ;CACR,MAAM,QAAkB,EAAE;AAC1B,KAAI,MACF,OAAM,KAAK,UAAU,MAAM,GAAG;AAEhC,KAAI,YACF,OAAM,KAAK,sBAAsB,YAAY,GAAG;AAElD,KAAI,oBACF,OAAM,KAAK,sBAAsB,oBAAoB,GAAG;AAG1D,KAAI,MACF,OAAM,KAAK,UAAU,MAAM,GAAG;AAEhC,QAAO,MAAM,SAAS,IAAI,UAAU,MAAM,KAAK,KAAK,KAAK;;;;ACnB3D,SAAgB,kCACd,aACA,sBACA,iBAC2B;AAC3B,QAAO;EACL,UAAU;EACV,uBAAuB;EACvB,GAAI,iBAAiB,SAAS,EAAE,kBAAkB,iBAAiB,GAAG,EAAE;EACxE,0BAA0B,CAAC,SAAS;EACrC;;;;ACHH,eAAsB,cACpB,qBACA,QACA,SACyB;CACzB,MAAM,WAAW,OAAO,YAAY;CACpC,MAAM,sBAAsB,OAAO,cAC/B,GAAG,OAAO,YAAY,yCACtB,KAAA;CAEJ,MAAM,QAAQ,mBAAmB,oBAAoB;AAErD,KAAI,CAAC,OAAO;AACV,MAAI,CAAC,SAAY,QAAO,EAAE;AAC1B,SAAO,qBAAqB,oBAAoB;;CAGlD,IAAI;AACJ,KAAI;AACF,aAAW,MAAM,OAAO,YAAY,OAAO,QAAQ;UAC5C,OAAO;AAEd,SAAO,iBADK,aAAa,iBAAiB,QAAQ,MAAM,UAAU,gBACvC,EAAE,oBAAoB;;AAGnD,KAAI,CAAC,SAEH,QAAO,iBADK,cACe,EAAE,oBAAoB;AAGnD,KAAI,SAAS,aAAa,SAAS,YAAY,KAAK,KAAK,GAAG,IAE1D,QAAO,iBADK,aAAa,oBACE,EAAE,oBAAoB;AAKnD,KAAI,OAAO,UAAU,OAAO,SAAS,QAAQ,YAAY,SAAS,QAAQ,OAAO,OAC/E,QAAO,iBAAiB,aAAa,wBAAwB,EAAE,oBAAoB;CAKrF,MAAM,mBAAmB,OAAO,aAAa,QAAQ,KAAA,IAAa,OAAO,YAAY,OAAO;AAC5F,KAAI,qBAAqB,KAAA,KAAa,CAAC,gBAAgB,SAAS,KAAK,iBAAiB,CACpF,QAAO,iBAAiB,aAAa,0BAA0B,EAAE,oBAAoB;AAGvF,KAAI,OAAO,gBAAgB,QAAQ;EACjC,MAAM,SAAS,SAAS,UAAU,EAAE;AAEpC,MAAI,CADW,OAAO,eAAe,OAAO,MAAM,OAAO,SAAS,EAAE,CACzD,CAET,QAAO,iBAAiB,mBAAmB,EAAE,qBAAqB,OAAO,eAAe,KAAK,IAAI,CAAC;;AAItG,QAAO,EAAE,MAAM,UAAU;;;;;;;AAQ3B,SAAS,gBAAgB,UAAmB,UAAsC;AAChF,KAAI,aAAa,KAAA,KAAa,aAAa,KAAQ,QAAO;CAC1D,MAAM,OAAO,MAAM,QAAQ,SAAS,GAAG,WAAW,CAAC,SAAS;CAC5D,MAAM,OAAO,MAAM,QAAQ,SAAS,GAAG,WAAW,CAAC,SAAS;AAC5D,QAAO,KAAK,MAAM,MAAM,KAAK,SAAS,EAAY,CAAC;;AAGrD,SAAS,qBAAqB,qBAA8C;AAC1E,QAAO,EACL,OAAO;EACL,YAAY;EACZ,SAAS;GACP,oBAAoB,qBAAqB,KAAA,GAAW,KAAA,GAAW,oBAAoB;GACnF,gBAAgB;GACjB;EACD,MAAM;GAAE,OAAO;GAAiB,mBAAmB;GAA6B;EACjF,EACF;;AAGH,SAAS,iBACP,KACA,qBACA,OACgB;AAChB,QAAO,EACL,OAAO;EACL,YAAY,IAAI;EAChB,SAAS;GACP,oBAAoB,qBAAqB,IAAI,MAAM,IAAI,SAAS,qBAAqB,MAAM;GAC3F,gBAAgB;GACjB;EACD,MAAM;GAAE,OAAO,IAAI;GAAM,mBAAmB,IAAI;GAAS;EAC1D,EACF"}

package/build/oauth.d.mts

@@ -0,0 +1,112 @@
+import { a as OAuthRequest, i as OAuthProvider, o as OAuthResponse, r as AuthInfo, t as AuthConfig } from "./types-BFhAEzlP.mjs";
+
+//#region src/provider/store.d.ts
+interface AuthCodeData {
+  clientId: string;
+  redirectUri: string;
+  codeChallenge: string;
+  codeChallengeMethod: string;
+  scopes: string[];
+  upstreamAccessToken: string;
+  upstreamIdToken?: string;
+  email?: string;
+  sub?: string;
+  expiresAt: number;
+}
+interface PendingAuthData {
+  clientId: string;
+  redirectUri: string;
+  codeChallenge: string;
+  codeChallengeMethod: string;
+  scope: string;
+  clientState: string;
