@stacksjs/auth 0.70.258 → 0.70.259

package/dist/token.js

@@ -1,21 +1 @@
-import { Buffer } from "node:buffer";
-import { createHmac, randomBytes } from "node:crypto";
-import process from "node:process";
-
-export class TokenManager {
-  static generateJWT(userId, expiresInSeconds = 3600) {
-    const appKey = process.env.APP_KEY;
-    if (!appKey)
-      throw Error("APP_KEY is not set. JWT tokens cannot be generated without a secure application key.");
-    const header = {
-      alg: "HS256",
-      typ: "JWT"
-    }, nowSeconds = Math.floor(Date.now() / 1000), payload = {
-      sub: userId,
-      iat: nowSeconds,
-      exp: nowSeconds + expiresInSeconds,
-      jti: randomBytes(16).toString("hex")
-    }, encodedHeader = Buffer.from(JSON.stringify(header)).toString("base64url"), encodedPayload = Buffer.from(JSON.stringify(payload)).toString("base64url"), signature = createHmac("sha256", appKey).update(`${encodedHeader}.${encodedPayload}`).digest("base64url");
-    return `${encodedHeader}.${encodedPayload}.${signature}`;
-  }
-}
+import{Buffer}from"node:buffer";import{createHmac,randomBytes}from"node:crypto";import process from"node:process";export class TokenManager{static generateJWT(userId,expiresInSeconds=3600){const appKey=process.env.APP_KEY;if(!appKey)throw Error("APP_KEY is not set. JWT tokens cannot be generated without a secure application key.");const header={alg:"HS256",typ:"JWT"},nowSeconds=Math.floor(Date.now()/1000),payload={sub:userId,iat:nowSeconds,exp:nowSeconds+expiresInSeconds,jti:randomBytes(16).toString("hex")},encodedHeader=Buffer.from(JSON.stringify(header)).toString("base64url"),encodedPayload=Buffer.from(JSON.stringify(payload)).toString("base64url"),signature=createHmac("sha256",appKey).update(`${encodedHeader}.${encodedPayload}`).digest("base64url");return`${encodedHeader}.${encodedPayload}.${signature}`}}

package/dist/tokens.js

@@ -1,209 +1,35 @@
-import process from "node:process";
-import { createHash, randomBytes } from "node:crypto";
-import { db } from "@stacksjs/database";
-import { HttpError } from "@stacksjs/error-handling";
-import { getCurrentRequest } from "@stacksjs/router";
-import { env } from "@stacksjs/env";
-import { parseSqlDateTime, sqlDateTime, sqlDateTimeLiteral, sqlHelpers } from "@stacksjs/database";
-const dbDriver = env.DB_CONNECTION || "sqlite", sql = sqlHelpers(dbDriver), { isPostgres, isMysql, now, boolTrue, boolFalse } = sql;
-function appNow() {
-  return sqlDateTimeLiteral();
-}
-function param(index) {
-  return sql.param(index);
-}
-function hashToken(token) {
-  return createHash("sha256").update(token).digest("hex");
-}
-function bearerLookupHash(bearer) {
-  const colonIdx = bearer.indexOf(":"), lookup = colonIdx === -1 ? bearer : bearer.substring(0, colonIdx);
-  return hashToken(lookup);
-}
-function generateSecureToken(bytes = 40) {
-  return randomBytes(bytes).toString("hex");
-}
-export async function getPasswordChangedAt(userId, q = db) {
-  if (userId === null || userId === void 0)
-    return null;
-  try {
-    const value = (await q.unsafe(`
+import process from"node:process";import{createHash,randomBytes}from"node:crypto";import{db}from"@stacksjs/database";import{HttpError}from"@stacksjs/error-handling";import{getCurrentRequest}from"@stacksjs/router";import{env}from"@stacksjs/env";import{parseSqlDateTime,sqlDateTime,sqlDateTimeLiteral,sqlHelpers}from"@stacksjs/database";const dbDriver=env.DB_CONNECTION||"sqlite",sql=sqlHelpers(dbDriver),{isPostgres,isMysql,now,boolTrue,boolFalse}=sql;function appNow(){return sqlDateTimeLiteral()}function param(index){return sql.param(index)}function hashToken(token){return createHash("sha256").update(token).digest("hex")}function bearerLookupHash(bearer){const colonIdx=bearer.indexOf(":"),lookup=colonIdx===-1?bearer:bearer.substring(0,colonIdx);return hashToken(lookup)}function generateSecureToken(bytes=40){return randomBytes(bytes).toString("hex")}export async function getPasswordChangedAt(userId,q=db){if(userId===null||userId===void 0)return null;try{const value=(await q.unsafe(`
