@spfn/auth 0.3.0-beta.17 → 0.3.0-beta.19

package/dist/{machine-principals-nrpFSvvB.d.ts → machine-principals-BD4tnASp.d.ts}

@@ -1592,6 +1592,138 @@ interface OAuthNativeResult {
  */
 declare function oauthNativeService(params: OAuthNativeParams): Promise<OAuthNativeResult>;
 
+/**
+ * OAuth 2.1 Authorize Service
+ *
+ * The API half of the consent screen. The screen itself is a page on the web
+ * app, because that is where the session cookie is; it has no database, so it
+ * asks here what to draw (`describeOAuth2AuthorizeRequest`) and tells here what
+ * the user decided (`approveOAuth2Authorize` / `denyOAuth2Authorize`). Both
+ * calls validate the request from scratch — the second must never trust what the
+ * first was shown, since a form can be edited between them.
+ *
+ * Refusals come in two kinds and the split is the security property, not a
+ * presentation choice:
+ *
+ * - **Not redirectable.** An unknown `client_id`, or a `redirect_uri` the client
+ *   never registered. There is no vetted URI to send the error to, and sending
+ *   it to the one the request supplied is precisely the open redirect the
+ *   registration check exists to prevent. These are shown on the screen.
+ * - **Redirectable.** Everything else — a missing PKCE challenge, a missing
+ *   `resource`, an unknown scope, and the user saying no. The client and its
+ *   URI are both vetted by then, so RFC 6749 §4.1.2.1 puts the error back on
+ *   that URI as query parameters, which is the only form the waiting CLI can
+ *   read.
+ */
+/** An authorize request as the web handler forwards it, before anything is trusted. */
+interface OAuth2AuthorizeParams {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge?: string;
+    codeChallengeMethod?: string;
+    resource?: string;
+    scope?: string;
+    state?: string;
+}
+/** One scope, with the sentence the consent screen shows for it. */
+interface OAuth2ScopeDescription {
+    name: string;
+    description: string;
+}
+/** Everything the consent screen needs, and nothing it does not. */
+interface OAuth2ConsentView {
+    clientName: string;
+    /** Host the code would be sent to — the one fact about the client that is checkable. */
+    redirectHost: string;
+    scopes: OAuth2ScopeDescription[];
+    resource: string;
+}
+/** What the web handler turns into the success redirect. */
+interface OAuth2AuthorizationCodeIssued {
+    code: string;
+    /** The presented URI, which matched a registered one. Safe to redirect to. */
+    redirectUri: string;
+    /** Echoed back verbatim, or absent when the request carried none. */
+    state?: string;
+}
+/**
+ * What to draw on the consent screen for this request.
+ *
+ * Read-only: nothing is recorded by looking, so a user who closes the tab has
+ * consented to nothing and left nothing behind.
+ */
+declare function describeOAuth2AuthorizeRequestService(params: OAuth2AuthorizeParams): Promise<OAuth2ConsentView>;
+/**
+ * Record the consent and mint the code.
+ *
+ * The whole request is validated again rather than carried over from the GET:
+ * the form between the two is in the user's browser, and a parameter changed
+ * there must be caught here and not honoured because the screen once looked
+ * right.
+ *
+ * `userId` comes from the approving session. Never from a request body — that
+ * would be the entire authorization.
+ */
+declare function approveOAuth2AuthorizeService(params: OAuth2AuthorizeParams, userId: number): Promise<OAuth2AuthorizationCodeIssued>;
+/**
+ * The user said no.
+ *
+ * Validated first, and validated in full — the same `validate` the approval
+ * runs. `access_denied` goes back to the client on its redirect URI like any
+ * other redirectable error, so the URI has to be one the client registered
+ * before anybody is sent to it; and a request that was malformed was malformed
+ * whichever button was pressed, so answering `access_denied` to it would tell
+ * the waiting client the user refused when in fact it never asked properly.
+ * Nothing is recorded — a refusal is not a grant with a flag on it.
