@tinyrack/tinyauth-server 0.0.7

package/dist/services/oauth-token.service.d.ts

@@ -0,0 +1,162 @@
+import type { TinyAuthRuntimeConfig } from '../lib/config/index.ts';
+import type { JwtService } from './jwt.service.ts';
+import type { MikroService } from './mikro.service.ts';
+import type { OAuthClientService } from './oauth-client.service.ts';
+import type { SecurityService } from './security.service.ts';
+import type { UserService } from './user.service.ts';
+/**
+ * Parameters for authorization code grant (RFC 6749 §4.1.3)
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
+ */
+export interface AuthorizationCodeGrantParams {
+    /** Authorization code received from /authorize endpoint */
+    code: string;
+    /** Redirect URI used in authorization request (must match) */
+    redirectUri: string;
+    /** OAuth client identifier */
+    clientId: string;
+    /** PKCE code verifier (required if code_challenge was used) */
+    codeVerifier?: string | undefined;
+}
+/**
+ * Parameters for refresh token grant (RFC 6749 §6)
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+ */
+export interface RefreshTokenGrantParams {
+    /** Refresh token from previous token response */
+    refreshToken: string;
+    /** OAuth client identifier (must match original request) */
+    clientId: string;
+}
+/**
+ * Token introspection result (RFC 7662 §2.2)
+ * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.2
+ */
+export interface TokenIntrospectionResult {
+    /** Whether the token is currently active */
+    active: boolean;
+    /** Space-separated list of scopes (only if active) */
+    scope?: string | undefined;
+    /** Client identifier (only if active) */
+    client_id?: string | undefined;
+    /** Type of token (only if active) */
+    token_type?: 'Bearer' | undefined;
+    /** Expiration timestamp in seconds (only if active) */
+    exp?: number | undefined;
+    /** Issued-at timestamp in seconds (only if active) */
+    iat?: number | undefined;
+    /** Subject identifier - user ID (only if active) */
+    sub?: string | undefined;
+    /** Issuer identifier (only if active) */
+    iss?: string | undefined;
+}
+/**
+ * OAuth 2.0 / OIDC token response (RFC 6749 §5.1)
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse
+ */
+export interface TokenResponse {
+    /** OAuth 2.0 access token (JWT format) */
+    access_token: string;
+    /** Token type identifier */
+    token_type: 'Bearer';
+    /** Access token lifetime in seconds */
+    expires_in: number;
+    /** Refresh token for obtaining new access tokens */
+    refresh_token: string;
+    /** OpenID Connect ID Token (JWT format, only if openid scope requested) */
+    id_token?: string | undefined;
+    /** Space-separated list of granted scopes */
+    scope: string;
+}
+/**
+ * OAuth Token Service
+ *
+ * Handles OAuth 2.0 token issuance for different grant types:
+ * - Authorization Code Grant (RFC 6749 §4.1)
+ * - Refresh Token Grant (RFC 6749 §6)
+ *
+ * Supports both config-based and database-based users/clients.
+ */
+export declare class OAuthTokenService {
+    private readonly config;
+    private readonly mikro;
+    private readonly userService;
+    private readonly oauthClientService;
+    private readonly jwtService;
+    private readonly securityService;
+    constructor(config: TinyAuthRuntimeConfig, mikro: MikroService, userService: UserService, oauthClientService: OAuthClientService, jwtService: JwtService, securityService: SecurityService);
+    /**
+     * Exchange authorization code for tokens
+     *
+     * Implements OAuth 2.0 Authorization Code Grant (RFC 6749 §4.1.3)
+     * with PKCE support (RFC 7636).
+     *
+     * @param params - Authorization code grant parameters
+     * @returns Token response with access_token, refresh_token, and optionally id_token
+     * @throws {InvalidAuthorizationCode} - Code is invalid or expired
+     * @throws {RedirectUriMismatch} - Redirect URI doesn't match authorization request
+     * @throws {MissingCodeVerifier} - PKCE verifier required but not provided
+     * @throws {InvalidPKCEVerifier} - PKCE verification failed
+     */
+    exchangeAuthorizationCode(params: AuthorizationCodeGrantParams): Promise<TokenResponse>;
+    /**
+     * Refresh access token using refresh token
+     *
+     * Implements OAuth 2.0 Refresh Token Grant (RFC 6749 §6) with
+     * Refresh Token Rotation (OAuth 2.0 Security Best Current Practice).
