@stacksjs/defaults 0.75.28 → 0.75.29

package/ai/skills/stacks-auth/SKILL.md

@@ -161,7 +161,28 @@ routes: minting and revoking both carry semantics a generic route does not.
 The authorization server is opt-in through `config/auth.ts` under
 `oauthProvider`. It is separate from social sign-in, where Stacks is the OAuth
 client. The provider profile is Authorization Code with S256 PKCE and rotating
-refresh tokens. It does not support implicit or password grants.
+refresh tokens. It does not support implicit, password, or client-credentials
+grants. It also does not implement token introspection or OpenID Connect.
+
+When enabled, the default auth route bundle registers:
+
+- `GET` and `POST /oauth/authorize`
+- `POST /oauth/token`
+- `POST /oauth/revoke`
+- `GET /.well-known/oauth-authorization-server`
+- owner-managed clients under `/auth/oauth/clients`
+- user-managed connected applications under `/auth/oauth/connections`
+
+Set a canonical `issuer`, then register every scope and resource explicitly.
+Resource audiences are absolute URIs and redirect URIs use exact matching.
+The consent view is `auth/oauth/consent` by default and can be overridden with
+`oauthProvider.consent.view`. Use `oauthProvider.consent.resolveWorkspace` when
+the application must bind consent to current server-owned workspace authority.
+
+Provider actions return 404 while `oauthProvider.enabled` is false. The token
+and revocation endpoints use protocol credentials and intentionally skip
+browser CSRF. Authorization approval, client management, and disconnect remain
+authenticated and CSRF protected.
 
 - `resolveOAuthProviderConfig(options)` returns `null` unless explicitly enabled
 - `generatePkceVerifier()` creates a 256-bit RFC 7636 verifier

package/app/Actions/Auth/OAuthAuthorizationAction.ts

@@ -0,0 +1,81 @@
+import type { OAuthAuthorizationConsentPageContext } from '@stacksjs/auth'
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { Action } from '@stacksjs/actions'
+import { resolveDefaultsResources } from '@stacksjs/actions/dev/defaults-resources'
+import {
+  authenticatedUser,
+  authUser,
+  handleOAuthAuthorizationPageRequest,
+  resolveOAuthConsentWorkspace,
+  resolveOAuthProviderConfig,
+} from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { path } from '@stacksjs/path'
+import { getCurrentRequest, response } from '@stacksjs/router'
+import { oauthPositiveId } from './oauth-request'
+
+function identityLabel(user: { email: string, [key: string]: unknown }): string {
+  const name = typeof user.name === 'string' ? user.name.trim() : ''
+  return name || user.email.trim()
+}
+
+async function renderConsentView(
+  view: string,
+  context: OAuthAuthorizationConsentPageContext,
+): Promise<string> {
+  const relative = view.endsWith('.stx') ? view : `${view}.stx`
+  const applicationView = path.userViewsPath(relative)
+  const frameworkView = join(resolveDefaultsResources(), 'views', relative)
+  const template = existsSync(applicationView) ? applicationView : frameworkView
+  const { renderTemplate } = await import('@stacksjs/stx')
+
+  return String(await renderTemplate(template, {
+    context,
+    injectCSS: true,
+    templateOnly: true,
+    processClientScripts: false,
+  }))
+}
+
+export default new Action({
+  name: 'OAuthAuthorizationAction',
+  description: 'Start or resume an OAuth authorization request',
+  method: 'GET',
+
+  async handle(request: RequestInstance) {
+    const provider = resolveOAuthProviderConfig(config.auth.oauthProvider)
+    if (!provider)
+      return response.notFound('OAuth provider is not enabled')
+
+    // This GET route must stay public so an anonymous browser can persist the
+    // request before login. `request.user()` only exposes identity populated
+    // by auth middleware, which this route deliberately cannot use, so fall
+    // through to the lazy cookie/bearer resolver after honoring a directly
+    // injected action-test or upstream middleware identity.
+    const user = await authenticatedUser(request)
+      ?? (getCurrentRequest() ? await authUser() : undefined)
+    const subjectId = user ? oauthPositiveId(user.id) : null
+    const workspace = user && subjectId
+      ? await resolveOAuthConsentWorkspace(provider, { request, user })
+      : null
+    const resolveWorkspaceId = user
+      ? async () => (await resolveOAuthConsentWorkspace(provider, { request, user }))?.id ?? null
+      : undefined
+    return handleOAuthAuthorizationPageRequest({
+      provider,
+      request: request as unknown as Request,
+      identity: user ? { label: identityLabel(user), workspaceLabel: workspace?.label } : null,
+      subject: subjectId
+        ? {
+            type: 'users',
+            id: subjectId,
+            workspaceId: workspace?.id,
+            resolveWorkspaceId,
+          }
+        : null,
+      csrfToken: (request as unknown as { _csrfToken?: string })._csrfToken,
+      dependencies: { render: renderConsentView },
+    })
+  },
+})

