@tinyrack/tinyauth-server 0.0.16 → 0.2.0

package/dist/lib/config/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/lib/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;oBAuC4B,CAAC;AAE5D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,sBAAsB,EAAE,YAAY,EAAO,CAAC;AAEzD,eAAO,MAAM,mBAAmB;;;;;;;;;;sBAGiC,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/lib/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAQpB;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;oBAuC4B,CAAC;AAE5D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,sBAAsB,EAAE,YAAY,EAAO,CAAC;AAEzD,eAAO,MAAM,mBAAmB;;;;;;;;;;sBAGiC,CAAC"}

package/dist/lib/config/client.js

@@ -1,4 +1,8 @@
 import z from 'zod';
+import { isSecureRedirectUri } from './url-policy.js';
+const RedirectUriSchema = z.string().refine(isSecureRedirectUri, {
+    message: 'Redirect URI must use HTTPS or local HTTP and must not contain fragments or wildcards.',
+});
 /**
  * OAuth/OIDC client configuration.
  * Defines applications that can authenticate through TinyAuth.
@@ -25,7 +29,7 @@ export const ClientConfigSchema = z
         .optional()
         .describe('OAuth client_secret for confidential clients. Omit for public clients.'),
     redirect_uris: z
-        .array(z.string())
+        .array(RedirectUriSchema)
         .describe('Allowed redirect URIs after authorization.'),
     response_types: z
         .array(z.string())

package/dist/lib/config/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/lib/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,CAAC,qCAAqC,CAAC;IAClD,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qCAAqC,CAAC;IAClD,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CAAC,4CAA4C,CAAC;IACzD,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CAAC,8CAA8C,CAAC;IAC3D,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CACP,0EAA0E,CAC3E;IACH,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,CAAC,yDAAyD,CAAC;CACvE,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,8CAA8C,CAAC,CAAC;AAI5D,MAAM,CAAC,MAAM,sBAAsB,GAAmB,EAAE,CAAC;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,KAAK,CAAC,kBAAkB,CAAC;KACzB,OAAO,CAAC,sBAAsB,CAAC;KAC/B,QAAQ,CAAC,oDAAoD,CAAC,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/lib/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE;IAC/D,OAAO,EACL,wFAAwF;CAC3F,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,CAAC,qCAAqC,CAAC;IAClD,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qCAAqC,CAAC;IAClD,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,iBAAiB,CAAC;SACxB,QAAQ,CAAC,4CAA4C,CAAC;IACzD,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CAAC,8CAA8C,CAAC;IAC3D,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CACP,0EAA0E,CAC3E;IACH,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,CAAC,yDAAyD,CAAC;CACvE,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,8CAA8C,CAAC,CAAC;AAI5D,MAAM,CAAC,MAAM,sBAAsB,GAAmB,EAAE,CAAC;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,KAAK,CAAC,kBAAkB,CAAC;KACzB,OAAO,CAAC,sBAAsB,CAAC;KAC/B,QAAQ,CAAC,oDAAoD,CAAC,CAAC"}

package/dist/lib/config/identity-providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-providers.d.ts","sourceRoot":"","sources":["../../../src/lib/config/identity-providers.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AA4DpB,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAiEe,CAAC;AAEzD,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAEF,eAAO,MAAM,iCAAiC,EAAE,sBAAsB,EAAO,CAAC;AAE9E,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAGuB,CAAC"}
+{"version":3,"file":"identity-providers.d.ts","sourceRoot":"","sources":["../../../src/lib/config/identity-providers.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAuCpB,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBA+De,CAAC;AAEzD,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAEF,eAAO,MAAM,iCAAiC,EAAE,sBAAsB,EAAO,CAAC;AAE9E,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAGuB,CAAC"}