+     *
+     * When a refresh token is used:
+     * 1. The old refresh token is revoked (token rotation)
+     * 2. A new refresh token is issued along with the new access token
+     * 3. This prevents token replay attacks
+     *
+     * @param params - Refresh token grant parameters
+     * @returns Token response with new access_token and refresh_token
+     * @throws {InvalidRefreshToken} - Refresh token is invalid, expired, or revoked
+     * @throws {ClientIdMismatch} - Client ID doesn't match original token request
+     */
+    refreshAccessToken(params: RefreshTokenGrantParams): Promise<TokenResponse>;
+    /**
+     * Introspect a token (access token or refresh token)
+     *
+     * Implements OAuth 2.0 Token Introspection (RFC 7662).
+     * Returns metadata about the token including active status.
+     *
+     * @param token - Token to introspect
+     * @param tokenTypeHint - Hint about token type (access_token or refresh_token)
+     * @returns Token introspection result
+     */
+    introspectToken(token: string, tokenTypeHint?: 'access_token' | 'refresh_token'): Promise<TokenIntrospectionResult>;
+    /**
+     * Revoke a token (access token or refresh token)
+     *
+     * Implements OAuth 2.0 Token Revocation (RFC 7009).
+     * When revoking a refresh token, also revokes all associated access tokens
+     * for the same user/client combination.
+     *
+     * @param token - Token to revoke
+     * @param tokenTypeHint - Hint about token type (access_token or refresh_token)
+     * @returns void - Always succeeds per RFC 7009 §2.1
+     */
+    revokeToken(token: string, tokenTypeHint?: 'access_token' | 'refresh_token'): Promise<void>;
+    /**
+     * Compute the at_hash claim value (OIDC Core 1.0 §3.1.3.6)
+     *
+     * The at_hash is the left-most half of the hash of the access token,
+     * using the hash algorithm from the ID Token's JOSE Header.
+     * For RS256, this is SHA-256.
+     *
+     * @param accessToken - The access token to hash
+     * @returns Base64URL-encoded left half of the SHA-256 hash
+     */
+    private computeAtHash;
+    /**
+     * Build complete OAuth/OIDC token response
+     *
+     * @param params - Token generation parameters
+     * @returns Complete token response
+     */
+    private buildTokenResponse;
+}
+//# sourceMappingURL=oauth-token.service.d.ts.map

package/dist/services/oauth-token.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token.service.d.ts","sourceRoot":"","sources":["../../src/services/oauth-token.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAGpE,OAAO,KAAK,EAEV,UAAU,EAEX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,qCAAqC;IACrC,UAAU,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAClC,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,4BAA4B;IAC5B,UAAU,EAAE,QAAQ,CAAC;IACrB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;gBAEhD,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,WAAW,EACxB,kBAAkB,EAAE,kBAAkB,EACtC,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe;IAUlC;;;;;;;;;;;;OAYG;IACG,yBAAyB,CAAC,MAAM,EAAE,4BAA4B;IA8EpE;;;;;;;;;;;;;;;OAeG;IACG,kBAAkB,CAAC,MAAM,EAAE,uBAAuB;IA6CxD;;;;;;;;;OASG;IACG,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,GAC/C,OAAO,CAAC,wBAAwB,CAAC;IAuEpC;;;;;;;;;;OAUG;IACG,WAAW,CACf,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,GAC/C,OAAO,CAAC,IAAI,CAAC;IA+DhB;;;;;;;;;OASG;YACW,aAAa;IAc3B;;;;;OAKG;YACW,kBAAkB;CA0FjC"}

package/dist/services/oauth-token.service.js

@@ -0,0 +1,374 @@
+import { stringToBytes, toArrayBuffer, toBase64Url } from "../lib/base64url.js";
+import { validatePKCE } from "../lib/pkce.js";
+import { e } from "../schemas/error.js";
+/**
+ * OAuth Token Service
+ *
+ * Handles OAuth 2.0 token issuance for different grant types:
+ * - Authorization Code Grant (RFC 6749 §4.1)
+ * - Refresh Token Grant (RFC 6749 §6)
+ *
+ * Supports both config-based and database-based users/clients.
