@stjoseph/prumo 0.2.0 → 0.4.0

package/templates/api/src/infra/http/app.ts

@@ -1,5 +1,7 @@
 import { randomUUID } from 'node:crypto'
+import cookie from '@fastify/cookie'
 import cors from '@fastify/cors'
+import rateLimit from '@fastify/rate-limit'
 import swagger from '@fastify/swagger'
 import swaggerUi from '@fastify/swagger-ui'
 import { EntityManager } from '@mikro-orm/postgresql'
@@ -12,11 +14,15 @@ import {
 import type { DependencyContainer } from 'tsyringe'
 import { ENV, type Env } from '@/infra/config/env'
 import { authController } from '@/infra/http/controllers/auth.controller'
+import { authEmailController } from '@/infra/http/controllers/auth-email.controller' // prumo:email
 import { healthController } from '@/infra/http/controllers/health.controller'
 import { mcpController } from '@/infra/http/controllers/mcp.controller' // prumo:mcp
+import { oauthController } from '@/infra/http/controllers/oauth.controller' // prumo:mcp
+import { socialController } from '@/infra/http/controllers/social.controller' // prumo:social
 import { usersController } from '@/infra/http/controllers/users.controller'
 import { registerErrorHandler } from '@/infra/http/errors/error-handler'
 import { registerAuthHook } from '@/infra/http/hooks/auth.hook'
+import { registerOriginCheck } from '@/infra/http/hooks/origin.hook'
 import { registerRequestContext } from '@/infra/http/hooks/request-context.hook'
 
 const DOCS = '/api/docs'
@@ -82,16 +88,24 @@ export async function buildApp(container: DependencyContainer): Promise<FastifyI
     exposedHeaders: ['X-Request-Id'],
   })
 
+  await app.register(cookie)
+  // Off by default: a route opts in through its config, so only the routes that take a password are limited.
+  await app.register(rateLimit, { global: false })
+  registerOriginCheck(app, env.WEB_ORIGIN)
+
   if (env.NODE_ENV !== 'production') {
     await registerDocs(app)
   }
 
   registerAuthHook(app)
 
-  await app.register(authController)
+  await app.register(authController, { prefix: '/api/auth' })
+  await app.register(authEmailController, { prefix: '/api/auth' }) // prumo:email
+  await app.register(socialController, { prefix: '/api/auth/social' }) // prumo:social
   await app.register(healthController, { prefix: '/api/health' })
   await app.register(usersController, { prefix: '/api/v1/users' })
   // prumo:mcp
+  await app.register(oauthController)
   await app.register(mcpController, { prefix: '/api/mcp' })
   // prumo:end-mcp
 

package/templates/api/src/infra/http/controllers/auth-email.controller.ts

@@ -0,0 +1,73 @@
+import type { FastifyInstance } from 'fastify'
+import type { ZodTypeProvider } from 'fastify-type-provider-zod'
+import { emailRequestSchema } from '@/domain/auth/dto/email-request.dto'
+import { resetPasswordSchema } from '@/domain/auth/dto/reset-password.dto'
+import { tokensResponseSchema } from '@/domain/auth/dto/tokens-response.dto'
+import { verifyEmailSchema } from '@/domain/auth/dto/verify-email.dto'
+import { RequestEmailVerificationUseCase } from '@/domain/auth/use-cases/request-email-verification.use-case'
+import { RequestPasswordResetUseCase } from '@/domain/auth/use-cases/request-password-reset.use-case'
+import { ResetPasswordUseCase } from '@/domain/auth/use-cases/reset-password.use-case'
+import { VerifyEmailUseCase } from '@/domain/auth/use-cases/verify-email.use-case'
+import { ENV, type Env } from '@/infra/config/env'
+import { ATTEMPTS } from '@/infra/http/controllers/auth.controller'
+import { sessionDelivery } from '@/infra/http/session-delivery'
+
+// Every route answers alike whether or not the email has an account: none of them can be used to find out.
+export async function authEmailController(fastify: FastifyInstance): Promise<void> {
+  const app = fastify.withTypeProvider<ZodTypeProvider>()
+  const { deliver } = sessionDelivery(app.container.resolve<Env>(ENV))
+
+  app.post(
+    '/email/verification',
+    { config: { public: true, ...ATTEMPTS }, schema: { tags: ['auth'], body: emailRequestSchema } },
+    async (request, reply) => {
+      await app.container.resolve(RequestEmailVerificationUseCase).execute(request.body.email)
+
+      return reply.code(204).send()
+    },
+  )
+
+  app.post(
+    '/email/verify',
+    {
+      config: { public: true, ...ATTEMPTS },
+      schema: { tags: ['auth'], body: verifyEmailSchema, response: { 200: tokensResponseSchema } },
+    },
+    async (request, reply) =>
+      deliver(
+        request,
+        reply,
+        await app.container.resolve(VerifyEmailUseCase).execute(request.body),
+        200,
+      ),
+  )
+
+  app.post(
+    '/password/forgot',
+    { config: { public: true, ...ATTEMPTS }, schema: { tags: ['auth'], body: emailRequestSchema } },
+    async (request, reply) => {
+      await app.container.resolve(RequestPasswordResetUseCase).execute(request.body.email)
+
+      return reply.code(204).send()
+    },
+  )
+
+  app.post(
+    '/password/reset',
+    {
+      config: { public: true, ...ATTEMPTS },
+      schema: {
+        tags: ['auth'],
+        body: resetPasswordSchema,
+        response: { 200: tokensResponseSchema },
+      },
+    },
+    async (request, reply) =>
+      deliver(
+        request,
+        reply,
+        await app.container.resolve(ResetPasswordUseCase).execute(request.body),
+        200,
+      ),
+  )
+}