+ */
+declare function denyOAuth2AuthorizeService(params: OAuth2AuthorizeParams): Promise<never>;
+
+/**
+ * OAuth 2.1 Grant Service
+ *
+ * The user's side of the authorization server: what is connected, and the button
+ * that disconnects it. A grant is the unit because it is the thing a person can
+ * recognise — "Claude Code, on this API, with these permissions" — and because
+ * revoking it takes every code and token underneath with it.
+ *
+ * `revokeAllOAuth2GrantsForUser` is the same act performed on the user's behalf
+ * rather than by them, and it sits at the four places that revoke everything:
+ * revoke-all, a password change, a completed password reset, a deletion request.
+ * A global revocation that left a grant alive would leave a refresh token alive,
+ * and a CLI holding one would be signed in again within the hour — which is
+ * exactly the device the user was cutting off.
+ */
+/** One connected client, as the account settings screen lists it. */
+interface OAuth2GrantSummary {
+    id: number;
+    clientId: string;
+    clientName: string;
+    resource: string;
+    scopes: string[];
+    createdAtMillis: number;
+    lastUsedAtMillis?: number;
+}
+/** What a user has connected. Revoked grants are not listed — they are gone. */
+declare function listOAuth2GrantsService(userId: number): Promise<OAuth2GrantSummary[]>;
+/**
+ * Disconnect one client.
+ *
+ * The user id is part of the statement's condition, not a check before it: the
+ * id comes from a URL, and a grant belonging to somebody else must answer as if
+ * it did not exist rather than as if it were merely not theirs.
+ */
+declare function revokeOAuth2GrantService(id: number, userId: number): Promise<void>;
+/**
+ * Revoke every grant a user has — the authorization-server half of a global
+ * revocation, called beside `deviceAuthorizationsRepository.denyAllActiveByUserId`.
+ *
+ * Tokens are revoked as well as the grants. Verification already refuses a token
+ * whose grant is dead, so this changes no decision; it means a `SELECT` against
+ * `oauth2_tokens` after a revoke-all does not show live-looking rows, which is
+ * the sort of thing that gets read as a hole.
+ */
+declare function revokeAllOAuth2GrantsForUser(userId: number): Promise<void>;
+
 /**
  * @spfn/auth - Main Router
  *
@@ -1608,6 +1740,7 @@ declare function oauthNativeService(params: OAuthNativeParams): Promise<OAuthNat
  * - Users: /_auth/users/*
  * - Deletion: /_auth/deletion/request, /_auth/deletion/cancel
  * - Admin: /_auth/admin/* (superadmin only)
+ * - OAuth 2.1 authorization server: /_auth/oauth2/*, /.well-known/oauth-authorization-server
  */
 declare const mainAuthRouter: _spfn_core_route.Router<{
     sendVerificationCode: _spfn_core_route.RouteDef<{
@@ -2272,6 +2405,43 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             createdAt: string | null;
         };
     }>;
+    registerOAuth2Client: _spfn_core_route.RouteDef<{}, {}, Response>;
+    getOAuth2Authorize: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            client_id: _sinclair_typebox.TString;
+            redirect_uri: _sinclair_typebox.TString;
+            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, OAuth2ConsentView>;
+    createOAuth2AuthorizationCode: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            approve: _sinclair_typebox.TBoolean;
+            client_id: _sinclair_typebox.TString;
+            redirect_uri: _sinclair_typebox.TString;
+            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, OAuth2AuthorizationCodeIssued>;