+ */
+export class OAuthTokenService {
+    config;
+    mikro;
+    userService;
+    oauthClientService;
+    jwtService;
+    securityService;
+    constructor(config, mikro, userService, oauthClientService, jwtService, securityService) {
+        this.config = config;
+        this.mikro = mikro;
+        this.userService = userService;
+        this.oauthClientService = oauthClientService;
+        this.jwtService = jwtService;
+        this.securityService = securityService;
+    }
+    /**
+     * Exchange authorization code for tokens
+     *
+     * Implements OAuth 2.0 Authorization Code Grant (RFC 6749 §4.1.3)
+     * with PKCE support (RFC 7636).
+     *
+     * @param params - Authorization code grant parameters
+     * @returns Token response with access_token, refresh_token, and optionally id_token
+     * @throws {InvalidAuthorizationCode} - Code is invalid or expired
+     * @throws {RedirectUriMismatch} - Redirect URI doesn't match authorization request
+     * @throws {MissingCodeVerifier} - PKCE verifier required but not provided
+     * @throws {InvalidPKCEVerifier} - PKCE verification failed
+     */
+    async exchangeAuthorizationCode(params) {
+        const { code, redirectUri, clientId, codeVerifier } = params;
+        // 1. Look up client to get primary key (clientId in request is the business key)
+        const client = await this.oauthClientService.findByClientId(clientId);
+        // 2. Verify and consume the authorization code
+        // Authorization codes are single-use (RFC 6749 §4.1.2)
+        const codeHash = await this.securityService.hashOpaqueToken('oauth-code', code);
+        const codeEntity = await this.mikro.oauthCode.findUnconsumedByClientAndCodeHash(client.id, codeHash);
+        if (!codeEntity) {
+            throw new e.InvalidAuthorizationCode.Error();
+        }
+        if (codeEntity.expiredAt < new Date()) {
+            throw new e.InvalidAuthorizationCode.Error();
+        }
+        codeEntity.consumedAt = new Date();
+        await this.mikro.em.flush();
+        // 3. Populate user relation
+        await this.mikro.em.populate(codeEntity, ['user']);
+        // 4. Validate redirect_uri matches (RFC 6749 §4.1.3)
+        // This prevents authorization code interception attacks
+        if (codeEntity.redirectUri !== redirectUri) {
+            throw new e.RedirectUriMismatch.Error();
+        }
+        // 5. Validate PKCE if code_challenge was used (RFC 7636 §4.6)
+        // PKCE protects against authorization code interception for public clients
+        if (codeEntity.codeChallenge) {
+            if (!codeVerifier) {
+                throw new e.MissingCodeVerifier.Error();
+            }
+            const isPKCEValid = await validatePKCE(codeVerifier, codeEntity.codeChallenge, codeEntity.codeChallengeMethod);
+            if (!isPKCEValid) {
+                throw new e.InvalidPKCEVerifier.Error();
+            }
+        }
+        // 6. Get user data from relation (load via Ref)
+        const user = await codeEntity.user.load();
+        if (!user) {
+            throw new e.UserNotFound.Error();
+        }
+        // 7. Build token response
+        return this.buildTokenResponse({
+            userSub: user.sub,
+            userEmail: user.email,
+            userEmailVerified: user.email_verified,
+            clientId: client.clientId,
+            scope: codeEntity.scope,
+            nonce: codeEntity.nonce,
+            // Pass OIDC authentication metadata from the authorization code
+            // Only include when defined and non-null (exactOptionalPropertyTypes)
+            ...(codeEntity.authTime != null && {
+                authTime: codeEntity.authTime,
+            }),
+        });
+    }
+    /**
+     * Refresh access token using refresh token
+     *
+     * Implements OAuth 2.0 Refresh Token Grant (RFC 6749 §6) with
+     * Refresh Token Rotation (OAuth 2.0 Security Best Current Practice).