package/templates/api/src/infra/http/controllers/auth.controller.ts

@@ -1,36 +1,115 @@
 import type { FastifyInstance } from 'fastify'
-import { AUTH, type Auth } from '@/infra/auth/auth.factory'
-import { sendFetchResponse, toFetchRequest } from '@/infra/http/fetch-bridge'
+import type { ZodTypeProvider } from 'fastify-type-provider-zod'
+import { z } from 'zod'
+import { refreshSchema } from '@/domain/auth/dto/refresh.dto'
+import { sessionResponseSchema } from '@/domain/auth/dto/session-response.dto'
+import { signInSchema } from '@/domain/auth/dto/sign-in.dto'
+import { signUpSchema } from '@/domain/auth/dto/sign-up.dto'
+import { tokensResponseSchema } from '@/domain/auth/dto/tokens-response.dto'
+import { InvalidSessionError } from '@/domain/auth/errors/invalid-session.error'
+import { FindUserUseCase } from '@/domain/auth/use-cases/find-user.use-case'
+import { RefreshSessionUseCase } from '@/domain/auth/use-cases/refresh-session.use-case'
+import { SignInUseCase } from '@/domain/auth/use-cases/sign-in.use-case'
+import { SignOutUseCase } from '@/domain/auth/use-cases/sign-out.use-case'
+import { SignUpUseCase } from '@/domain/auth/use-cases/sign-up.use-case'
+import { ENV, type Env } from '@/infra/config/env'
+import { currentSession, currentUser } from '@/infra/http/hooks/auth.hook'
+import { REFRESH_COOKIE, sessionDelivery, wantsBearer } from '@/infra/http/session-delivery'
+
+// Repeated guessing is slowed down per address; a refresh happens every quarter hour per tab, so it gets more room.
+export const ATTEMPTS = { rateLimit: { max: 10, timeWindow: '1 minute' } }
+const REFRESHES = { rateLimit: { max: 60, timeWindow: '1 minute' } }
+
+const verificationRequiredSchema = z.object({ verificationRequired: z.literal(true) })
 
 export async function authController(fastify: FastifyInstance): Promise<void> {
-  const auth = fastify.container.resolve<Auth>(AUTH)
-  const routes = { config: { public: true }, schema: { hide: true } } as const
-
-  // prumo:mcp
-  // OAuth's token endpoint takes a form. It is kept as text and handed to Better Auth as sent.
-  fastify.addContentTypeParser(
-    'application/x-www-form-urlencoded',
-    { parseAs: 'string' },
-    (_request, body, done) => done(null, body),
+  const app = fastify.withTypeProvider<ZodTypeProvider>()
+  const { deliver, clearCookies } = sessionDelivery(app.container.resolve<Env>(ENV))
+
+  app.post(
+    '/sign-up',
+    {
+      config: { public: true, ...ATTEMPTS },
+      schema: {
+        tags: ['auth'],
+        body: signUpSchema,
+        response: { 201: z.union([tokensResponseSchema, verificationRequiredSchema]) },
+      },
+    },
+    async (request, reply) => {
+      const tokens = await app.container.resolve(SignUpUseCase).execute(request.body)
+
+      // No session until the address is confirmed: the client asks for the code next.
+      if (tokens === null) {
+        return reply.code(201).send({ verificationRequired: true })
+      }
+
+      return deliver(request, reply, tokens, 201)
+    },
   )
-  // prumo:end-mcp
-
-  fastify.route({
-    ...routes,
-    method: ['GET', 'POST'],
-    url: '/api/auth/*',
-    handler: async (request, reply) =>
-      sendFetchResponse(reply, await auth.handler(toFetchRequest(request))),
-  })
 