       SELECT password_changed_at FROM users WHERE id = ${param(1)} LIMIT 1
-    `, [userId]))[0]?.password_changed_at;
-    if (value === null || value === void 0)
-      return null;
-    return parseSqlDateTime(value);
-  } catch {
-    return null;
-  }
-}
-export function isIssuedBeforePasswordChange(createdAt, changedAt) {
-  if (!changedAt)
-    return !1;
-  if (createdAt === null || createdAt === void 0)
-    return !1;
-  const created = parseSqlDateTime(createdAt);
-  if (!created)
-    return !1;
-  return created.getTime() < changedAt.getTime();
-}
-export async function tokens(userId) {
-  return (await db.unsafe(`
+    `,[userId]))[0]?.password_changed_at;if(value===null||value===void 0)return null;return parseSqlDateTime(value)}catch{return null}}export function isIssuedBeforePasswordChange(createdAt,changedAt){if(!changedAt)return!1;if(createdAt===null||createdAt===void 0)return!1;const created=parseSqlDateTime(createdAt);if(!created)return!1;return created.getTime()<changedAt.getTime()}export async function tokens(userId){return(await db.unsafe(`
     SELECT t.*, c.provider as client_provider
     FROM oauth_access_tokens t
     LEFT JOIN oauth_clients c ON t.oauth_client_id = c.id
     WHERE t.user_id = ${param(1)}
     AND t.revoked = ${boolFalse}
     ORDER BY t.created_at DESC
-  `, [userId])).map((row) => ({
-    id: row.id,
-    userId: row.user_id,
-    clientId: row.oauth_client_id,
-    name: row.name || "access-token",
-    scopes: parseScopes(row.scopes),
-    revoked: !!row.revoked,
-    expiresAt: row.expires_at ? new Date(row.expires_at) : null,
-    createdAt: new Date(row.created_at),
-    updatedAt: row.updated_at ? new Date(row.updated_at) : new Date
-  }));
-}
-export async function findToken(plainTextToken) {
-  const hashedToken = bearerLookupHash(plainTextToken), row = (await db.unsafe(`
+  `,[userId])).map((row)=>({id:row.id,userId:row.user_id,clientId:row.oauth_client_id,name:row.name||"access-token",scopes:parseScopes(row.scopes),revoked:!!row.revoked,expiresAt:row.expires_at?new Date(row.expires_at):null,createdAt:new Date(row.created_at),updatedAt:row.updated_at?new Date(row.updated_at):new Date}))}export async function findToken(plainTextToken){const hashedToken=bearerLookupHash(plainTextToken),row=(await db.unsafe(`
     SELECT * FROM oauth_access_tokens
     WHERE token = ${param(1)}
     AND revoked = ${boolFalse}
     AND (expires_at IS NULL OR expires_at > ${appNow()})
     LIMIT 1
-  `, [hashedToken]))[0];
-  if (!row)
-    return null;
-  if (isIssuedBeforePasswordChange(row.created_at, await getPasswordChangedAt(row.user_id)))
-    return null;
-  return {
-    id: row.id,
-    userId: row.user_id,
-    clientId: row.oauth_client_id,
-    name: row.name || "access-token",
-    scopes: parseScopes(row.scopes),
-    revoked: !!row.revoked,
-    expiresAt: row.expires_at ? new Date(row.expires_at) : null,
-    createdAt: new Date(row.created_at),
-    updatedAt: row.updated_at ? new Date(row.updated_at) : new Date
-  };
-}
-export async function currentAccessToken() {
-  const request = getCurrentRequest();
-  if (!request)
-    return null;
-  const attached = request._currentAccessToken;
-  if (attached)
-    return attached;
-  const bearerToken = request.bearerToken?.();
-  if (!bearerToken)
-    return null;
-  const token = await findToken(bearerToken);
-  if (token)
-    request._currentAccessToken = token;
-  return token;
-}
-export const token = currentAccessToken;
-export async function tokenCan(scope) {
-  const accessToken = await currentAccessToken();
-  if (!accessToken)