+     *
+     * When a refresh token is used:
+     * 1. The old refresh token is revoked (token rotation)
+     * 2. A new refresh token is issued along with the new access token
+     * 3. This prevents token replay attacks
+     *
+     * @param params - Refresh token grant parameters
+     * @returns Token response with new access_token and refresh_token
+     * @throws {InvalidRefreshToken} - Refresh token is invalid, expired, or revoked
+     * @throws {ClientIdMismatch} - Client ID doesn't match original token request
+     */
+    async refreshAccessToken(params) {
+        const { refreshToken, clientId } = params;
+        // 1. Verify refresh token (also checks revocation)
+        const refreshPayload = await this.jwtService.verifyRefreshToken(refreshToken);
+        // 2. Validate client_id matches (RFC 6749 §6)
+        // Refresh token is bound to the client that obtained it
+        if (refreshPayload.client_id !== clientId) {
+            throw new e.ClientIdMismatch.Error();
+        }
+        // 3. Load user (supports both config and DB users)
+        const userEntity = await this.mikro.user.verifyBySub(refreshPayload.sub);
+        const userData = await this.userService.userEntityToSessionUser(userEntity);
+        // 4. Get client info
+        const client = await this.oauthClientService.findByClientId(clientId);
+        // 5. Refresh Token Rotation: Revoke the old refresh token
+        // This is a security best practice per OAuth 2.0 Security BCP §4.14.2
+        // If an attacker tries to use a stolen refresh token after the legitimate
+        // user has already used it, the token will be rejected as revoked.
+        if (refreshPayload.jti && refreshPayload.exp) {
+            await this.mikro.revokedToken.revokeToken({
+                jti: refreshPayload.jti,
+                token_type: 'refresh_token',
+                clientId: client.id, // Use entity primary key
+                userSub: userData.sub,
+                expires_at: new Date(refreshPayload.exp * 1000),
+            });
+        }
+        // 6. Build token response with new access and refresh tokens
+        // (no nonce in refresh flow)
+        return this.buildTokenResponse({
+            userSub: userData.sub,
+            userEmail: userData.email,
+            userEmailVerified: userData.email_verified,
+            clientId: client.clientId,
+            scope: refreshPayload.scope.split(' '),
+        });
+    }
+    /**
+     * Introspect a token (access token or refresh token)
+     *
+     * Implements OAuth 2.0 Token Introspection (RFC 7662).
+     * Returns metadata about the token including active status.
+     *
+     * @param token - Token to introspect
+     * @param tokenTypeHint - Hint about token type (access_token or refresh_token)
+     * @returns Token introspection result
+     */
+    async introspectToken(token, tokenTypeHint) {
+        // Try to verify the token based on hint or both types
+        let payload = null;
+        let tokenType = null;
+        // 1. Try to verify as hinted token type first (if hint provided)
+        if (tokenTypeHint === 'access_token') {
+            try {
+                payload = await this.jwtService.verifyAccessToken(token);
+                tokenType = 'access_token';
+            }
+            catch {
+                // Hint failed, try refresh token
+                try {
+                    payload = await this.jwtService.verifyRefreshToken(token);
+                    tokenType = 'refresh_token';
+                }
+                catch {
+                    // Both failed, fall through to inactive
+                }
+            }
+        }
+        else if (tokenTypeHint === 'refresh_token') {
+            try {
+                payload = await this.jwtService.verifyRefreshToken(token);
+                tokenType = 'refresh_token';
+            }
+            catch {
+                // Hint failed, try access token
+                try {
+                    payload = await this.jwtService.verifyAccessToken(token);
+                    tokenType = 'access_token';
+                }
+                catch {
+                    // Both failed, fall through to inactive
+                }
+            }
+        }
+        else {
+            // 2. No hint provided, try both types
+            try {
+                payload = await this.jwtService.verifyAccessToken(token);
+                tokenType = 'access_token';
+            }
+            catch {
+                try {
+                    payload = await this.jwtService.verifyRefreshToken(token);
+                    tokenType = 'refresh_token';
+                }
+                catch {
+                    // Both failed, fall through to inactive
+                }
+            }
+        }
+        // 3. If verification succeeded, return active response
+        if (payload && tokenType) {
+            return {
+                active: true,
+                scope: payload.scope,
+                client_id: payload.client_id,
+                token_type: 'Bearer',
+                ...(payload.exp !== undefined && { exp: payload.exp }),
+                ...(payload.iat !== undefined && { iat: payload.iat }),
+                sub: payload.sub,
+                ...(payload.iss !== undefined && { iss: payload.iss }),
+            };
+        }
+        // 4. Token is invalid or expired - return inactive
+        // RFC 7662 §2.2: "If the token is not active, does not exist on this server,
+        // or the protected resource is not allowed to introspect this particular token,
+        // then the authorization server MUST return an introspection response with
+        // the active field set to false"
+        return {
+            active: false,
+        };
+    }
+    /**
+     * Revoke a token (access token or refresh token)
+     *
+     * Implements OAuth 2.0 Token Revocation (RFC 7009).