-  // prumo:mcp
-  // OAuth discovery lives at the root, outside Better Auth's base path, and still reaches its handler.
-  fastify.route({
-    ...routes,
-    method: 'GET',
-    url: '/.well-known/*',
-    handler: async (request, reply) =>
-      sendFetchResponse(reply, await auth.handler(toFetchRequest(request))),
+  app.post(
+    '/sign-in',
+    {
+      config: { public: true, ...ATTEMPTS },
+      schema: { tags: ['auth'], body: signInSchema, response: { 200: tokensResponseSchema } },
+    },
+    async (request, reply) =>
+      deliver(
+        request,
+        reply,
+        await app.container.resolve(SignInUseCase).execute(request.body),
+        200,
+      ),
+  )
+
+  app.post(
+    '/refresh',
+    {
+      config: { public: true, ...REFRESHES },
+      schema: { tags: ['auth'], body: refreshSchema, response: { 200: tokensResponseSchema } },
+    },
+    async (request, reply) => {
+      const token = request.body?.refreshToken ?? request.cookies[REFRESH_COOKIE]
+
+      try {
+        if (token === undefined) {
+          throw new InvalidSessionError()
+        }
+
+        return deliver(
+          request,
+          reply,
+          await app.container.resolve(RefreshSessionUseCase).execute(token),
+          200,
+        )
+      } catch (error) {
+        // A refresh that cannot succeed will not succeed later either: drop what the browser holds.
+        if (error instanceof InvalidSessionError && !wantsBearer(request)) {
+          clearCookies(reply)
+        }
+
+        throw error
+      }
+    },
+  )
+
+  app.post('/sign-out', { schema: { tags: ['auth'] } }, async (request, reply) => {
+    await app.container
+      .resolve(SignOutUseCase)
+      .execute(currentUser(request).id, currentSession(request))
+    clearCookies(reply)
+
+    return reply.code(204).send()
   })
-  // prumo:end-mcp
+
+  app.get(
+    '/session',
+    { schema: { tags: ['auth'], response: { 200: sessionResponseSchema } } },
+    async (request) => {
+      const user = await app.container.resolve(FindUserUseCase).execute(currentUser(request).id)
+
+      return { user: { id: user.id, email: user.email } }
+    },
+  )
 }

package/templates/api/src/infra/http/controllers/mcp.controller.ts

@@ -1,40 +1,59 @@
-import { requireMcpAuth } from '@better-auth/mcp'
 import type { AuthInfo } from '@modelcontextprotocol/server'
 import type { FastifyInstance } from 'fastify'
-import { AUTH, type Auth, mcpResource } from '@/infra/auth/auth.factory'
+import { ACCESS_TOKENS, type AccessTokens } from '@/domain/auth/ports/access-tokens.port'
 import { ENV, type Env } from '@/infra/config/env'
+import { HttpError } from '@/infra/http/errors/http-error'
 import { sendFetchResponse, toFetchRequest } from '@/infra/http/fetch-bridge'
-import { createMcpServerHandler } from '@/infra/mcp/mcp.server'
+import { missingScopes, SCOPES } from '@/infra/mcp/mcp.scopes'
+import { createMcpServerHandler, mcpResource, mcpResourceMetadataUrl } from '@/infra/mcp/mcp.server'
 