-    return !1;
-  if (accessToken.scopes.includes("*"))
-    return !0;
-  return accessToken.scopes.includes(scope);
-}
-export async function tokenCant(scope) {
-  return !await tokenCan(scope);
-}
-export async function tokenCanAll(scopes) {
-  const accessToken = await currentAccessToken();
-  if (!accessToken)
-    return !1;
-  if (accessToken.scopes.includes("*"))
-    return !0;
-  return scopes.every((scope) => accessToken.scopes.includes(scope));
-}
-export async function tokenCanAny(scopes) {
-  const accessToken = await currentAccessToken();
-  if (!accessToken)
-    return !1;
-  if (accessToken.scopes.includes("*"))
-    return !0;
-  return scopes.some((scope) => accessToken.scopes.includes(scope));
-}
-export async function tokenAbilities() {
-  return (await currentAccessToken())?.scopes || [];
-}
-export async function createToken(userId, name = "access-token", scopes = ["*"], options = {}) {
-  const {
-    expiresInMinutes = 60,
-    withRefreshToken = !0,
-    refreshExpiresInDays = 30
-  } = options, client = (await db.unsafe(`
+  `,[hashedToken]))[0];if(!row)return null;if(isIssuedBeforePasswordChange(row.created_at,await getPasswordChangedAt(row.user_id)))return null;return{id:row.id,userId:row.user_id,clientId:row.oauth_client_id,name:row.name||"access-token",scopes:parseScopes(row.scopes),revoked:!!row.revoked,expiresAt:row.expires_at?new Date(row.expires_at):null,createdAt:new Date(row.created_at),updatedAt:row.updated_at?new Date(row.updated_at):new Date}}export async function currentAccessToken(){const request=getCurrentRequest();if(!request)return null;const attached=request._currentAccessToken;if(attached)return attached;const bearerToken=request.bearerToken?.();if(!bearerToken)return null;const token=await findToken(bearerToken);if(token)request._currentAccessToken=token;return token}export const token=currentAccessToken;export async function tokenCan(scope){const accessToken=await currentAccessToken();if(!accessToken)return!1;if(accessToken.scopes.includes("*"))return!0;return accessToken.scopes.includes(scope)}export async function tokenCant(scope){return!await tokenCan(scope)}export async function tokenCanAll(scopes){const accessToken=await currentAccessToken();if(!accessToken)return!1;if(accessToken.scopes.includes("*"))return!0;return scopes.every((scope)=>accessToken.scopes.includes(scope))}export async function tokenCanAny(scopes){const accessToken=await currentAccessToken();if(!accessToken)return!1;if(accessToken.scopes.includes("*"))return!0;return scopes.some((scope)=>accessToken.scopes.includes(scope))}export async function tokenAbilities(){return(await currentAccessToken())?.scopes||[]}export async function createToken(userId,name="access-token",scopes=["*"],options={}){const{expiresInMinutes=60,withRefreshToken=!0,refreshExpiresInDays=30}=options,client=(await db.unsafe(`
     SELECT id FROM oauth_clients WHERE personal_access_client = ${boolTrue} LIMIT 1
-  `))[0];
-  if (!client)
-    throw new HttpError(500, "No personal access client found. Run ./buddy auth:setup first.");
-  const plainTextToken = generateSecureToken(40), hashedToken = hashToken(plainTextToken), expiresAt = new Date;
-  expiresAt.setMinutes(expiresAt.getMinutes() + expiresInMinutes);
-  if (isPostgres)
-    await db.unsafe(`
+  `))[0];if(!client)throw new HttpError(500,"No personal access client found. Run ./buddy auth:setup first.");const plainTextToken=generateSecureToken(40),hashedToken=hashToken(plainTextToken),expiresAt=new Date;expiresAt.setMinutes(expiresAt.getMinutes()+expiresInMinutes);if(isPostgres)await db.unsafe(`
       INSERT INTO oauth_access_tokens (user_id, oauth_client_id, token, name, scopes, revoked, expires_at, created_at, updated_at)
       VALUES ($1, $2, $3, $4, $5, false, $6, ${appNow()}, ${appNow()})