+     * When revoking a refresh token, also revokes all associated access tokens
+     * for the same user/client combination.
+     *
+     * @param token - Token to revoke
+     * @param tokenTypeHint - Hint about token type (access_token or refresh_token)
+     * @returns void - Always succeeds per RFC 7009 §2.1
+     */
+    async revokeToken(token, tokenTypeHint) {
+        // Decode the token to get metadata (without full verification)
+        const decoded = this.jwtService.decodeToken(token);
+        if (!decoded?.jti || !decoded.sub || !decoded.exp) {
+            // RFC 7009 §2.1: "The authorization server responds with HTTP status
+            // code 200 if the token has been revoked successfully or if the client
+            // submitted an invalid token."
+            return;
+        }
+        const jti = decoded.jti;
+        const userSub = decoded.sub;
+        const rawClientId = decoded['client_id'];
+        const clientId = typeof rawClientId === 'string' ? rawClientId : undefined;
+        const rawTyp = decoded['typ'];
+        const tokenType = (rawTyp === 'access_token' || rawTyp === 'refresh_token'
+            ? rawTyp
+            : undefined) ||
+            tokenTypeHint ||
+            'access_token';
+        const expiresAt = new Date(decoded.exp * 1000);
+        if (!clientId) {
+            return;
+        }
+        // Check if already revoked
+        const isAlreadyRevoked = await this.mikro.revokedToken.isRevoked(jti);
+        if (isAlreadyRevoked) {
+            return;
+        }
+        // Look up user and client entities to get primary keys
+        // Note: clientId from token is the business key, we need the entity's primary key
+        const userEntity = await this.mikro.user.findOne({ sub: userSub });
+        const clientEntity = await this.mikro.oauthClient.findOne({ clientId });
+        if (!userEntity || !clientEntity) {
+            // User or client no longer exists, but we still return success per RFC 7009
+            return;
+        }
+        // Revoke the token (using primary keys for FK references)
+        await this.mikro.revokedToken.revokeToken({
+            jti,
+            token_type: tokenType,
+            clientId: clientEntity.id, // Use entity's primary key
+            userSub: userEntity.sub,
+            expires_at: expiresAt,
+        });
+        // RFC 7009 §2.1: "If the particular token is a refresh token and the
+        // authorization server supports the revocation of access tokens, then
+        // the authorization server SHOULD also invalidate all access tokens
+        // based on the same authorization grant."
+        //
+        // Since we can't enumerate all access tokens issued for this refresh token,
+        // the revocation check happens at token verification time via jti lookup.
+        // Access tokens will be rejected when their jti is in the revoked_tokens table.
+    }
+    /**
+     * Compute the at_hash claim value (OIDC Core 1.0 §3.1.3.6)
+     *
+     * The at_hash is the left-most half of the hash of the access token,
+     * using the hash algorithm from the ID Token's JOSE Header.
+     * For RS256, this is SHA-256.
+     *
+     * @param accessToken - The access token to hash
+     * @returns Base64URL-encoded left half of the SHA-256 hash
+     */
+    async computeAtHash(accessToken) {
+        // SHA-256 hash of the access token
+        const hash = new Uint8Array(await crypto.subtle.digest('SHA-256', toArrayBuffer(stringToBytes(accessToken))));
+        // Take the left-most half (128 bits = 16 bytes for SHA-256)
+        const leftHalf = hash.slice(0, hash.byteLength / 2);
+        // Base64URL encode
+        return toBase64Url(leftHalf);
+    }
+    /**
+     * Build complete OAuth/OIDC token response
+     *
+     * @param params - Token generation parameters
+     * @returns Complete token response
+     */
+    async buildTokenResponse(params) {
+        const { userSub, userEmail, userEmailVerified, clientId, scope, nonce, authTime, } = params;
+        const scopeString = scope.join(' ');
+        // Generate access token (RFC 6749 §1.4)
+        const accessToken = await this.jwtService.signAccessToken({
+            typ: 'access_token',
+            sub: userSub,
+            client_id: clientId,
+            scope: scopeString,
+        });
+        // Generate refresh token (RFC 6749 §1.5)
+        const refreshToken = await this.jwtService.signRefreshToken({
+            typ: 'refresh_token',
+            sub: userSub,
+            client_id: clientId,