-type AccessTokenClaims = Parameters<Parameters<typeof requireMcpAuth>[1]>[1]
-
-function authInfoOf(request: Request, claims: AccessTokenClaims): AuthInfo {
-  const scope = typeof claims.scope === 'string' ? claims.scope : ''
-  const clientId = claims.azp ?? claims.client_id
-
-  return {
-    token: request.headers.get('authorization')?.replace(/^\w+\s+/, '') ?? '',
-    clientId: typeof clientId === 'string' ? clientId : '',
-    scopes: scope.split(' ').filter(Boolean),
-    ...(claims.exp === undefined ? {} : { expiresAt: claims.exp }),
-    extra: { userId: claims.sub },
-  }
-}
-
-// The route answers a bearer access token, never a session cookie, so the session hook stands aside.
+// The route answers an OAuth access token issued for it, never a session cookie or a first-party token: the
+// audience decides, so the session hook stands aside.
 export async function mcpController(fastify: FastifyInstance): Promise<void> {
-  const auth = fastify.container.resolve<Auth>(AUTH)
+  const tokens = fastify.container.resolve<AccessTokens>(ACCESS_TOKENS)
   const env = fastify.container.resolve<Env>(ENV)
+  const resource = mcpResource(env)
   const mcp = createMcpServerHandler(fastify.container)
-  const handle = requireMcpAuth(
-    auth,
-    (request, claims) => mcp.fetch(request, { authInfo: authInfoOf(request, claims) }),
-    { resource: mcpResource(env) },
-  )
 
   fastify.addHook('onClose', () => mcp.close())
 
-  fastify.post('/', { config: { public: true }, schema: { hide: true } }, async (request, reply) =>
-    sendFetchResponse(reply, await handle(toFetchRequest(request))),
+  fastify.post(
+    '/',
+    { config: { public: true }, schema: { hide: true } },
+    async (request, reply) => {
+      const token = /^Bearer (.+)$/i.exec(request.headers.authorization ?? '')?.[1]
+      const claims = token === undefined ? null : await tokens.verify(token, resource)
+
+      if (token === undefined || claims === null || claims.clientId === undefined) {
+        // RFC 9728: the 401 names the document that says where to obtain a token, and the scopes worth asking for.
+        reply.header(
+          'www-authenticate',
+          `Bearer resource_metadata="${mcpResourceMetadataUrl(env)}", scope="${Object.keys(SCOPES).join(' ')}"${token === undefined ? '' : ', error="invalid_token"'}`,
+        )
+        throw new HttpError(401, 'Unauthorized')
+      }
+
+      const scopes = (claims.scope ?? '').split(' ').filter(Boolean)
+      const missing = missingScopes(request.body, scopes)
+
+      // Checked before the server runs the call: a tool the user did not grant is refused with the scopes it needs,
+      // so the client can ask the user for them and come back.
+      if (missing.length > 0) {
+        reply.header(
+          'www-authenticate',
+          `Bearer error="insufficient_scope", scope="${missing.join(' ')}", resource_metadata="${mcpResourceMetadataUrl(env)}"`,
+        )
+        throw new HttpError(403, `This token lacks ${missing.join(' ')}`)
+      }
+
+      const authInfo: AuthInfo = {
+        token,
+        clientId: claims.clientId,
+        scopes,
+        extra: { userId: claims.userId },
+      }
+
+      return sendFetchResponse(reply, await mcp.fetch(toFetchRequest(request), { authInfo }))
+    },
   )
 }