package/app/Actions/Auth/OAuthClientDisableAction.ts

@@ -0,0 +1,38 @@
+import { Action } from '@stacksjs/actions'
+import { disableOAuthClient, resolveOAuthProviderConfig } from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { response } from '@stacksjs/router'
+import { oauthPositiveId } from './oauth-request'
+
+export default new Action({
+  name: 'OAuthClientDisableAction',
+  description: 'Disable an OAuth client owned by the authenticated user',
+  method: 'POST',
+
+  async handle(request: RequestInstance) {
+    const provider = resolveOAuthProviderConfig(config.auth.oauthProvider)
+    if (!provider)
+      return response.notFound('OAuth provider is not enabled')
+
+    const user = await request.user()
+    const ownerId = user ? oauthPositiveId(user.id) : null
+    if (!ownerId)
+      return response.unauthorized('Authentication required')
+
+    const rawClientId = request.getParam('id')
+    const clientId = /^\d+$/.test(rawClientId) ? oauthPositiveId(rawClientId) : null
+    if (!clientId)
+      return response.badRequest('Invalid OAuth client ID')
+
+    const disabled = await disableOAuthClient(ownerId, clientId)
+    if (!disabled)
+      return response.notFound('OAuth client not found')
+
+    return response.json({
+      message: 'OAuth client disabled successfully',
+      client_id: clientId,
+    }, {
+      headers: { 'Cache-Control': 'no-store' },
+    })
+  },
+})

package/app/Actions/Auth/OAuthClientSecretRotateAction.ts

@@ -0,0 +1,41 @@
+import { Action } from '@stacksjs/actions'
+import { resolveOAuthProviderConfig, rotateOAuthClientSecret } from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { response } from '@stacksjs/router'
+import { oauthPositiveId } from './oauth-request'
+
+export default new Action({
+  name: 'OAuthClientSecretRotateAction',
+  description: 'Rotate an OAuth client secret owned by the authenticated user',
+  method: 'POST',
+
+  async handle(request: RequestInstance) {
+    const provider = resolveOAuthProviderConfig(config.auth.oauthProvider)
+    if (!provider)
+      return response.notFound('OAuth provider is not enabled')
+
+    const user = await request.user()
+    const ownerId = user ? oauthPositiveId(user.id) : null
+    if (!ownerId)
+      return response.unauthorized('Authentication required')
+
+    const rawClientId = request.getParam('id')
+    const clientId = /^\d+$/.test(rawClientId) ? oauthPositiveId(rawClientId) : null
+    if (!clientId)
+      return response.badRequest('Invalid OAuth client ID')
+
+    const clientSecret = await rotateOAuthClientSecret(ownerId, clientId)
+    if (!clientSecret)
+      return response.notFound('OAuth client not found')
+
+    return response.json({
+      client_id: clientId,
+      client_secret: clientSecret,
+    }, {
+      headers: {
+        'Cache-Control': 'no-store',
+        'Pragma': 'no-cache',
+      },
+    })
+  },
+})