+            scope: scopeString,
+        });
+        const response = {
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: this.config.tokens.access_token_ttl,
+            refresh_token: refreshToken,
+            scope: scopeString,
+        };
+        // Generate ID token if OIDC (openid scope present)
+        if (scope.includes('openid')) {
+            const idTokenPayload = {
+                sub: userSub,
+                aud: clientId,
+            };
+            if (nonce) {
+                idTokenPayload.nonce = nonce;
+            }
+            // Include OIDC authentication metadata claims
+            if (authTime !== undefined) {
+                idTokenPayload.auth_time = authTime;
+            }
+            // Compute at_hash (OIDC Core 1.0 §3.1.3.6)
+            // Required when ID Token is issued from Authorization Endpoint with
+            // access token in the same response, optional otherwise but recommended
+            idTokenPayload.at_hash = await this.computeAtHash(accessToken);
+            if (scope.includes('email')) {
+                idTokenPayload.email = userEmail;
+                idTokenPayload.email_verified = userEmailVerified;
+            }
+            if (scope.includes('profile')) {
+                idTokenPayload.name = userEmail;
+            }
+            response.id_token = await this.jwtService.signIdToken(idTokenPayload);
+        }
+        return response;
+    }
+}
+//# sourceMappingURL=oauth-token.service.js.map

package/dist/services/oauth-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token.service.js","sourceRoot":"","sources":["../../src/services/oauth-token.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEhF,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAgFxC;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAiB;IACX,MAAM,CAAwB;IAC9B,KAAK,CAAe;IACpB,WAAW,CAAc;IACzB,kBAAkB,CAAqB;IACvC,UAAU,CAAa;IACvB,eAAe,CAAkB;IAClD,YACE,MAA6B,EAC7B,KAAmB,EACnB,WAAwB,EACxB,kBAAsC,EACtC,UAAsB,EACtB,eAAgC;QAEhC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,yBAAyB,CAAC,MAAoC;QAClE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;QAE7D,iFAAiF;QACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAEtE,+CAA+C;QAC/C,uDAAuD;QACvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CACzD,YAAY,EACZ,IAAI,CACL,CAAC;QACF,MAAM,UAAU,GACd,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,iCAAiC,CAC1D,MAAM,CAAC,EAAE,EACT,QAAQ,CACT,CAAC;QAEJ,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;QAC/C,CAAC;QAED,IAAI,UAAU,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;QAC/C,CAAC;QAED,UAAU,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAE5B,4BAA4B;QAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAEnD,qDAAqD;QACrD,wDAAwD;QACxD,IAAI,UAAU,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YAC3C,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;QAC1C,CAAC;QAED,8DAA8D;QAC9D,2EAA2E;QAC3E,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,YAAY,CACpC,YAAY,EACZ,UAAU,CAAC,aAAa,EACxB,UAAU,CAAC,mBAAmB,CAC/B,CAAC;YAEF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,0BAA0B;QAC1B,OAAO,IAAI,CAAC,kBAAkB,CAAC;YAC7B,OAAO,EAAE,IAAI,CAAC,GAAG;YACjB,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,iBAAiB,EAAE,IAAI,CAAC,cAAc;YACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,gEAAgE;YAChE,sEAAsE;YACtE,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,IAAI,IAAI;gBACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;aAC9B,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAA+B;QACtD,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAE1C,mDAAmD;QACnD,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAEzD,8CAA8C;QAC9C,wDAAwD;QACxD,IAAI,cAAc,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QACvC,CAAC;QAED,mDAAmD;QACnD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAE5E,qBAAqB;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAEtE,0DAA0D;QAC1D,sEAAsE;QACtE,0EAA0E;QAC1E,mEAAmE;QACnE,IAAI,cAAc,CAAC,GAAG,IAAI,cAAc,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC;gBACxC,GAAG,EAAE,cAAc,CAAC,GAAG;gBACvB,UAAU,EAAE,eAAe;gBAC3B,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,yBAAyB;gBAC9C,OAAO,EAAE,QAAQ,CAAC,GAAG;gBACrB,UAAU,EAAE,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,GAAG,IAAI,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;QAED,6DAA6D;QAC7D,6BAA6B;QAC7B,OAAO,IAAI,CAAC,kBAAkB,CAAC;YAC7B,OAAO,EAAE,QAAQ,CAAC,GAAG;YACrB,SAAS,EAAE,QAAQ,CAAC,KAAK;YACzB,iBAAiB,EAAE,QAAQ,CAAC,cAAc;YAC1C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