package/templates/api/src/infra/http/controllers/oauth.controller.ts

@@ -0,0 +1,267 @@
+import type { FastifyInstance, FastifyReply } from 'fastify'
+import type { ZodTypeProvider } from 'fastify-type-provider-zod'
+import { z } from 'zod'
+import { InvalidSessionError } from '@/domain/auth/errors/invalid-session.error'
+import { SupersededTokenError } from '@/domain/auth/errors/superseded-token.error'
+import { RefreshSessionUseCase } from '@/domain/auth/use-cases/refresh-session.use-case'
+import type { SessionTokens } from '@/domain/auth/use-cases/start-session.use-case'
+import {
+  authorizationDecisionSchema,
+  authorizationRedirectSchema,
+} from '@/domain/oauth/dto/authorization-decision.dto'
+import { authorizationViewSchema } from '@/domain/oauth/dto/authorization-view.dto'
+import { AuthorizationRequestError } from '@/domain/oauth/errors/authorization-request.error'
+import { InvalidGrantError } from '@/domain/oauth/errors/invalid-grant.error'
+import { DecideAuthorizationUseCase } from '@/domain/oauth/use-cases/decide-authorization.use-case'
+import { ExchangeCodeUseCase } from '@/domain/oauth/use-cases/exchange-code.use-case'
+import { FindAuthorizationUseCase } from '@/domain/oauth/use-cases/find-authorization.use-case'
+import { StartAuthorizationUseCase } from '@/domain/oauth/use-cases/start-authorization.use-case'
+import { ENV, type Env } from '@/infra/config/env'
+import { currentUser } from '@/infra/http/hooks/auth.hook'
+import { SCOPES } from '@/infra/mcp/mcp.scopes'
+import { mcpResource } from '@/infra/mcp/mcp.server'
+
+const PUBLIC = { public: true, rateLimit: { max: 30, timeWindow: '1 minute' } }
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]'])
+
+const authorizeQuerySchema = z.object({
+  response_type: z.string().optional(),
+  client_id: z.string().max(2048),
+  redirect_uri: z.string().max(2048),
+  code_challenge: z.string().optional(),
+  code_challenge_method: z.string().optional(),
+  state: z.string().max(1024).optional(),
+  resource: z.string().optional(),
+  scope: z.string().optional(),
+})
+
+const idParamsSchema = z.object({ id: z.uuid() })
+
+function withParams(uri: string, params: Record<string, string | null | undefined>): string {
+  const url = new URL(uri)
+
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== null && value !== undefined) {
+      url.searchParams.set(key, value)
+    }
+  }
+
+  return url.toString()
+}
+
+function tokenResponse(tokens: SessionTokens) {
+  return {
+    access_token: tokens.accessToken.token,
+    token_type: 'Bearer',
+    expires_in: Math.round((tokens.accessToken.expiresAt.getTime() - Date.now()) / 1000),
+    refresh_token: tokens.refreshToken,
+    scope: tokens.scope ?? '',
+  }
+}
+
+// MCP's authorization server, from discovery to the token: RFC 9728, RFC 8414, OAuth 2.1 with PKCE, RFC 8707 and
+// RFC 9207, with clients identified by their metadata document. The user signs in and consents on the web app.
+export async function oauthController(fastify: FastifyInstance): Promise<void> {
+  const app = fastify.withTypeProvider<ZodTypeProvider>()
+  const env = app.container.resolve<Env>(ENV)
+  const issuer = env.API_URL
+  const resource = mcpResource(env)
+
+  // The token endpoint takes a form, as OAuth writes it.
+  app.addContentTypeParser(
+    'application/x-www-form-urlencoded',
+    { parseAs: 'string' },
+    (_request, body, done) => done(null, Object.fromEntries(new URLSearchParams(body as string))),
+  )
+
+  const scopesSupported = Object.keys(SCOPES)
+  const resourceMetadata = {
+    resource,
+    authorization_servers: [issuer],
+    bearer_methods_supported: ['header'],
+    scopes_supported: scopesSupported,
+  }
+
+  // At the path of the resource first, then at the root: the two places an MCP client looks.
+  for (const url of [
+    '/.well-known/oauth-protected-resource/api/mcp',
+    '/.well-known/oauth-protected-resource',
+  ]) {
+    app.get(url, { config: { public: true }, schema: { hide: true } }, async () => resourceMetadata)
+  }
+
+  app.get(
+    '/.well-known/oauth-authorization-server',
+    { config: { public: true }, schema: { hide: true } },
+    async () => ({
+      issuer,
+      authorization_endpoint: `${issuer}/api/oauth/authorize`,
+      token_endpoint: `${issuer}/api/oauth/token`,
+      response_types_supported: ['code'],
+      grant_types_supported: ['authorization_code', 'refresh_token'],
+      code_challenge_methods_supported: ['S256'],
+      token_endpoint_auth_methods_supported: ['none'],
+      client_id_metadata_document_supported: true,
+      scopes_supported: scopesSupported,
+      authorization_response_iss_parameter_supported: true,
+    }),
+  )
+
+  app.get(
+    '/api/oauth/authorize',
+    { config: PUBLIC, schema: { tags: ['oauth'], querystring: authorizeQuerySchema } },
+    async (request, reply) => {
+      const query = request.query