+    oauth2Token: _spfn_core_route.RouteDef<{}, {}, Response>;
+    oauth2Revoke: _spfn_core_route.RouteDef<{}, {}, Response>;
+    listOAuth2Grants: _spfn_core_route.RouteDef<{}, {}, {
+        grants: OAuth2GrantSummary[];
+    }>;
+    revokeOAuth2Grant: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            id: _sinclair_typebox.TNumber;
+        }>;
+    }, {}, {
+        revoked: boolean;
+    }>;
+    oauth2AuthorizationServerMetadata: _spfn_core_route.RouteDef<{}, {}, Response>;
 }>;
 
 /**
@@ -2566,4 +2736,4 @@ declare const machineAuth: _spfn_core_route.NamedMiddleware<"machineAuth">;
  */
 declare const requireMachineScope: _spfn_core_route.NamedMiddlewareFactory<"machineScope", string[]>;
 
-export { KeyIdSchema as $, type AuthInitOptions as A, type ConfirmPasswordResetParams as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type ConfirmSignupLinkParams as E, type FinishPasskeyEnrollmentResult as F, type DenyDeviceAuthParams as G, type DeviceAuthApprovedResult as H, type IssueOneTimeTokenResult as I, type DeviceAuthInfoParams as J, type KeySummary as K, type LoginResult as L, type DeviceAuthPendingResult as M, type NewPasskey as N, type OAuthStartResult as O, type PermissionConfig as P, DeviceAuthPollResponseSchema as Q, type RoleConfig as R, type SendVerificationCodeResult as S, DeviceNameSchema as T, type UserProfile as U, VERIFICATION_PURPOSES as V, EmailSchema as W, FingerprintSchema as X, type FinishPasskeyEnrollmentParams as Y, type FinishPasskeyLoginParams as Z, KEY_FINGERPRINT_PREFIX_LENGTH as _, type RegisterResult as a, issueOneTimeTokenService as a$, type LoginParams as a0, type LogoutParams as a1, type MachinePrincipal as a2, type MachineVerifierRegistration as a3, type NativeVerifyOptions as a4, type NormalizedIdentity as a5, type OAuthCallbackParams as a6, type OAuthCallbackResult as a7, type OAuthCodeExchangeOptions as a8, type OAuthNativeParams as a9, UnlinkNotifyRejection as aA, type UnlinkNotifyRequest as aB, type UnlinkNotifyResult as aC, UserCodeSchema as aD, VerificationPurposeSchema as aE, type VerifyCodeParams as aF, type VerifyCodeResult as aG, approveDeviceAuthService as aH, assertNotLastRecoveryCredential as aI, assertRecentAuthentication as aJ, authenticate as aK, buildOAuthErrorUrl as aL, changePasswordService as aM, completePasswordResetService as aN, completeSignupService as aO, confirmPasswordResetService as aP, confirmSignupLinkService as aQ, denyDeviceAuthService as aR, finishPasskeyEnrollmentService as aS, finishPasskeyLoginService as aT, getDeviceAuthInfoService as aU, getEnabledOAuthProviders as aV, getGoogleAccessToken as aW, getMachinePrincipal as aX, getOAuthProvider as aY, getRegisteredProviders as aZ, isOAuthProviderEnabled as a_, type OAuthStartParams as aa, type OAuthTokens as ab, PASSKEY_DEVICE_TYPES as ac, PASSKEY_LABEL_MAX_LENGTH as ad, type PasskeyDeviceType as ae, PasswordSchema as af, PhoneSchema as ag, PlatformSchema as ah, type PollDeviceAuthParams as ai, type PollDeviceAuthResult as aj, PublicKeySchema as ak, type RecentAuthenticationParams as al, type RegisterParams as am, type RegisterPublicKeyParams as an, type RenamePasskeyParams as ao, type RequestPasswordResetParams as ap, type RequestSignupLinkParams as aq, type RevokeAllKeysParams as ar, type RevokeKeyParams as as, type RevokePasskeyParams as at, type RotateKeyParams as au, type SendVerificationCodeParams as av, type StartDeviceAuthParams as aw, type StartPasskeyEnrollmentParams as ax, TargetTypeSchema