,eAAe,CACnB,KAAa,EACb,aAAgD;QAEhD,sDAAsD;QACtD,IAAI,OAAO,GAAoD,IAAI,CAAC;QACpE,IAAI,SAAS,GAA4C,IAAI,CAAC;QAE9D,iEAAiE;QACjE,IAAI,aAAa,KAAK,cAAc,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBACzD,SAAS,GAAG,cAAc,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,iCAAiC;gBACjC,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;oBAC1D,SAAS,GAAG,eAAe,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,wCAAwC;gBAC1C,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,KAAK,eAAe,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAC1D,SAAS,GAAG,eAAe,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;gBAChC,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;oBACzD,SAAS,GAAG,cAAc,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,wCAAwC;gBAC1C,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,sCAAsC;YACtC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBACzD,SAAS,GAAG,cAAc,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;oBAC1D,SAAS,GAAG,eAAe,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,wCAAwC;gBAC1C,CAAC;YACH,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,QAAQ;gBACpB,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;gBACtD,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;aACvD,CAAC;QACJ,CAAC;QAED,mDAAmD;QACnD,6EAA6E;QAC7E,gFAAgF;QAChF,2EAA2E;QAC3E,iCAAiC;QACjC,OAAO;YACL,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,WAAW,CACf,KAAa,EACb,aAAgD;QAEhD,+DAA+D;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAEnD,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAClD,qEAAqE;YACrE,uEAAuE;YACvE,+BAA+B;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,SAAS,GACb,CAAC,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,eAAe;YACtD,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,SAAS,CAAC;YACd,aAAa;YACb,cAAc,CAAC;QACjB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QAE/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,2BAA2B;QAC3B,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtE,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,kFAAkF;QAClF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAExE,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;YACjC,4EAA4E;YAC5E,OAAO;QACT,CAAC;QAED,0DAA0D;QAC1D,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC;YACxC,GAAG;YACH,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,YAAY,CAAC,EAAE,EAAE,2BAA2B;YACtD,OAAO,EAAE,UAAU,CAAC,GAAG;YACvB,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;QAEH,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,0CAA0C;QAC1C,EAAE;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,gFAAgF;IAClF,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,aAAa,CAAC,WAAmB;QAC7C,mCAAmC;QACnC,MAAM,IAAI,GAAG,IAAI,UAAU,CACzB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxB,SAAS,EACT,aAAa,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAC1C,CACF,CAAC;QACF,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QACpD,mBAAmB;QACnB,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAShC;QACC,MAAM,EACJ,OAAO,EACP,SAAS,EACT,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,KAAK,EACL,QAAQ,GACT,GAAG,MAAM,CAAC;QAEX,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEpC,wCAAwC;QACxC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;YACxD,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,OAAO;YACZ,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,WAAW;SACnB,CAAC,CAAC;QAEH,yCAAyC;QACzC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAC1D,GAAG,EAAE,eAAe;YACpB,GAAG,EAAE,OAAO;YACZ,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,WAAW;SACnB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAkB;YAC9B,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB;YAC/C,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,WAAW;SACnB,CAAC;QAEF,mDAAmD;QACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,cAAc,GAShB;gBACF,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,QAAQ;aACd,CAAC;YAEF,IAAI,KAAK,EAAE,CAAC;gBACV,cAAc,CAAC,KAAK,GAAG,KAAK,CAAC;YAC/B,CAAC;YAED,8CAA8C;YAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,cAAc,CAAC,SAAS,GAAG,QAAQ,CAAC;YACtC,CAAC;YAED,2CAA2C;YAC3C,oEAAoE;YACpE,wEAAwE;YACxE,cAAc,CAAC,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAE/D,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,cAAc,CAAC,KAAK,GAAG,SAAS,CAAC;gBACjC,cAAc,CAAC,cAAc,GAAG,iBAAiB,CAAC;YACpD,CAAC;YAED,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9B,cAAc,CAAC,IAAI,GAAG,SAAS,CAAC;YAClC,CAAC;YAED,QAAQ,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/services/passkey.service.d.ts