-    `, [userId, client.id, hashedToken, name, JSON.stringify(scopes), sqlDateTime(expiresAt)]);
-  else
-    await db.unsafe(`
+    `,[userId,client.id,hashedToken,name,JSON.stringify(scopes),sqlDateTime(expiresAt)]);else await db.unsafe(`
       INSERT INTO oauth_access_tokens (user_id, oauth_client_id, token, name, scopes, revoked, expires_at, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, 0, ?, ${appNow()}, ${appNow()})
-    `, [userId, client.id, hashedToken, name, JSON.stringify(scopes), sqlDateTime(expiresAt)]);
-  const row = (await db.unsafe(`
+    `,[userId,client.id,hashedToken,name,JSON.stringify(scopes),sqlDateTime(expiresAt)]);const row=(await db.unsafe(`
     SELECT * FROM oauth_access_tokens WHERE token = ${param(1)} LIMIT 1
-  `, [hashedToken]))[0];
-  if (!row)
-    throw new HttpError(500, "Failed to create access token \u2014 inserted row not found");
-  const accessToken = {
-    id: row.id,
-    userId: row.user_id,
-    clientId: row.oauth_client_id,
-    name: row.name,
-    scopes: parseScopes(row.scopes),
-    revoked: !1,
-    expiresAt,
-    createdAt: new Date(row.created_at),
-    updatedAt: new Date(row.updated_at)
-  };
-  let refreshTokenPlain;
-  if (withRefreshToken) {
-    refreshTokenPlain = generateSecureToken(40);
-    const hashedRefreshToken = hashToken(refreshTokenPlain), refreshExpiresAt = new Date;
-    refreshExpiresAt.setDate(refreshExpiresAt.getDate() + refreshExpiresInDays);
-    if (isPostgres)
-      await db.unsafe(`
+  `,[hashedToken]))[0];if(!row)throw new HttpError(500,"Failed to create access token \u2014 inserted row not found");const accessToken={id:row.id,userId:row.user_id,clientId:row.oauth_client_id,name:row.name,scopes:parseScopes(row.scopes),revoked:!1,expiresAt,createdAt:new Date(row.created_at),updatedAt:new Date(row.updated_at)};let refreshTokenPlain;if(withRefreshToken){refreshTokenPlain=generateSecureToken(40);const hashedRefreshToken=hashToken(refreshTokenPlain),refreshExpiresAt=new Date;refreshExpiresAt.setDate(refreshExpiresAt.getDate()+refreshExpiresInDays);if(isPostgres)await db.unsafe(`
         INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
         VALUES ($1, $2, false, $3, ${appNow()})
-      `, [accessToken.id, hashedRefreshToken, sqlDateTime(refreshExpiresAt)]);
-    else
-      await db.unsafe(`
+      `,[accessToken.id,hashedRefreshToken,sqlDateTime(refreshExpiresAt)]);else await db.unsafe(`
         INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
         VALUES (?, ?, 0, ?, ${appNow()})
-      `, [accessToken.id, hashedRefreshToken, sqlDateTime(refreshExpiresAt)]);
-  }
-  return {
-    accessToken,
-    plainTextToken,
-    refreshToken: refreshTokenPlain,
-    expiresIn: expiresInMinutes * 60
-  };
-}
-export async function refreshToken(refreshTokenPlain, options = {}) {
-  const {
-    expiresInMinutes = 60,
-    refreshExpiresInDays = 30
-  } = options, hashedRefreshToken = hashToken(refreshTokenPlain);
-  return await db.transaction(async (rawTrx) => {
-    const trx = rawTrx, forUpdate = isPostgres || isMysql ? " FOR UPDATE" : "", refreshRow = (await trx.unsafe(`
+      `,[accessToken.id,hashedRefreshToken,sqlDateTime(refreshExpiresAt)])}return{accessToken,plainTextToken,refreshToken:refreshTokenPlain,expiresIn:expiresInMinutes*60}}export async function refreshToken(refreshTokenPlain,options={}){const{expiresInMinutes=60,refreshExpiresInDays=30}=options,hashedRefreshToken=hashToken(refreshTokenPlain);return await db.transaction(async(rawTrx)=>{const trx=rawTrx,forUpdate=isPostgres||isMysql?" FOR UPDATE":"",refreshRow=(await trx.unsafe(`
       SELECT r.*, t.user_id, t.oauth_client_id, t.name, t.scopes
       FROM oauth_refresh_tokens r
       JOIN oauth_access_tokens t ON r.access_token_id = t.id
@@ -211,281 +37,124 @@ export async function refreshToken(refreshTokenPlain, options = {}) {