package/app/Actions/Auth/OAuthClientStoreAction.ts

@@ -0,0 +1,73 @@
+import { Action } from '@stacksjs/actions'
+import {
+  OAuthClientRegistrationError,
+  registerOAuthClient,
+  resolveOAuthProviderConfig,
+} from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { response } from '@stacksjs/router'
+import { oauthPositiveId, oauthStringList } from './oauth-request'
+
+export default new Action({
+  name: 'OAuthClientStoreAction',
+  description: 'Register an OAuth client for the authenticated user',
+  method: 'POST',
+
+  async handle(request: RequestInstance) {
+    const provider = resolveOAuthProviderConfig(config.auth.oauthProvider)
+    if (!provider)
+      return response.notFound('OAuth provider is not enabled')
+
+    const user = await request.user()
+    const ownerId = user ? oauthPositiveId(user.id) : null
+    if (!ownerId)
+      return response.unauthorized('Authentication required')
+
+    const body = await request.all() as Record<string, unknown>
+    const name = typeof body.name === 'string' ? body.name : null
+    const type = body.type === 'public' || body.type === 'confidential' ? body.type : null
+    const redirectUris = oauthStringList(body.redirect_uris)
+    const scopes = oauthStringList(body.scopes)
+    const resources = oauthStringList(body.resources)
+    if (!name || !type || !redirectUris || !scopes || !resources)
+      return response.badRequest('OAuth client registration metadata is invalid')
+
+    try {
+      const result = await registerOAuthClient(provider, ownerId, {
+        name,
+        type,
+        tokenEndpointAuthMethod: type === 'public' ? 'none' : 'client_secret_basic',
+        redirectUris,
+        grantTypes: ['authorization_code', 'refresh_token'],
+        scopes,
+        resources,
+      })
+
+      return response.json({
+        client: {
+          id: result.client.id,
+          name: result.client.name,
+          type: result.client.type,
+          token_endpoint_auth_method: result.client.tokenEndpointAuthMethod,
+          redirect_uris: result.client.redirectUris,
+          grant_types: result.client.grantTypes,
+          scopes: result.client.scopes,
+          resources: result.client.resources,
+          created_at: result.client.createdAt.toISOString(),
+        },
+        ...(result.plainTextSecret ? { client_secret: result.plainTextSecret } : {}),
+      }, {
+        status: 201,
+        headers: {
+          'Cache-Control': 'no-store',
+          'Pragma': 'no-cache',
+        },
+      })
+    }
+    catch (error) {
+      if (error instanceof OAuthClientRegistrationError)
+        return response.json({ message: error.message }, { status: 422 })
+      throw error
+    }
+  },
+})

package/app/Actions/Auth/OAuthClientUpdateAction.ts

@@ -0,0 +1,73 @@
+import { Action } from '@stacksjs/actions'
+import {
+  OAuthClientRegistrationError,
+  resolveOAuthProviderConfig,
+  updateOAuthClient,
+} from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { response } from '@stacksjs/router'
+import { oauthPositiveId, oauthStringList } from './oauth-request'
+
+export default new Action({
+  name: 'OAuthClientUpdateAction',
+  description: 'Update an OAuth client owned by the authenticated user',
+  method: 'PATCH',
+
+  async handle(request: RequestInstance) {
+    const provider = resolveOAuthProviderConfig(config.auth.oauthProvider)
+    if (!provider)
+      return response.notFound('OAuth provider is not enabled')
+
+    const user = await request.user()
+    const ownerId = user ? oauthPositiveId(user.id) : null
+    if (!ownerId)
+      return response.unauthorized('Authentication required')
+
+    const rawClientId = request.getParam('id')
+    const clientId = /^\d+$/.test(rawClientId) ? oauthPositiveId(rawClientId) : null
+    if (!clientId)
+      return response.badRequest('Invalid OAuth client ID')
+
+    const body = await request.all() as Record<string, unknown>
+    const name = typeof body.name === 'string' ? body.name : null
+    const redirectUris = oauthStringList(body.redirect_uris)
+    const scopes = oauthStringList(body.scopes)
+    const resources = oauthStringList(body.resources)
+    if (!name || !redirectUris || !scopes || !resources)
+      return response.badRequest('OAuth client update metadata is invalid')
+
+    try {
+      const client = await updateOAuthClient(provider, ownerId, clientId, {
+        name,
+        redirectUris,
+        grantTypes: ['authorization_code', 'refresh_token'],
+        scopes,
+        resources,
+      })
+      if (!client)
+        return response.notFound('OAuth client not found')
+
+      return response.json({
+        client: {
+          id: client.id,
+          name: client.name,
+          type: client.type,
+          token_endpoint_auth_method: client.tokenEndpointAuthMethod,
+          redirect_uris: client.redirectUris,
+          grant_types: client.grantTypes,
+          scopes: client.scopes,
+          resources: client.resources,
+          revoked: client.revoked,
+          created_at: client.createdAt.toISOString(),
+        },
+      }, {
+        headers: { 'Cache-Control': 'no-store' },
+      })
+    }
+    catch (error) {
+      if (error instanceof OAuthClientRegistrationError)
+        return response.json({ message: error.message }, { status: 422 })
+      throw error
+    }
+  },
+})