@@ -0,0 +1,73 @@
+import type { AuthenticationResponseJSON, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON } from '@simplewebauthn/server';
+import type { UserEntity } from '../entities/user.entity.ts';
+import { type IUserPasskeyEntity } from '../entities/user-passkey.entity.ts';
+import type { TinyAuthRuntimeConfig } from '../lib/config/index.ts';
+import type { MikroService } from './mikro.service.ts';
+/**
+ * Passkey information for user passkey list
+ * Used to display registered passkeys to the user
+ */
+export interface PasskeyInfo {
+    /** Passkey entity ID */
+    id: string;
+    /** WebAuthn credential ID */
+    credential_id: string;
+    /** User-defined name for the passkey */
+    name: string | null;
+    /** Device type: single device or multi-device (synced) */
+    device_type: 'singleDevice' | 'multiDevice';
+    /** Whether the passkey is backed up (synced to cloud) */
+    backed_up: boolean;
+    /** When the passkey was registered */
+    created_at: Date;
+}
+export declare class PasskeyService {
+    private readonly rpName;
+    private readonly mikro;
+    private readonly config;
+    constructor(mikro: MikroService, config: TinyAuthRuntimeConfig);
+    /**
+     * Get rpId from config or extract from server.public_origin hostname
+     */
+    private getRpId;
+    /**
+     * Get allowed origins from config or use server.public_origin
+     */
+    private getOrigins;
+    /**
+     * Generate registration options for a user
+     */
+    generateRegistrationOptions(user: UserEntity): Promise<PublicKeyCredentialCreationOptionsJSON>;
+    /**
+     * Verify registration response and save passkey
+     */
+    verifyRegistration(user: UserEntity, response: RegistrationResponseJSON, expectedChallenge: string, passkeyName?: string): Promise<IUserPasskeyEntity>;
+    /**
+     * Generate authentication options
+     * If userSub is provided, allow only that user's passkeys
+     * If not provided, allow discoverable credentials (usernameless)
+     */
+    generateAuthenticationOptions(userSub?: string): Promise<PublicKeyCredentialRequestOptionsJSON>;
+    /**
+     * Verify authentication response
+     * Returns the user if verification succeeds
+     */
+    verifyAuthentication(response: AuthenticationResponseJSON, expectedChallenge: string): Promise<UserEntity>;
+    /**
+     * Get all passkeys for a user
+     */
+    getUserPasskeys(userSub: string): Promise<PasskeyInfo[]>;
+    /**
+     * Delete a passkey
+     */
+    deletePasskey(userSub: string, passkeyId: string, options: {
+        hasOtherAuthMethods: boolean;
+        secondFactorRequired: boolean;
+        hasOtherSecondFactor: boolean;
+    }): Promise<void>;
+    /**
+     * Rename a passkey
+     */
+    renamePasskey(userSub: string, passkeyId: string, name: string): Promise<void>;
+}
+//# sourceMappingURL=passkey.service.d.ts.map

package/dist/services/passkey.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.service.d.ts","sourceRoot":"","sources":["../../src/services/passkey.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAE1B,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACzB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EACL,KAAK,kBAAkB,EAExB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,6BAA6B;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0DAA0D;IAC1D,WAAW,EAAE,cAAc,GAAG,aAAa,CAAC;IAC5C,yDAAyD;IACzD,SAAS,EAAE,OAAO,CAAC;IACnB,sCAAsC;IACtC,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAElD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAC5B,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,qBAAqB;IAKrE;;OAEG;IACH,OAAO,CAAC,OAAO;IASf;;OAEG;IACH,OAAO,CAAC,UAAU;IAQlB;;OAEG;IACU,2BAA2B,CACtC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,sCAAsC,CAAC;IA4BlD;;OAEG;IACU,kBAAkB,CAC7B,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,wBAAwB,EAClC,iBAAiB,EAAE,MAAM,EACzB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,CAAC;IA0C9B;;;;OAIG;IACU,6BAA6B,CACxC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,qCAAqC,CAAC;IAyBjD;;;OAGG;IACU,oBAAoB,CAC/B,QAAQ,EAAE,0BAA0B,EACpC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,UAAU,CAAC;IAoCtB;;OAEG;IACU,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAYrE;;OAEG;IACU,aAAa,CACxB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;QACP,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oBAAoB,EAAE,OAAO,CAAC;QAC9B,oBAAoB,EAAE,OAAO,CAAC;KAC/B,GACA,OAAO,CAAC,IAAI,CAAC;IA4BhB;;OAEG;IACU,aAAa,CACxB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC;CAajB"}