package/dist/lib/config/identity-providers.js

@@ -1,26 +1,9 @@
 import z from 'zod';
-const JwksUrlSchema = z
-    .string()
-    .url()
-    .refine((value) => {
-    try {
-        const { hostname, protocol } = new URL(value);
-        if (protocol === 'https:') {
-            return true;
-        }
-        return protocol === 'http:' && isLocalHttpHostname(hostname);
-    }
-    catch {
-        return false;
-    }
-}, { message: 'JWKS URL must use HTTPS or local HTTP.' });
-function isLocalHttpHostname(hostname) {
-    return (hostname === 'localhost' ||
-        hostname.endsWith('.localhost') ||
-        hostname === '127.0.0.1' ||
-        hostname === '[::1]' ||
-        hostname === '::1');
-}
+import { isHttpsOrLocalHttpUrl } from './url-policy.js';
+const SecureEndpointUrlSchema = z.string().refine(isHttpsOrLocalHttpUrl, {
+    message: 'URL must use HTTPS or local HTTP.',
+});
+const JwksUrlSchema = SecureEndpointUrlSchema.describe('JWKS endpoint URL for providers that verify ID tokens.');
 const UserinfoMappingConfigSchema = z
     .object({
     id: z
@@ -60,22 +43,16 @@ export const IdentityProviderConfigSchema = z
     client_secret: z
         .string()
         .describe('OAuth client secret from the provider.'),
-    authorization_url: z.string().describe('OAuth authorization endpoint URL.'),
-    token_url: z.string().describe('OAuth token endpoint URL.'),
-    userinfo_url: z
-        .string()
-        .nullable()
-        .describe('OAuth userinfo endpoint URL.'),
-    jwks_url: JwksUrlSchema.optional().describe('JWKS endpoint URL for providers that verify ID tokens.'),
+    authorization_url: SecureEndpointUrlSchema.describe('OAuth authorization endpoint URL.'),
+    token_url: SecureEndpointUrlSchema.describe('OAuth token endpoint URL.'),
+    userinfo_url: SecureEndpointUrlSchema.nullable().describe('OAuth userinfo endpoint URL.'),
+    jwks_url: JwksUrlSchema.optional(),
     issuer: z
         .string()
         .url()
         .optional()
         .describe('Expected issuer for ID tokens verified with JWKS.'),
-    email_url: z
-        .string()
-        .optional()
-        .describe('Separate endpoint URL for fetching user email.'),
+    email_url: SecureEndpointUrlSchema.optional().describe('Separate endpoint URL for fetching user email.'),
     scopes: z
         .array(z.string())
         .describe('OAuth scopes to request from the provider.'),

package/dist/lib/config/identity-providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-providers.js","sourceRoot":"","sources":["../../../src/lib/config/identity-providers.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,EAAE;KACR,GAAG,EAAE;KACL,MAAM,CACL,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAE9C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,KAAK,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,wCAAwC,EAAE,CACtD,CAAC;AAEJ,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC/B,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,KAAK,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,2BAA2B,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,QAAQ,CAAC,sDAAsD,CAAC;IACnE,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,CAAC,oDAAoD,CAAC;IACjE,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE,CACnE;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,2DAA2D,CAAC;IACxE,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE,CACnE;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,yDAAyD,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IAC/D,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;SACpD,QAAQ,CAAC,yBAAyB,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAC1E,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,mDAAmD,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IACpE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,CAAC,wCAAwC,CAAC;IACrD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC3D,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,8BAA8B,CAAC;IAC3C,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACzC,wDAAwD,CACzD;IACD,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,mDAAmD,CAAC;IAChE,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,gDAAgD,CAAC;IAC7D,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CAAC,4CAA4C,CAAC;IACzD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,uBAAuB,EAAE,CAAC;SACvB,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;SACnC,QAAQ,CACP,iDAAiD;QAC/C,6EAA6E,CAChF;IACH,gBAAgB,EAAE,2BAA2B;CAC9C,CAAC;KACD,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,IACE,QAAQ,CAAC,IAAI,KAAK,eAAe;QACjC,QAAQ,CAAC,YAAY,KAAK,IAAI;QAC9B,QAAQ,CAAC,QAAQ;QACjB,CAAC,QAAQ,CAAC,MAAM,EAChB,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EACL,mEAAmE;SACtE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,2CAA2C,CAAC,CAAC;AAMzD,MAAM,CAAC,MAAM,iCAAiC,GAA6B,EAAE,CAAC;AAE9E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,KAAK,CAAC,4BAA4B,CAAC;KACnC,OAAO,CAAC,iCAAiC,CAAC;KAC1C,QAAQ,CAAC,oDAAoD,CAAC,CAAC"}
+{"version":3,"file":"identity-providers.js","sourceRoot":"","sources":["../../../src/lib/config/identity-providers.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,qBAAqB,EAAE;IACvE,OAAO,EAAE,mCAAmC;CAC7C,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,uBAAuB,CAAC,QAAQ,CACpD,wDAAwD,CACzD,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,QAAQ,CAAC,sDAAsD,CAAC;IACnE,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,CAAC,oDAAoD,CAAC;IACjE,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE,CACnE;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,2DAA2D,CAAC;IACxE,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE,CACnE;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,yDAAyD,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IAC/D,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;SACpD,QAAQ,CAAC,yBAAyB,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAC1E,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,mDAAmD,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IACpE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,CAAC,wCAAwC,CAAC;IACrD,iBAAiB,EAAE,uBAAuB,CAAC,QAAQ,CACjD,mCAAmC,CACpC;IACD,SAAS,EAAE,uBAAuB,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IACxE,YAAY,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACvD,8BAA8B,CAC/B;IACD,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,mDAAmD,CAAC;IAChE,SAAS,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACpD,gDAAgD,CACjD;IACD,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CAAC,4CAA4C,CAAC;IACzD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,uBAAuB,EAAE,CAAC;SACvB,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;SACnC,QAAQ,CACP,iDAAiD;QAC/C,6EAA6E,CAChF;IACH,gBAAgB,EAAE,2BAA2B;CAC9C,CAAC;KACD,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,IACE,QAAQ,CAAC,IAAI,KAAK,eAAe;QACjC,QAAQ,CAAC,YAAY,KAAK,IAAI;QAC9B,QAAQ,CAAC,QAAQ;QACjB,CAAC,QAAQ,CAAC,MAAM,EAChB,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EACL,mEAAmE;SACtE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,2CAA2C,CAAC,CAAC;AAMzD,MAAM,CAAC,MAAM,iCAAiC,GAA6B,EAAE,CAAC;AAE9E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,KAAK,CAAC,4BAA4B,CAAC;KACnC,OAAO,CAAC,iCAAiC,CAAC;KAC1C,QAAQ,CAAC,oDAAoD,CAAC,CAAC"}