as ay, type UnlinkNotification as az, type RequestSignupLinkResult as b, listKeysService as b0, listPasskeysService as b1, loginService as b2, logoutService as b3, machineAuth as b4, oauthCallbackService as b5, oauthNativeService as b6, oauthStartService as b7, oauthUnlinkNotifyService as b8, optionalAuth as b9, passkeys as ba, pollDeviceAuthService as bb, registerAuthProfile as bc, registerMachineVerifier as bd, registerOAuthProvider as be, registerPublicKeyService as bf, registerService as bg, renamePasskeyService as bh, requestPasswordResetService as bi, requestSignupLinkService as bj, requireEnabledProvider as bk, requireMachineScope as bl, resolveAuthenticatedUser as bm, revokeAllKeysService as bn, revokeKeyService as bo, revokePasskeyService as bp, rotateKeyService as bq, runAuthProfile as br, selectAuthProfile as bs, sendVerificationCodeService as bt, startDeviceAuthService as bu, startPasskeyEnrollmentService as bv, startPasskeyLoginService as bw, verifyCodeService as bx, verifyOneTimeTokenService as by, type RequestPasswordResetResult as c, type ConfirmPasswordResetResult as d, type StartDeviceAuthResult as e, type PasskeySummary as f, type RotateKeyResult as g, type RevokeAllKeysResult as h, type OAuthNativeResult as i, type ProfileInfo as j, type AuthSession as k, PERMISSION_CATEGORIES as l, mainAuthRouter as m, type PermissionCategory as n, VERIFICATION_TARGET_TYPES as o, type VerificationPurpose as p, type VerificationTargetType as q, type OAuthProvider as r, type Passkey as s, type AuthContext as t, type ApproveDeviceAuthParams as u, type AuthProfileOutcome as v, type AuthProfileVerifier as w, type ChangePasswordParams as x, type CompletePasswordResetParams as y, type CompleteSignupParams as z };
+export { type FinishPasskeyEnrollmentParams as $, type AuthInitOptions as A, type ChangePasswordParams as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type CompletePasswordResetParams as E, type FinishPasskeyEnrollmentResult as F, type CompleteSignupParams as G, type ConfirmPasswordResetParams as H, type IssueOneTimeTokenResult as I, type ConfirmSignupLinkParams as J, type KeySummary as K, type LoginResult as L, type DenyDeviceAuthParams as M, type NewPasskey as N, type OAuthStartResult as O, type PermissionConfig as P, type DeviceAuthApprovedResult as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type DeviceAuthInfoParams as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type DeviceAuthPendingResult as W, DeviceAuthPollResponseSchema as X, DeviceNameSchema as Y, EmailSchema as Z, FingerprintSchema as _, type RegisterResult as a, finishPasskeyLoginService as a$, type FinishPasskeyLoginParams as a0, KEY_FINGERPRINT_PREFIX_LENGTH as a1, KeyIdSchema as a2, type LoginParams as a3, type LogoutParams as a4, type MachinePrincipal as a5, type MachineVerifierRegistration as a6, type NativeVerifyOptions as a7, type NormalizedIdentity as a8, type OAuth2AuthorizeParams as a9, type SendVerificationCodeParams as aA, type StartDeviceAuthParams as aB, type StartPasskeyEnrollmentParams as aC, TargetTypeSchema as aD, type UnlinkNotification as aE, UnlinkNotifyRejection as aF, type UnlinkNotifyRequest as aG, type UnlinkNotifyResult as aH, UserCodeSchema as aI, VerificationPurposeSchema as aJ, type VerifyCodeParams as aK, type VerifyCodeResult as aL, approveDeviceAuthService as aM, approveOAuth2AuthorizeService as aN, assertNotLastRecoveryCredential as aO, assertRecentAuthentication as aP, authenticate as aQ, buildOAuthErrorUrl as aR, changePasswordService as