package/app/Actions/Auth/OAuthClientsAction.ts

@@ -0,0 +1,42 @@
+import { Action } from '@stacksjs/actions'
+import { listOAuthClients, resolveOAuthProviderConfig } from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { response } from '@stacksjs/router'
+import { oauthPositiveId } from './oauth-request'
+
+export default new Action({
+  name: 'OAuthClientsAction',
+  description: 'List OAuth clients owned by the authenticated user',
+  method: 'GET',
+
+  async handle(request: RequestInstance) {
+    const provider = resolveOAuthProviderConfig(config.auth.oauthProvider)
+    if (!provider)
+      return response.notFound('OAuth provider is not enabled')
+
+    const user = await request.user()
+    const id = user ? oauthPositiveId(user.id) : null
+    if (!id)
+      return response.unauthorized('Authentication required')
+
+    const clients = await listOAuthClients(id)
+
+    return response.json({
+      clients: clients.map(client => ({
+        id: client.id,
+        name: client.name,
+        type: client.type,
+        token_endpoint_auth_method: client.tokenEndpointAuthMethod,
+        redirect_uris: client.redirectUris,
+        grant_types: client.grantTypes,
+        scopes: client.scopes,
+        resources: client.resources,
+        revoked: client.revoked,
+        created_at: client.createdAt.toISOString(),
+      })),
+      count: clients.length,
+    }, {
+      headers: { 'Cache-Control': 'no-store' },
+    })
+  },
+})

package/app/Actions/Auth/OAuthConnectionsAction.ts

@@ -0,0 +1,40 @@
+import { Action } from '@stacksjs/actions'
+import { listOAuthConnections, resolveOAuthProviderConfig } from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { response } from '@stacksjs/router'
+import { oauthPositiveId } from './oauth-request'
+
+export default new Action({
+  name: 'OAuthConnectionsAction',
+  description: 'List OAuth applications connected to the authenticated user',
+  method: 'GET',
+
+  async handle(request: RequestInstance) {
+    const provider = resolveOAuthProviderConfig(config.auth.oauthProvider)
+    if (!provider)
+      return response.notFound('OAuth provider is not enabled')
+
+    const user = await request.user()
+    const id = user ? oauthPositiveId(user.id) : null
+    if (!id)
+      return response.unauthorized('Authentication required')
+
+    const connections = await listOAuthConnections('users', id)
+
+    return response.json({
+      connections: connections.map(connection => ({
+        grant_id: connection.grantId,
+        client_id: connection.clientId,
+        client_name: connection.clientName,
+        scopes: connection.scopes,
+        resources: connection.resources,
+        audiences: connection.audiences,
+        workspace_id: connection.workspaceId,
+        created_at: connection.createdAt.toISOString(),
+      })),
+      count: connections.length,
+    }, {
+      headers: { 'Cache-Control': 'no-store' },
+    })
+  },
+})

package/app/Actions/Auth/OAuthConsentAction.ts

@@ -0,0 +1,34 @@
+import { Action } from '@stacksjs/actions'
+import {
+  handleOAuthAuthorizationConsentRequest,
+  resolveOAuthConsentWorkspace,
+  resolveOAuthProviderConfig,
+} from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { response } from '@stacksjs/router'
+import { oauthPositiveId } from './oauth-request'
+
+export default new Action({
+  name: 'OAuthConsentAction',
+  description: 'Approve or deny an OAuth authorization request',
+  method: 'POST',
+
+  async handle(request: RequestInstance) {
+    const provider = resolveOAuthProviderConfig(config.auth.oauthProvider)
+    if (!provider)
+      return response.notFound('OAuth provider is not enabled')
+
+    const user = await request.user()
+    const id = user ? oauthPositiveId(user.id) : null
+    if (!id)
+      return response.unauthorized('Authentication required')
+
+    return handleOAuthAuthorizationConsentRequest({
+      provider,
+      request: request as unknown as Request,
+      subjectType: 'users',
+      subjectId: id,
+      resolveWorkspaceId: async () => (await resolveOAuthConsentWorkspace(provider, { request, user }))?.id ?? null,
+    })
+  },
+})