+  resource?: string;
+  expiresAt: number;
+}
+interface ClientRegistration {
+  clientId: string;
+  clientSecret: string;
+  redirectUris: string[];
+  clientName?: string;
+  createdAt: number;
+}
+interface RefreshTokenData {
+  clientId: string;
+  scopes: string[];
+  email?: string;
+  sub?: string;
+  expiresAt: number;
+}
+interface OAuthStore {
+  saveAuthCode(code: string, data: AuthCodeData): Promise<void>;
+  getAuthCode(code: string): Promise<AuthCodeData | undefined>;
+  deleteAuthCode(code: string): Promise<void>;
+  savePendingAuth(state: string, data: PendingAuthData): Promise<void>;
+  getPendingAuth(state: string): Promise<PendingAuthData | undefined>;
+  deletePendingAuth(state: string): Promise<void>;
+  savePkceVerifier(state: string, verifier: string): Promise<void>;
+  getPkceVerifier(state: string): Promise<string | undefined>;
+  deletePkceVerifier(state: string): Promise<void>;
+  saveClient(clientId: string, data: ClientRegistration): Promise<void>;
+  getClient(clientId: string): Promise<ClientRegistration | undefined>;
+  saveRefreshToken(token: string, data: RefreshTokenData): Promise<void>;
+  getRefreshToken(token: string): Promise<RefreshTokenData | undefined>;
+  deleteRefreshToken(token: string): Promise<void>;
+}
+//#endregion
+//#region src/provider/google.d.ts
+interface GoogleOAuthOptions {
+  clientId: string;
+  clientSecret: string;
+  resourceUrl: string;
+  redirectUris: string[];
+  requiredScopes?: string[];
+  callbackPath?: string;
+  signingKey?: string;
+  tokenTtl?: number;
+  store?: OAuthStore;
+}
+declare function google(options: GoogleOAuthOptions): AuthConfig;
+//#endregion
+//#region src/provider/proxy.d.ts
+interface OAuthProxyConfig {
+  authorizeUrl: string;
+  tokenUrl: string;
+  userinfoUrl?: string;
+  clientId: string;
+  clientSecret: string;
+  resourceUrl: string;
+  redirectUris: string[];
+  requiredScopes?: string[];
+  callbackPath?: string;
+  signingKey?: string;
+  tokenTtl?: number;
+  store?: OAuthStore;
+}
+declare function createOAuthProxy(config: OAuthProxyConfig): OAuthProvider;
+//#endregion
+//#region src/provider/uri.d.ts
+declare function matchRedirectUri(uri: string, patterns: string[]): boolean;
+//#endregion
+//#region src/store/json-store.d.ts
+declare function createJsonStore(path: string): OAuthStore;
+//#endregion
+//#region src/store/memory-store.d.ts
+declare function createMemoryStore(): OAuthStore;
+//#endregion
+//#region src/store/redis-store.d.ts
+interface RedisClient {
+  get(key: string): Promise<unknown>;
+  set(key: string, value: string, options?: {