+
+      try {
+        const authorization = await app.container.resolve(StartAuthorizationUseCase).execute(
+          {
+            responseType: query.response_type,
+            clientId: query.client_id,
+            redirectUri: query.redirect_uri,
+            codeChallenge: query.code_challenge,
+            codeChallengeMethod: query.code_challenge_method,
+            clientState: query.state ?? null,
+            resource: query.resource,
+            scope: query.scope,
+          },
+          resource,
+          scopesSupported,
+        )
+
+        // Signing in, if needed, and the consent itself happen on the web app.
+        return reply.redirect(`${env.WEB_ORIGIN}/consent?request=${authorization.id}`)
+      } catch (error) {
+        if (error instanceof AuthorizationRequestError) {
+          return reply.redirect(
+            withParams(query.redirect_uri, {
+              error: error.code,
+              error_description: error.message,
+              state: query.state,
+              iss: issuer,
+            }),
+          )
+        }
+
+        throw error
+      }
+    },
+  )
+
+  app.get(
+    '/api/oauth/authorizations/:id',
+    {
+      schema: {
+        tags: ['oauth'],
+        params: idParamsSchema,
+        response: { 200: authorizationViewSchema },
+      },
+    },
+    async (request) => {
+      const authorization = await app.container
+        .resolve(FindAuthorizationUseCase)
+        .execute(request.params.id)
+      const redirect = new URL(authorization.redirectUri)
+
+      return {
+        clientId: authorization.clientId,
+        clientName: authorization.clientName,
+        clientHost: new URL(authorization.clientId).host,
+        redirectHost: redirect.host,
+        redirectsToThisDevice: LOOPBACK.has(redirect.hostname),
+        scopes: authorization.scope
+          .split(' ')
+          .map((scope) => ({ scope, description: SCOPES[scope] ?? scope })),
+      }
+    },
+  )
+
+  app.post(
+    '/api/oauth/authorizations/:id/decision',
+    {
+      schema: {
+        tags: ['oauth'],
+        params: idParamsSchema,
+        body: authorizationDecisionSchema,
+        response: { 200: authorizationRedirectSchema },
+      },
+    },
+    async (request) => {
+      const { authorization, code } = await app.container
+        .resolve(DecideAuthorizationUseCase)
+        .execute(request.params.id, currentUser(request).id, request.body.accept)
+
+      return {
+        redirectTo: withParams(authorization.redirectUri, {
+          ...(code === null ? { error: 'access_denied' } : { code }),
+          state: authorization.clientState,
+          iss: issuer,
+        }),
+      }
+    },
+  )
+
+  // Errors here are OAuth's, not problem+json: an MCP client reads `error` and `error_description`.
+  app.post(
+    '/api/oauth/token',
+    { config: PUBLIC, schema: { tags: ['oauth'] } },
+    async (request, reply: FastifyReply) => {
+      const body = (request.body ?? {}) as Record<string, string | undefined>
+      const fail = (error: string, description: string) =>
+        reply.code(400).send({ error, error_description: description })
+
+      reply.header('cache-control', 'no-store')
+
+      if (body.resource !== undefined && body.resource !== resource) {
+        return fail('invalid_target', `resource must be ${resource}`)
+      }
+
+      try {
+        if (body.grant_type === 'authorization_code') {
+          const { code, client_id, redirect_uri, code_verifier } = body
+
+          if (!code || !client_id || !redirect_uri || !code_verifier) {
+            return fail(
+              'invalid_request',
+              'code, client_id, redirect_uri and code_verifier are required',
+            )
+          }
+
+          return tokenResponse(
+            await app.container.resolve(ExchangeCodeUseCase).execute({
+              code,
+              clientId: client_id,
+              redirectUri: redirect_uri,
+              codeVerifier: code_verifier,
+              resource,
+            }),
+          )
+        }
+
+        if (body.grant_type === 'refresh_token') {
+          if (!body.refresh_token || !body.client_id) {
+            return fail('invalid_request', 'refresh_token and client_id are required')
+          }
+
+          return tokenResponse(
+            await app.container
+              .resolve(RefreshSessionUseCase)
+              .execute(body.refresh_token, body.client_id),
+          )
+        }
+
+        return fail('unsupported_grant_type', 'Only authorization_code and refresh_token')
+      } catch (error) {
+        if (
+          error instanceof InvalidGrantError ||
+          error instanceof InvalidSessionError ||
+          error instanceof SupersededTokenError
+        ) {
+          return fail('invalid_grant', error.message)
+        }
+
+        throw error
+      }
+    },
+  )
+}