package/app/Actions/Auth/OAuthDisconnectAction.ts

@@ -0,0 +1,37 @@
+import { Action } from '@stacksjs/actions'
+import { disconnectOAuthGrant, resolveOAuthProviderConfig } from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { response } from '@stacksjs/router'
+import { oauthPositiveId } from './oauth-request'
+
+export default new Action({
+  name: 'OAuthDisconnectAction',
+  description: 'Disconnect an OAuth application from the authenticated user',
+  method: 'POST',
+
+  async handle(request: RequestInstance) {
+    const provider = resolveOAuthProviderConfig(config.auth.oauthProvider)
+    if (!provider)
+      return response.notFound('OAuth provider is not enabled')
+
+    const user = await request.user()
+    const id = user ? oauthPositiveId(user.id) : null
+    if (!id)
+      return response.unauthorized('Authentication required')
+
+    const grantId = request.getParam('id')
+    if (!/^[a-f0-9]{32}$/.test(grantId))
+      return response.badRequest('Invalid OAuth grant ID')
+
+    const disconnected = await disconnectOAuthGrant('users', id, grantId)
+    if (!disconnected)
+      return response.notFound('OAuth connection not found')
+
+    return response.json({
+      message: 'OAuth application disconnected successfully',
+      grant_id: grantId,
+    }, {
+      headers: { 'Cache-Control': 'no-store' },
+    })
+  },
+})

package/app/Actions/Auth/OAuthMetadataAction.ts

@@ -0,0 +1,20 @@
+import { Action } from '@stacksjs/actions'
+import { oauthAuthorizationServerMetadata, resolveOAuthProviderConfig } from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { response } from '@stacksjs/router'
+
+export default new Action({
+  name: 'OAuthMetadataAction',
+  description: 'Publish OAuth authorization-server metadata',
+  method: 'GET',
+
+  async handle() {
+    const provider = resolveOAuthProviderConfig(config.auth.oauthProvider)
+    if (!provider)
+      return response.notFound('OAuth provider is not enabled')
+
+    return response.json(oauthAuthorizationServerMetadata(provider), {
+      headers: { 'Cache-Control': 'public, max-age=300' },
+    })
+  },
+})

package/app/Actions/Auth/OAuthRevocationAction.ts

@@ -0,0 +1,24 @@
+import { Action } from '@stacksjs/actions'
+import { handleOAuthRevocationRequest, resolveOAuthProviderConfig } from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { response } from '@stacksjs/router'
+
+export default new Action({
+  name: 'OAuthRevocationAction',
+  description: 'Revoke a delegated OAuth token',
+  method: 'POST',
+  // OAuth clients authenticate with their registered protocol method instead
+  // of a browser session, so they cannot and must not need a CSRF cookie.
+  skipCsrf: true,
+
+  async handle(request: RequestInstance) {
+    if (!resolveOAuthProviderConfig(config.auth.oauthProvider))
+      return response.notFound('OAuth provider is not enabled')
+
+    return handleOAuthRevocationRequest({
+      body: (await request.rawBody?.()) ?? '',
+      contentType: request.headers.get('content-type'),
+      authorization: request.headers.get('authorization'),
+    })
+  },
+})

package/app/Actions/Auth/OAuthTokenAction.ts

@@ -0,0 +1,35 @@
+import type { OAuthSubjectEligibility } from '@stacksjs/auth'
+import { Action } from '@stacksjs/actions'
+import { handleOAuthTokenRequest, resolveOAuthProviderConfig } from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { db } from '@stacksjs/database/runtime'
+import { response } from '@stacksjs/router'
+
+const isSubjectEligible: OAuthSubjectEligibility = async (subject) => {
+  if (subject.type !== 'users') return false
+  return Boolean(await db.primary.selectFrom('users')
+    .where('id', '=', subject.id)
+    .select('id')
+    .executeTakeFirst())
+}
+
+export default new Action({
+  name: 'OAuthTokenAction',
+  description: 'Exchange OAuth authorization codes and refresh tokens',
+  method: 'POST',
+  // OAuth clients authenticate with PKCE or HTTP Basic and cannot obtain the
+  // browser CSRF cookie. The protocol boundary validates its own credentials.
+  skipCsrf: true,
+
+  async handle(request: RequestInstance) {
+    const provider = resolveOAuthProviderConfig(config.auth.oauthProvider)
+    if (!provider)
+      return response.notFound('OAuth provider is not enabled')
+
+    return handleOAuthTokenRequest(provider, {
+      body: (await request.rawBody?.()) ?? '',
+      contentType: request.headers.get('content-type'),
+      authorization: request.headers.get('authorization'),
+    }, { isSubjectEligible })
+  },
+})