+    ex?: number;
+  }): Promise<unknown>;
+  del(key: string): Promise<unknown>;
+}
+interface RedisStoreOptions {
+  client: RedisClient;
+  prefix?: string;
+}
+declare function createRedisStore(options: RedisStoreOptions): OAuthStore;
+//#endregion
+export { AuthCodeData, AuthInfo, ClientRegistration, GoogleOAuthOptions, OAuthProvider, OAuthProxyConfig, OAuthRequest, OAuthResponse, OAuthStore, PendingAuthData, RedisClient, RedisStoreOptions, RefreshTokenData, createJsonStore, createMemoryStore, createOAuthProxy, createRedisStore, google, matchRedirectUri };
+//# sourceMappingURL=oauth.d.mts.map

package/build/oauth.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.mts","names":[],"sources":["../src/provider/store.ts","../src/provider/google.ts","../src/provider/proxy.ts","../src/provider/uri.ts","../src/store/json-store.ts","../src/store/memory-store.ts","../src/store/redis-store.ts"],"mappings":";;;UAAiB,YAAA;EACf,QAAA;EACA,WAAA;EACA,aAAA;EACA,mBAAA;EACA,MAAA;EACA,mBAAA;EACA,eAAA;EACA,KAAA;EACA,GAAA;EACA,SAAA;AAAA;AAAA,UAGe,eAAA;EACf,QAAA;EACA,WAAA;EACA,aAAA;EACA,mBAAA;EACA,KAAA;EACA,WAAA;EACA,QAAA;EACA,SAAA;AAAA;AAAA,UAGe,kBAAA;EACf,QAAA;EACA,YAAA;EACA,YAAA;EACA,UAAA;EACA,SAAA;AAAA;AAAA,UAGe,gBAAA;EACf,QAAA;EACA,MAAA;EACA,KAAA;EACA,GAAA;EACA,SAAA;AAAA;AAAA,UAGe,UAAA;EACf,YAAA,CAAa,IAAA,UAAc,IAAA,EAAM,YAAA,GAAe,OAAA;EAChD,WAAA,CAAY,IAAA,WAAe,OAAA,CAAQ,YAAA;EACnC,cAAA,CAAe,IAAA,WAAe,OAAA;EAE9B,eAAA,CAAgB,KAAA,UAAe,IAAA,EAAM,eAAA,GAAkB,OAAA;EACvD,cAAA,CAAe,KAAA,WAAgB,OAAA,CAAQ,eAAA;EACvC,iBAAA,CAAkB,KAAA,WAAgB,OAAA;EAElC,gBAAA,CAAiB,KAAA,UAAe,QAAA,WAAmB,OAAA;EACnD,eAAA,CAAgB,KAAA,WAAgB,OAAA;EAChC,kBAAA,CAAmB,KAAA,WAAgB,OAAA;EAEnC,UAAA,CAAW,QAAA,UAAkB,IAAA,EAAM,kBAAA,GAAqB,OAAA;EACxD,SAAA,CAAU,QAAA,WAAmB,OAAA,CAAQ,kBAAA;EAErC,gBAAA,CAAiB,KAAA,UAAe,IAAA,EAAM,gBAAA,GAAmB,OAAA;EACzD,eAAA,CAAgB,KAAA,WAAgB,OAAA,CAAQ,gBAAA;EACxC,kBAAA,CAAmB,KAAA,WAAgB,OAAA;AAAA;;;UCtDpB,kBAAA;EACf,QAAA;EACA,YAAA;EACA,WAAA;EACA,YAAA;EACA,cAAA;EACA,YAAA;EACA,UAAA;EACA,QAAA;EACA,KAAA,GAAQ,UAAA;AAAA;AAAA,iBAGM,MAAA,CAAO,OAAA,EAAS,kBAAA,GAAqB,UAAA;;;UCTpC,gBAAA;EACf,YAAA;EACA,QAAA;EACA,WAAA;EACA,QAAA;EACA,YAAA;EACA,WAAA;EACA,YAAA;EACA,cAAA;EACA,YAAA;EACA,UAAA;EACA,QAAA;EACA,KAAA,GAAQ,UAAA;AAAA;AAAA,iBA2SM,gBAAA,CAAiB,MAAA,EAAQ,gBAAA,GAAmB,aAAA;;;iBC9T5C,gBAAA,CAAiB,GAAA,UAAa,QAAA;;;iBCwC9B,eAAA,CAAgB,IAAA,WAAe,UAAA;;;iBC5B/B,iBAAA,CAAA,GAAqB,UAAA;;;UCVpB,WAAA;EACf,GAAA,CAAI,GAAA,WAAc,OAAA;EAClB,GAAA,CAAI,GAAA,UAAa,KAAA,UAAe,OAAA;IAAY,EAAA;EAAA,IAAgB,OAAA;EAC5D,GAAA,CAAI,GAAA,WAAc,OAAA;AAAA;AAAA,UAGH,iBAAA;EACf,MAAA,EAAQ,WAAA;EACR,MAAA;AAAA;AAAA,iBAGc,gBAAA,CAAiB,OAAA,EAAS,iBAAA,GAAoB,UAAA"}