aS, completePasswordResetService as aT, completeSignupService as aU, confirmPasswordResetService as aV, confirmSignupLinkService as aW, denyDeviceAuthService as aX, denyOAuth2AuthorizeService as aY, describeOAuth2AuthorizeRequestService as aZ, finishPasskeyEnrollmentService as a_, type OAuth2ScopeDescription as aa, type OAuthCallbackParams as ab, type OAuthCallbackResult as ac, type OAuthCodeExchangeOptions as ad, type OAuthNativeParams as ae, type OAuthStartParams as af, type OAuthTokens as ag, PASSKEY_DEVICE_TYPES as ah, PASSKEY_LABEL_MAX_LENGTH as ai, type PasskeyDeviceType as aj, PasswordSchema as ak, PhoneSchema as al, PlatformSchema as am, type PollDeviceAuthParams as an, type PollDeviceAuthResult as ao, PublicKeySchema as ap, type RecentAuthenticationParams as aq, type RegisterParams as ar, type RegisterPublicKeyParams as as, type RenamePasskeyParams as at, type RequestPasswordResetParams as au, type RequestSignupLinkParams as av, type RevokeAllKeysParams as aw, type RevokeKeyParams as ax, type RevokePasskeyParams as ay, type RotateKeyParams as az, type RequestSignupLinkResult as b, getDeviceAuthInfoService as b0, getEnabledOAuthProviders as b1, getGoogleAccessToken as b2, getMachinePrincipal as b3, getOAuthProvider as b4, getRegisteredProviders as b5, isOAuthProviderEnabled as b6, issueOneTimeTokenService as b7, listKeysService as b8, listOAuth2GrantsService as b9, revokePasskeyService as bA, rotateKeyService as bB, runAuthProfile as bC, selectAuthProfile as bD, sendVerificationCodeService as bE, startDeviceAuthService as bF, startPasskeyEnrollmentService as bG, startPasskeyLoginService as bH, verifyCodeService as bI, verifyOneTimeTokenService as bJ, listPasskeysService as ba, loginService as bb, logoutService as bc, machineAuth as bd, oauthCallbackService as be, oauthNativeService as bf, oauthStartService as bg, oauthUnlinkNotifyService as bh, optionalAuth as bi, passkeys as bj, pollDeviceAuthService as bk, registerAuthProfile as bl, registerMachineVerifier as bm, registerOAuthProvider as bn, registerPublicKeyService as bo, registerService as bp, renamePasskeyService as bq, requestPasswordResetService as br, requestSignupLinkService as bs, requireEnabledProvider as bt, requireMachineScope as bu, resolveAuthenticatedUser as bv, revokeAllKeysService as bw, revokeAllOAuth2GrantsForUser as bx, revokeKeyService as by, revokeOAuth2GrantService as bz, type RequestPasswordResetResult as c, type ConfirmPasswordResetResult as d, type StartDeviceAuthResult as e, type PasskeySummary as f, type RotateKeyResult as g, type RevokeAllKeysResult as h, type OAuthNativeResult as i, type ProfileInfo as j, type OAuth2ConsentView as k, type OAuth2AuthorizationCodeIssued as l, mainAuthRouter as m, type OAuth2GrantSummary as n, type AuthSession as o, PERMISSION_CATEGORIES as p, type PermissionCategory as q, VERIFICATION_TARGET_TYPES as r, type VerificationPurpose as s, type VerificationTargetType as t, type OAuthProvider as u, type Passkey as v, type AuthContext as w, type ApproveDeviceAuthParams as x, type AuthProfileOutcome as y, type AuthProfileVerifier as z };

package/dist/nextjs/api.js

@@ -285,8 +285,13 @@ function getCsrfMode() {
   }
   return normalized;
 }
+var PACKAGE_CSRF_EXEMPT_PATHS = [
+  "/_auth/oauth2/register",
+  "/_auth/oauth2/token",
+  "/_auth/oauth2/revoke"
+];
 function getCsrfExemptPaths() {
-  return globalConfig.csrf?.exemptPaths ?? [];
+  return [...PACKAGE_CSRF_EXEMPT_PATHS, ...globalConfig.csrf?.exemptPaths ?? []];
 }
 
 // src/nextjs/interceptors/cookie-options.ts