package/app/Actions/Auth/oauth-request.ts

@@ -0,0 +1,10 @@
+export function oauthPositiveId(value: number | string): number | null {
+  const id = Number(value)
+  return Number.isSafeInteger(id) && id > 0 ? id : null
+}
+
+export function oauthStringList(value: unknown): string[] | null {
+  return Array.isArray(value) && value.every(item => typeof item === 'string')
+    ? value
+    : null
+}

package/app/Middleware/Csrf.ts

@@ -215,7 +215,7 @@ export function seedCsrfCookieIfMissing(req: Request, response: Response, minted
  * Last duplicate wins; the canonical name takes precedence over the legacy
  * name unless its final value is empty. Malformed pairs are skipped.
  */
-function csrfCookieToken(req: Request): string {
+export function csrfCookieToken(req: Request): string {
   const header = req.headers.get('cookie')
   if (!header) return ''
   // The cookie this framework emits has one exact, whitespace-free shape.

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.28",
+  "version": "0.75.29",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.28",
+  "version": "0.75.29",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.75.28",
+    "@stacksjs/mobile": "^0.75.29",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/resources/components/Video.stx

@@ -67,10 +67,12 @@ effect(() => {
 })
 </script>
 
+{{-- No src attribute until there is a video: an empty one resolves to the
+     page's own URL, which the browser then downloads as the video. --}}
 <figure class="m-0 {{ className }}">
   <video-player
     ref="player"
-    src="{{ src }}"
+    @if(src) src="{{ src }}" @endif
     :src="liveSrc() || null"
     :poster="livePoster() || null"
     data-media-config="{{ playerConfig }}"
@@ -93,7 +95,7 @@ effect(() => {
     @if(isEmbed)
       <a data-native-fallback href="{{ src }}" target="_blank" rel="noopener" class="flex items-center justify-center h-full w-full text-sm text-white underline">Watch {{ title }}</a>
     @else
-    <video data-native-fallback src="{{ src }}" @if(poster) poster="{{ poster }}" @endif @if(width) width="{{ width }}" @endif @if(height) height="{{ height }}" @endif @if(controls) controls @endif @if(props.autoplay) autoplay @endif @if(props.loop) loop @endif @if(props.muted) muted @endif @if(inline) playsinline @endif preload="{{ preload }}" @if(crossorigin) crossorigin="{{ crossorigin }}" @endif controlslist="{{ controlslist }}" @if(props.disablePictureInPicture) disablepictureinpicture @endif aria-label="{{ title }}" class="object-contain h-full w-full">
+    <video data-native-fallback @if(src) src="{{ src }}" @endif @if(poster) poster="{{ poster }}" @endif @if(width) width="{{ width }}" @endif @if(height) height="{{ height }}" @endif @if(controls) controls @endif @if(props.autoplay) autoplay @endif @if(props.loop) loop @endif @if(props.muted) muted @endif @if(inline) playsinline @endif preload="{{ preload }}" @if(crossorigin) crossorigin="{{ crossorigin }}" @endif controlslist="{{ controlslist }}" @if(props.disablePictureInPicture) disablepictureinpicture @endif aria-label="{{ title }}" class="object-contain h-full w-full">
       @foreach (sources as source)
         <source src="{{ source.src }}" @if(source.type) type="{{ source.type }}" @endif>
       @endforeach

package/resources/components/Video.test.ts

@@ -11,6 +11,14 @@ describe('Video', () => {
     expect(video).toContain(`:poster="livePoster() || null"`)
   })
 
+  it('renders no src attribute without a video, which would fetch the page itself', () => {
+    // An empty src resolves to the document's URL: the browser downloads the
+    // whole page as the video and fails, every time a player with nothing
+    // chosen yet renders.
+    expect(video).not.toMatch(/(?<!@if\(src\) )src="\{\{ src \}\}"/)
+    expect(video.match(/@if\(src\) src="\{\{ src \}\}" @endif/g)?.length).toBe(2)
+  })
+
   it('pauses when its src is cleared, as closing a sheet does', () => {
     expect(video).toContain(`useRef('player')`)
     expect(video).toContain('ref="player"')

package/routes/auth.ts

@@ -23,8 +23,18 @@
  * and user routes load first, so your handler always takes priority.
  */
 