package/dist/lib/config/url-policy.d.ts

@@ -0,0 +1,4 @@
+export declare function isLocalHttpHostname(hostname: string): boolean;
+export declare function isHttpsOrLocalHttpUrl(value: string): boolean;
+export declare function isSecureRedirectUri(value: string): boolean;
+//# sourceMappingURL=url-policy.d.ts.map

package/dist/lib/config/url-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-policy.d.ts","sourceRoot":"","sources":["../../../src/lib/config/url-policy.ts"],"names":[],"mappings":"AAeA,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ7D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAY5D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAU1D"}

package/dist/lib/config/url-policy.js

@@ -0,0 +1,38 @@
+import { parseIPv4 } from '../ip-utils.js';
+function parseUrl(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return null;
+    }
+}
+function isIPv4Loopback(hostname) {
+    const ipv4 = parseIPv4(hostname);
+    return ipv4 !== null && (ipv4 & 0xff000000) === 0x7f000000;
+}
+export function isLocalHttpHostname(hostname) {
+    return (hostname === 'localhost' ||
+        hostname.endsWith('.localhost') ||
+        isIPv4Loopback(hostname) ||
+        hostname === '[::1]' ||
+        hostname === '::1');
+}
+export function isHttpsOrLocalHttpUrl(value) {
+    const url = parseUrl(value);
+    if (!url) {
+        return false;
+    }
+    if (url.protocol === 'https:') {
+        return true;
+    }
+    return url.protocol === 'http:' && isLocalHttpHostname(url.hostname);
+}
+export function isSecureRedirectUri(value) {
+    const url = parseUrl(value);
+    if (!url) {
+        return false;
+    }
+    return (!value.includes('*') && url.hash === '' && isHttpsOrLocalHttpUrl(value));
+}
+//# sourceMappingURL=url-policy.js.map

package/dist/lib/config/url-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-policy.js","sourceRoot":"","sources":["../../../src/lib/config/url-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,KAAK,UAAU,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC/B,cAAc,CAAC,QAAQ,CAAC;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,KAAK,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,qBAAqB,CAAC,KAAK,CAAC,CACxE,CAAC;AACJ,CAAC"}

package/dist/lib/pkce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/lib/pkce.ts"],"names":[],"mappings":"AAmBA;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,MAAM,GAAE,MAAW;;;;GAWrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAAM,GAAG,OAAgB,oBASlC"}
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/lib/pkce.ts"],"names":[],"mappings":"AAmBA;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,MAAM,GAAE,MAAW;;;;GAWrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAAM,GAAG,OAAgB,oBAalC"}

package/dist/lib/pkce.js

@@ -46,6 +46,9 @@ export async function generatePKCE(length = 64) {
  * @see {@link https://datatracker.ietf.org/doc/html/rfc7636#section-4.6 | RFC 7636 §4.6 - Client Sends the Authorization Code and the Code Verifier to the Token Endpoint}
  */
 export async function validatePKCE(verifier, challenge, method = 'S256') {
+    if (method !== 'S256') {
+        return false;
+    }
     if (!CODE_VERIFIER_PATTERN.test(verifier)) {
         return false;
     }