       AND r.revoked = ${boolFalse}
       AND (r.expires_at IS NULL OR r.expires_at > ${appNow()})
       LIMIT 1${forUpdate}
-    `, [hashedRefreshToken]))[0];
-    if (!refreshRow)
-      throw new HttpError(401, "Invalid or expired refresh token");
-    if (isIssuedBeforePasswordChange(refreshRow.created_at, await getPasswordChangedAt(refreshRow.user_id, trx)))
-      throw new HttpError(401, "Invalid or expired refresh token");
-    await trx.unsafe(`
+    `,[hashedRefreshToken]))[0];if(!refreshRow)throw new HttpError(401,"Invalid or expired refresh token");if(isIssuedBeforePasswordChange(refreshRow.created_at,await getPasswordChangedAt(refreshRow.user_id,trx)))throw new HttpError(401,"Invalid or expired refresh token");await trx.unsafe(`
       UPDATE oauth_refresh_tokens
       SET revoked = ${boolTrue}
       WHERE id = ${param(1)}
-    `, [refreshRow.id]);
-    await trx.unsafe(`
+    `,[refreshRow.id]);await trx.unsafe(`
       UPDATE oauth_access_tokens
       SET revoked = ${boolTrue}
       WHERE id = ${param(1)}
-    `, [refreshRow.access_token_id]);
-    const plainTextToken = generateSecureToken(40), hashedToken = hashToken(plainTextToken), expiresAt = new Date;
-    expiresAt.setMinutes(expiresAt.getMinutes() + expiresInMinutes);
-    if (isPostgres)
-      await trx.unsafe(`
+    `,[refreshRow.access_token_id]);const plainTextToken=generateSecureToken(40),hashedToken=hashToken(plainTextToken),expiresAt=new Date;expiresAt.setMinutes(expiresAt.getMinutes()+expiresInMinutes);if(isPostgres)await trx.unsafe(`
         INSERT INTO oauth_access_tokens (user_id, oauth_client_id, token, name, scopes, revoked, expires_at, created_at, updated_at)
         VALUES ($1, $2, $3, $4, $5, false, $6, ${appNow()}, ${appNow()})
-      `, [refreshRow.user_id, refreshRow.oauth_client_id, hashedToken, refreshRow.name, refreshRow.scopes, sqlDateTime(expiresAt)]);
-    else
-      await trx.unsafe(`
+      `,[refreshRow.user_id,refreshRow.oauth_client_id,hashedToken,refreshRow.name,refreshRow.scopes,sqlDateTime(expiresAt)]);else await trx.unsafe(`
         INSERT INTO oauth_access_tokens (user_id, oauth_client_id, token, name, scopes, revoked, expires_at, created_at, updated_at)
         VALUES (?, ?, ?, ?, ?, 0, ?, ${appNow()}, ${appNow()})
-      `, [refreshRow.user_id, refreshRow.oauth_client_id, hashedToken, refreshRow.name, refreshRow.scopes, sqlDateTime(expiresAt)]);
-    const row = (await trx.unsafe(`
+      `,[refreshRow.user_id,refreshRow.oauth_client_id,hashedToken,refreshRow.name,refreshRow.scopes,sqlDateTime(expiresAt)]);const row=(await trx.unsafe(`
       SELECT * FROM oauth_access_tokens WHERE token = ${param(1)} LIMIT 1
-    `, [hashedToken]))[0], accessToken = {
-      id: row.id,
-      userId: row.user_id,
-      clientId: row.oauth_client_id,
-      name: row.name,
-      scopes: parseScopes(row.scopes),
-      revoked: !1,
-      expiresAt,
-      createdAt: new Date(row.created_at),
-      updatedAt: new Date(row.updated_at)
-    };
-    if (isIssuedBeforePasswordChange(row.created_at, await getPasswordChangedAt(refreshRow.user_id, trx)))
-      throw new HttpError(401, "Invalid or expired refresh token");
-    const newRefreshTokenPlain = generateSecureToken(40), newHashedRefreshToken = hashToken(newRefreshTokenPlain), refreshExpiresAt = new Date;
-    refreshExpiresAt.setDate(refreshExpiresAt.getDate() + refreshExpiresInDays);
-    if (isPostgres)
-      await trx.unsafe(`
+    `,[hashedToken]))[0],accessToken={id:row.id,userId:row.user_id,clientId:row.oauth_client_id,name:row.name,scopes:parseScopes(row.scopes),revoked:!1,expiresAt,createdAt:new Date(row.created_at),updatedAt:new Date(row.updated_at)};if(isIssuedBeforePasswordChange(row.created_at,await getPasswordChangedAt(refreshRow.user_id,trx)))throw new HttpError(401,"Invalid or expired refresh token");const newRefreshTokenPlain=generateSecureToken(40),newHashedRefreshToken=hashToken(newRefreshTokenPlain),refreshExpiresAt=new Date;refreshExpiresAt.setDate(refreshExpiresAt.getDate()+refreshExpiresInDays);if(isPostgres)await trx.unsafe(`
         INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
         VALUES ($1, $2, false, $3, ${appNow()})
-      `, [accessToken.id, newHashedRefreshToken, sqlDateTime(refreshExpiresAt)]);
-    else
-      await trx.unsafe(`
+      `,[accessToken.id,newHashedRefreshToken,sqlDateTime(refreshExpiresAt)]);else await trx.unsafe(`
         INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
         VALUES (?, ?, 0, ?, ${appNow()})
-      `, [accessToken.id, newHashedRefreshToken, sqlDateTime(refreshExpiresAt)]);
-    return {
-      accessToken,
-      plainTextToken,
-      refreshToken: newRefreshTokenPlain,
-      expiresIn: expiresInMinutes * 60
-    };
-  });
-}
-export async function validateRefreshToken(refreshTokenPlain) {
-  const hashedRefreshToken = hashToken(refreshTokenPlain);
-  return (await db.unsafe(`
+      `,[accessToken.id,newHashedRefreshToken,sqlDateTime(refreshExpiresAt)]);return{accessToken,plainTextToken,refreshToken:newRefreshTokenPlain,expiresIn:expiresInMinutes*60}})}export async function validateRefreshToken(refreshTokenPlain){const hashedRefreshToken=hashToken(refreshTokenPlain);return(await db.unsafe(`
     SELECT id FROM oauth_refresh_tokens
     WHERE token = ${param(1)}
     AND revoked = ${boolFalse}
     AND (expires_at IS NULL OR expires_at > ${appNow()})
     LIMIT 1
-  `, [hashedRefreshToken])).length > 0;
-}
-export async function revokeRefreshToken(refreshTokenPlain) {
-  const hashedRefreshToken = hashToken(refreshTokenPlain);
-  await db.unsafe(`
+  `,[hashedRefreshToken])).length>0}export async function revokeRefreshToken(refreshTokenPlain){const hashedRefreshToken=hashToken(refreshTokenPlain);await db.unsafe(`
     UPDATE oauth_refresh_tokens
     SET revoked = ${boolTrue}
     WHERE token = ${param(1)}
-  `, [hashedRefreshToken]);
-}
-export async function revokeAllRefreshTokens(userId) {
-  await db.unsafe(`
+  `,[hashedRefreshToken])}export async function revokeAllRefreshTokens(userId){await db.unsafe(`
     UPDATE oauth_refresh_tokens
     SET revoked = ${boolTrue}
     WHERE access_token_id IN (
       SELECT id FROM oauth_access_tokens WHERE user_id = ${param(1)}
     )
-  `, [userId]);
-}
-export async function deleteExpiredRefreshTokens() {
-  const result = await db.unsafe(`
+  `,[userId])}export async function deleteExpiredRefreshTokens(){const result=await db.unsafe(`
     DELETE FROM oauth_refresh_tokens
     WHERE expires_at < ${appNow()}
-  `);
-  return result?.changes || result?.rowCount || 0;
-}
-export async function deleteRevokedRefreshTokens(daysOld = 7) {
-  const cutoffDate = new Date;
-  cutoffDate.setDate(cutoffDate.getDate() - daysOld);
-  const result = await db.unsafe(`
+  `);return result?.changes||result?.rowCount||0}export async function deleteRevokedRefreshTokens(daysOld=7){const cutoffDate=new Date;cutoffDate.setDate(cutoffDate.getDate()-daysOld);const result=await db.unsafe(`
     DELETE FROM oauth_refresh_tokens
     WHERE revoked = ${boolTrue} AND created_at < ${param(1)}
-  `, [sqlDateTime(cutoffDate)]);
-  return result?.changes || result?.rowCount || 0;
-}
-export async function revokeToken(plainTextToken) {
-  const hashedToken = bearerLookupHash(plainTextToken);
-  await db.unsafe(`
+  `,[sqlDateTime(cutoffDate)]);return result?.changes||result?.rowCount||0}export async function revokeToken(plainTextToken){const hashedToken=bearerLookupHash(plainTextToken);await db.unsafe(`
     UPDATE oauth_refresh_tokens
     SET revoked = ${boolTrue}
     WHERE access_token_id IN (
       SELECT id FROM oauth_access_tokens WHERE token = ${param(1)}