+import { oauthAuthorizationServerMetadataPath, resolveOAuthProviderConfig } from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
 import { route } from '@stacksjs/router'
 
+const oauthProvider = resolveOAuthProviderConfig(config.auth.oauthProvider)
+const oauthAuthorizationPath = oauthProvider ? new URL(oauthProvider.endpoints.authorization).pathname : '/oauth/authorize'
+const oauthTokenPath = oauthProvider ? new URL(oauthProvider.endpoints.token).pathname : '/oauth/token'
+const oauthRevocationPath = oauthProvider ? new URL(oauthProvider.endpoints.revocation).pathname : '/oauth/revoke'
+const oauthMetadataPath = oauthProvider
+  ? oauthAuthorizationServerMetadataPath(oauthProvider.issuer)
+  : '/.well-known/oauth-authorization-server'
+
 // Rate limits on token-issuance + password-reset endpoints
 // (stacksjs/stacks#1921). `Auth.attempt()` already has a per-email
 // lockout but it doesn't stop credential-stuffing across many emails
@@ -34,6 +44,14 @@ import { route } from '@stacksjs/router'
 // `routes/api.ts` (user routes win) gets to pick its own limits.
 route.post('/login', 'Actions/Auth/LoginAction').rateLimit(5, 'minute')
 route.post('/register', 'Actions/Auth/RegisterAction').rateLimit(3, 'minute')
+// OAuth authorization-server token exchange. The action remains a 404 unless
+// config.auth.oauthProvider.enabled is explicitly true. PKCE or HTTP Basic is
+// the endpoint's credential boundary, so the action opts out of browser CSRF.
+route.post(oauthTokenPath, 'Actions/Auth/OAuthTokenAction').rateLimit(30, 'minute')
+route.post(oauthRevocationPath, 'Actions/Auth/OAuthRevocationAction').rateLimit(30, 'minute')
+route.get(oauthAuthorizationPath, 'Actions/Auth/OAuthAuthorizationAction').rateLimit(60, 'minute')
+route.post(oauthAuthorizationPath, 'Actions/Auth/OAuthConsentAction').middleware('auth').rateLimit(30, 'minute')
+route.get(oauthMetadataPath, 'Actions/Auth/OAuthMetadataAction')
 // Magic links (config.auth.magicLink.enabled gates both, 404 when off).
 // The send endpoint answers a uniform 202 either way (anti-enumeration
 // lives in sendMagicLink); the consume endpoint is a POST because email
@@ -67,6 +85,13 @@ route.post('/verify-two-factor-login', 'Actions/Auth/VerifyTwoFactorLoginAction'
 
 route.group({ prefix: '/auth' }, () => {
   route.post('/refresh', 'Actions/Auth/RefreshTokenAction').rateLimit(10, 'minute')
+  route.get('/oauth/clients', 'Actions/Auth/OAuthClientsAction').middleware('auth')
+  route.post('/oauth/clients', 'Actions/Auth/OAuthClientStoreAction').middleware('auth').rateLimit(10, 'minute')
+  route.patch('/oauth/clients/{id}', 'Actions/Auth/OAuthClientUpdateAction').middleware('auth').rateLimit(20, 'minute')
+  route.post('/oauth/clients/{id}/disable', 'Actions/Auth/OAuthClientDisableAction').middleware('auth').rateLimit(10, 'minute')
+  route.post('/oauth/clients/{id}/rotate-secret', 'Actions/Auth/OAuthClientSecretRotateAction').middleware('auth').rateLimit(5, 'minute')
+  route.get('/oauth/connections', 'Actions/Auth/OAuthConnectionsAction').middleware('auth')
+  route.post('/oauth/connections/{id}/disconnect', 'Actions/Auth/OAuthDisconnectAction').middleware('auth').rateLimit(10, 'minute')
   route.get('/tokens', 'Actions/Auth/ListTokensAction').middleware('auth')
   route.post('/token', 'Actions/Auth/CreateTokenAction').middleware('auth').rateLimit(10, 'minute')
   route.delete('/tokens/{id}', 'Actions/Auth/RevokeTokenAction').middleware('auth')