package/dist/lib/pkce.js.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/lib/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAExC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAE1D,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,MAAwB;IACzE,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE;IACpD,IAAI,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO;QACL,QAAQ;QACR,SAAS;QACT,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,SAAiB,EACjB,SAA2B,MAAM;IAEjC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrE,sBAAsB;IACtB,OAAO,kBAAkB,KAAK,SAAS,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/lib/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAExC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAE1D,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,MAAwB;IACzE,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE;IACpD,IAAI,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO;QACL,QAAQ;QACR,SAAS;QACT,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,SAAiB,EACjB,SAA2B,MAAM;IAEjC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrE,sBAAsB;IACtB,OAAO,kBAAkB,KAAK,SAAS,CAAC;AAC1C,CAAC"}

package/dist/middleware/csrf.d.ts

@@ -0,0 +1,2 @@
+export declare function csrfProtection(publicOrigin: string): import("hono").MiddlewareHandler<any, string, {}, Response>;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/middleware/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/middleware/csrf.ts"],"names":[],"mappings":"AAmBA,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,+DA0ClD"}

package/dist/middleware/csrf.js

@@ -0,0 +1,51 @@
+import { getCookie } from 'hono/cookie';
+import { createMiddleware } from 'hono/factory';
+import { e } from "../schemas/error.js";
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+const OAUTH_PROVIDER_CALLBACK_PATTERN = /^\/api\/oauth\/[^/]+\/callback$/;
+function normalizeOrigin(value) {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isOAuthProviderCallback(path) {
+    return OAUTH_PROVIDER_CALLBACK_PATTERN.test(path);
+}
+export function csrfProtection(publicOrigin) {
+    const trustedOrigin = normalizeOrigin(publicOrigin);
+    return createMiddleware(async (c, next) => {
+        if (SAFE_METHODS.has(c.req.method)) {
+            await next();
+            return;
+        }
+        if (isOAuthProviderCallback(c.req.path)) {
+            await next();
+            return;
+        }
+        if (!getCookie(c, 'session')) {
+            await next();
+            return;
+        }
+        const requestOrigin = c.req.header('Origin');
+        if (requestOrigin &&
+            trustedOrigin &&
+            normalizeOrigin(requestOrigin) === trustedOrigin) {
+            await next();
+            return;
+        }
+        const fetchSite = c.req.header('Sec-Fetch-Site');
+        if (!requestOrigin && fetchSite === 'same-origin') {
+            await next();
+            return;
+        }
+        if (!requestOrigin && !fetchSite && !c.req.header('User-Agent')) {
+            await next();
+            return;
+        }
+        throw new e.CsrfViolation.Error();
+    });
+}
+//# sourceMappingURL=csrf.js.map

package/dist/middleware/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/middleware/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAExC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACzD,MAAM,+BAA+B,GAAG,iCAAiC,CAAC;AAE1E,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,YAAoB;IACjD,MAAM,aAAa,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAEpD,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,IACE,aAAa;YACb,aAAa;YACb,eAAe,CAAC,aAAa,CAAC,KAAK,aAAa,EAChD,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACjD,IAAI,CAAC,aAAa,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAClD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/repositories/revoked-token.repository.d.ts

@@ -8,6 +8,7 @@ import type { IRevokedTokenEntity, TokenType } from '../entities/revoked-token.e
  * by user/client combination.
  */
 export declare class RevokedTokenRepository extends EntityRepository<IRevokedTokenEntity> {
+    private grantRevocationJti;
     /**
      * Revoke a single token by its JTI
      *
@@ -21,6 +22,24 @@ export declare class RevokedTokenRepository extends EntityRepository<IRevokedTok
         userSub: string;
         expires_at: Date;
     }): Promise<IRevokedTokenEntity>;
+    /**
+     * Revoke a single token only if it has not already been revoked.
+     *
+     * @returns true when this call created the revocation entry.
+     */
+    revokeTokenOnce(params: {
+        jti: string;
+        token_type: TokenType;
+        clientId: string;
+        userSub: string;
+        expires_at: Date;
+    }): Promise<boolean>;
+    revokeGrant(params: {
+        grantId: string;
+        clientId: string;
+        userSub: string;
+        expires_at: Date;
+    }): Promise<IRevokedTokenEntity>;
     /**
      * Check if a token is revoked by its JTI
      *
@@ -28,5 +47,6 @@ export declare class RevokedTokenRepository extends EntityRepository<IRevokedTok
      * @returns true if the token is revoked
      */
     isRevoked(jti: string): Promise<boolean>;
+    isGrantRevoked(grantId: string): Promise<boolean>;
 }
 //# sourceMappingURL=revoked-token.repository.d.ts.map