     )
-  `, [hashedToken]);
-  await db.unsafe(`
+  `,[hashedToken]);await db.unsafe(`
     UPDATE oauth_access_tokens
     SET revoked = ${boolTrue}, updated_at = ${appNow()}
     WHERE token = ${param(1)}
-  `, [hashedToken]);
-}
-export async function revokeTokenById(tokenId) {
-  await db.unsafe(`
+  `,[hashedToken])}export async function revokeTokenById(tokenId){await db.unsafe(`
     UPDATE oauth_refresh_tokens
     SET revoked = ${boolTrue}
     WHERE access_token_id = ${param(1)}
-  `, [tokenId]);
-  await db.unsafe(`
+  `,[tokenId]);await db.unsafe(`
     UPDATE oauth_access_tokens
     SET revoked = ${boolTrue}, updated_at = ${appNow()}
     WHERE id = ${param(1)}
-  `, [tokenId]);
-}
-export async function revokeAllTokens(userId) {
-  await revokeAllRefreshTokens(userId);
-  await db.unsafe(`
+  `,[tokenId])}export async function revokeAllTokens(userId){await revokeAllRefreshTokens(userId);await db.unsafe(`
     UPDATE oauth_access_tokens
     SET revoked = ${boolTrue}, updated_at = ${appNow()}
     WHERE user_id = ${param(1)}
-  `, [userId]);
-}
-export async function revokeOtherTokens(userId) {
-  const current = await currentAccessToken();
-  if (!current)
-    return revokeAllTokens(userId);
-  if (isPostgres) {
-    await db.unsafe(`
+  `,[userId])}export async function revokeOtherTokens(userId){const current=await currentAccessToken();if(!current)return revokeAllTokens(userId);if(isPostgres){await db.unsafe(`
       UPDATE oauth_refresh_tokens
       SET revoked = true
       WHERE access_token_id IN (
         SELECT id FROM oauth_access_tokens WHERE user_id = $1 AND id != $2
       )
-    `, [userId, current.id]);
-    await db.unsafe(`
+    `,[userId,current.id]);await db.unsafe(`
       UPDATE oauth_access_tokens
       SET revoked = true, updated_at = ${appNow()}
       WHERE user_id = $1 AND id != $2
-    `, [userId, current.id]);
-  } else {
-    await db.unsafe(`
+    `,[userId,current.id])}else{await db.unsafe(`
       UPDATE oauth_refresh_tokens
       SET revoked = 1
       WHERE access_token_id IN (
         SELECT id FROM oauth_access_tokens WHERE user_id = ? AND id != ?
       )
-    `, [userId, current.id]);
-    await db.unsafe(`
+    `,[userId,current.id]);await db.unsafe(`
       UPDATE oauth_access_tokens
       SET revoked = 1, updated_at = ${appNow()}
       WHERE user_id = ? AND id != ?
-    `, [userId, current.id]);
-  }
-}
-export async function deleteExpiredTokens() {
-  await db.unsafe(`
+    `,[userId,current.id])}}export async function deleteExpiredTokens(){await db.unsafe(`
     DELETE FROM oauth_refresh_tokens
     WHERE access_token_id IN (
       SELECT id FROM oauth_access_tokens WHERE expires_at < ${appNow()}
     )
-  `);
-  const result = await db.unsafe(`
+  `);const result=await db.unsafe(`
     DELETE FROM oauth_access_tokens
     WHERE expires_at < ${appNow()}
-  `);
-  return result?.changes || result?.rowCount || 0;
-}
-export async function deleteRevokedTokens(daysOld = 7) {
-  const cutoffDate = new Date;
-  cutoffDate.setDate(cutoffDate.getDate() - daysOld);
-  await db.unsafe(`
+  `);return result?.changes||result?.rowCount||0}export async function deleteRevokedTokens(daysOld=7){const cutoffDate=new Date;cutoffDate.setDate(cutoffDate.getDate()-daysOld);await db.unsafe(`
     DELETE FROM oauth_refresh_tokens
     WHERE access_token_id IN (
       SELECT id FROM oauth_access_tokens WHERE revoked = ${boolTrue} AND updated_at < ${param(1)}
     )
-  `, [sqlDateTime(cutoffDate)]);
-  const result = await db.unsafe(`
+  `,[sqlDateTime(cutoffDate)]);const result=await db.unsafe(`
     DELETE FROM oauth_access_tokens
     WHERE revoked = ${boolTrue} AND updated_at < ${param(1)}
-  `, [sqlDateTime(cutoffDate)]);
-  return result?.changes || result?.rowCount || 0;
-}
-export async function clients(userId) {