package/dist/repositories/revoked-token.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revoked-token.repository.d.ts","sourceRoot":"","sources":["../../src/repositories/revoked-token.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EACV,mBAAmB,EACnB,SAAS,EACV,MAAM,qCAAqC,CAAC;AAE7C;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB,CAAC,mBAAmB,CAAC;IAC/E;;;;;OAKG;IACG,WAAW,CAAC,MAAM,EAAE;QACxB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,SAAS,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAmBhC;;;;;OAKG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAI/C"}
+{"version":3,"file":"revoked-token.repository.d.ts","sourceRoot":"","sources":["../../src/repositories/revoked-token.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAEjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EACV,mBAAmB,EACnB,SAAS,EACV,MAAM,qCAAqC,CAAC;AAE7C;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB,CAAC,mBAAmB,CAAC;IAC/E,OAAO,CAAC,kBAAkB;IAI1B;;;;;OAKG;IACG,WAAW,CAAC,MAAM,EAAE;QACxB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,SAAS,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAmBhC;;;;OAIG;IACG,eAAe,CAAC,MAAM,EAAE;QAC5B,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,SAAS,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,OAAO,CAAC;IAyBd,WAAW,CAAC,MAAM,EAAE;QACxB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAUhC;;;;;OAKG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKxC,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAGxD"}

package/dist/repositories/revoked-token.repository.js

@@ -1,4 +1,4 @@
-import { EntityRepository } from '@mikro-orm/core';
+import { EntityRepository, UniqueConstraintViolationException, } from '@mikro-orm/core';
 /**
  * Repository for managing revoked tokens
  *
@@ -7,6 +7,9 @@ import { EntityRepository } from '@mikro-orm/core';
  * by user/client combination.
  */
 export class RevokedTokenRepository extends EntityRepository {
+    grantRevocationJti(grantId) {
+        return `grant:${grantId}`;
+    }
     /**
      * Revoke a single token by its JTI
      *
@@ -29,6 +32,43 @@ export class RevokedTokenRepository extends EntityRepository {
         await this.getEntityManager().persist(entity).flush();
         return entity;
     }
+    /**
+     * Revoke a single token only if it has not already been revoked.
+     *
+     * @returns true when this call created the revocation entry.
+     */
+    async revokeTokenOnce(params) {
+        const existing = await this.findOne({ jti: params.jti });
+        if (existing) {
+            return false;
+        }
+        const entity = this.create({
+            jti: params.jti,
+            token_type: params.token_type,
+            client: params.clientId,
+            user: params.userSub,
+            expires_at: params.expires_at,
+        });
+        try {
+            await this.getEntityManager().persist(entity).flush();
+            return true;
+        }
+        catch (error) {
+            if (error instanceof UniqueConstraintViolationException) {
+                return false;
+            }
+            throw error;
+        }
+    }
+    async revokeGrant(params) {
+        return this.revokeToken({
+            jti: this.grantRevocationJti(params.grantId),
+            token_type: 'refresh_token',
+            clientId: params.clientId,
+            userSub: params.userSub,
+            expires_at: params.expires_at,
+        });
+    }
     /**
      * Check if a token is revoked by its JTI
      *
@@ -39,5 +79,8 @@ export class RevokedTokenRepository extends EntityRepository {
         const count = await this.count({ jti });
         return count > 0;
     }
+    async isGrantRevoked(grantId) {
+        return this.isRevoked(this.grantRevocationJti(grantId));
+    }
 }
 //# sourceMappingURL=revoked-token.repository.js.map

package/dist/repositories/revoked-token.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"revoked-token.repository.js","sourceRoot":"","sources":["../../src/repositories/revoked-token.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAMnD;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,gBAAqC;IAC/E;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,MAMjB;QACC,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM,CAAC,OAAO;YACpB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACtD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACxC,OAAO,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"revoked-token.repository.js","sourceRoot":"","sources":["../../src/repositories/revoked-token.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,kCAAkC,GACnC,MAAM,iBAAiB,CAAC;AAMzB;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,gBAAqC;IACvE,kBAAkB,CAAC,OAAe;QACxC,OAAO,SAAS,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,MAMjB;QACC,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM,CAAC,OAAO;YACpB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACtD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,MAMrB;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM,CAAC,OAAO;YACpB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAkC,EAAE,CAAC;gBACxD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAKjB;QACC,OAAO,IAAI,CAAC,WAAW,CAAC;YACtB,GAAG,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC;YAC5C,UAAU,EAAE,eAAe;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACxC,OAAO,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;CACF"}