-  return (await db.unsafe(`
+  `,[sqlDateTime(cutoffDate)]);return result?.changes||result?.rowCount||0}export async function clients(userId){return(await db.unsafe(`
     SELECT * FROM oauth_clients
     WHERE user_id = ${param(1)} AND revoked = ${boolFalse}
     ORDER BY created_at DESC
-  `, [userId])).map(mapToOAuthClient);
-}
-export async function findClient(clientId) {
-  const row = (await db.unsafe(`
+  `,[userId])).map(mapToOAuthClient)}export async function findClient(clientId){const row=(await db.unsafe(`
     SELECT * FROM oauth_clients WHERE id = ${param(1)} LIMIT 1
-  `, [clientId]))[0];
-  return row ? mapToOAuthClient(row) : null;
-}
-export async function createClient(options) {
-  const secret = generateSecureToken(40);
-  if (isPostgres)
-    await db.unsafe(`
+  `,[clientId]))[0];return row?mapToOAuthClient(row):null}export async function createClient(options){const secret=generateSecureToken(40);if(isPostgres)await db.unsafe(`
       INSERT INTO oauth_clients (name, secret, provider, redirect, personal_access_client, password_client, revoked, created_at)
       VALUES ($1, $2, 'local', $3, $4, $5, false, ${appNow()})
-    `, [
-      options.name,
-      secret,
-      options.redirect,
-      options.personalAccessClient || !1,
-      options.passwordClient || !1
-    ]);
-  else
-    await db.unsafe(`
+    `,[options.name,secret,options.redirect,options.personalAccessClient||!1,options.passwordClient||!1]);else await db.unsafe(`
       INSERT INTO oauth_clients (name, secret, provider, redirect, personal_access_client, password_client, revoked, created_at)
       VALUES (?, ?, 'local', ?, ?, ?, 0, ${appNow()})
-    `, [
-      options.name,
-      secret,
-      options.redirect,
-      options.personalAccessClient ? 1 : 0,
-      options.passwordClient ? 1 : 0
-    ]);
-  const inserted = await db.unsafe(`
+    `,[options.name,secret,options.redirect,options.personalAccessClient?1:0,options.passwordClient?1:0]);const inserted=await db.unsafe(`
     SELECT * FROM oauth_clients WHERE secret = ${param(1)} LIMIT 1
-  `, [secret]);
-  return {
-    client: mapToOAuthClient(inserted[0]),
-    plainTextSecret: secret
-  };
-}
-export async function revokeClient(clientId) {
-  await db.unsafe(`
+  `,[secret]);return{client:mapToOAuthClient(inserted[0]),plainTextSecret:secret}}export async function revokeClient(clientId){await db.unsafe(`
     UPDATE oauth_clients
     SET revoked = ${boolTrue}, updated_at = ${appNow()}
     WHERE id = ${param(1)}
-  `, [clientId]);
-}
-export function parseScopes(scopes) {
-  if (!scopes)
-    return [];
-  if (Array.isArray(scopes))
-    return scopes;
-  try {
-    const parsed = JSON.parse(scopes);
-    return Array.isArray(parsed) ? parsed : [];
-  } catch {
-    return [];
-  }
-}
-function mapToOAuthClient(row) {
-  return {
-    id: row.id,
-    name: row.name,
-    secret: row.secret,
-    provider: row.provider,
-    redirect: row.redirect,
-    personalAccessClient: Boolean(row.personal_access_client),
-    passwordClient: Boolean(row.password_client),
-    revoked: Boolean(row.revoked),
-    createdAt: row.created_at ? new Date(row.created_at) : new Date,
-    updatedAt: row.updated_at ? new Date(row.updated_at) : null
-  };
-}
+  `,[clientId])}export function parseScopes(scopes){if(!scopes)return[];if(Array.isArray(scopes))return scopes;try{const parsed=JSON.parse(scopes);return Array.isArray(parsed)?parsed:[]}catch{return[]}}function mapToOAuthClient(row){return{id:row.id,name:row.name,secret:row.secret,provider:row.provider,redirect:row.redirect,personalAccessClient:Boolean(row.personal_access_client),passwordClient:Boolean(row.password_client),revoked:Boolean(row.revoked),createdAt:row.created_at?new Date(row.created_at):new Date,updatedAt:row.updated_at?new Date(row.updated_at):null}}