@trokky/trokky 2.0.3

package/dist/core/services/oauth-service.d.ts

@@ -0,0 +1,58 @@
+import type { TrokkyLogger } from '../utils/logger.js';
+import type { AuditEvent } from '../core/engine.js';
+import type { MFARequirement } from './mfa-service.js';
+import type { AuthenticationResult, AuthenticationSuccessResult, DataStorageAdapter, MFAMethodType, OAuthProvider, OAuthProviderType, TrokkyConfig, UpdateUserData, User, UserListOptions, UserSession } from '../types/index.js';
+export interface OAuthServiceDependencies {
+    config: TrokkyConfig;
+    logger: TrokkyLogger;
+    dataStorage: DataStorageAdapter;
+    getUser: (id: string) => Promise<User | null>;
+    updateUser: (id: string, userData: UpdateUserData) => Promise<User>;
+    listUsers: (options?: UserListOptions) => Promise<User[]>;
+    logAuditEvent: (event: AuditEvent) => void;
+    checkMFARequired: (userId: string) => Promise<MFARequirement>;
+    isDeviceTrusted: (userId: string, deviceId: string) => Promise<boolean>;
+    issueFullTokens: (user: User, options?: {
+        rememberMe?: boolean;
+    }) => Promise<AuthenticationSuccessResult>;
+    generateMFAPendingToken: (user: User, methods: MFAMethodType[]) => Promise<string>;
+    generateMFASetupToken: (user: User, allowedMethods: MFAMethodType[]) => Promise<string>;
+    generateAuthToken: (user: User, expiresIn?: string, rememberMe?: boolean) => Promise<string>;
+    verifyAuthToken: (token: string) => Promise<UserSession | null>;
+}
+/**
+ * OAuth provider linking and login.
+ */
+export declare class OAuthService {
+    private readonly deps;
+    constructor(deps: OAuthServiceDependencies);
+    /**
+     * Link an OAuth provider to an existing user
+     */
+    linkOAuthProvider(userId: string, provider: OAuthProvider): Promise<User>;
+    /**
+     * Unlink an OAuth provider from a user
+     */
+    unlinkOAuthProvider(userId: string, providerName: OAuthProviderType): Promise<User>;
+    /**
+     * Authenticate a user via OAuth provider
+     * Returns null if no user is linked to this provider
+     * Returns AuthenticationResult which may require MFA verification or setup
+     */
+    authenticateWithOAuth(providerName: OAuthProviderType, providerId: string, options?: {
+        deviceId?: string;
+    }): Promise<AuthenticationResult | null>;
+    /**
+     * Find a user by OAuth provider
+     */
+    getUserByOAuthProvider(providerName: OAuthProviderType, providerId: string): Promise<User | null>;
+    /**
+     * Check if OAuth is configured for a provider
+     */
+    isOAuthConfigured(providerName: OAuthProviderType): boolean;
+    /**
+     * Get OAuth configuration for a provider
+     */
+    getOAuthConfig(providerName: OAuthProviderType): Record<string, string> | null;
+}
+//# sourceMappingURL=oauth-service.d.ts.map

package/dist/core/services/oauth-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-service.d.ts","sourceRoot":"","sources":["../../../src/core/services/oauth-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,KAAK,EACV,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,IAAI,EACJ,eAAe,EACf,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAE1B,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,YAAY,CAAA;IACpB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAC7C,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IACzD,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;IAC1C,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;IAC7D,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACvE,eAAe,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACzG,uBAAuB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAClF,qBAAqB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IACvF,iBAAiB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5F,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;CAChE;AAED;;GAEG;AACH,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,wBAAwB;IAE3D;;OAEG;IACU,iBAAiB,CAC5B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,IAAI,CAAC;IAkDhB;;OAEG;IACU,mBAAmB,CAC9B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,iBAAiB,GAC9B,OAAO,CAAC,IAAI,CAAC;IAsChB;;;;OAIG;IACU,qBAAqB,CAChC,YAAY,EAAE,iBAAiB,EAC/B,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAoJvC;;OAEG;IACU,sBAAsB,CACjC,YAAY,EAAE,iBAAiB,EAC/B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAsBvB;;OAEG;IACI,iBAAiB,CAAC,YAAY,EAAE,iBAAiB,GAAG,OAAO;IAQlE;;OAEG;IACI,cAAc,CAAC,YAAY,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;CAWtF"}

package/dist/core/services/oauth-service.js

@@ -0,0 +1,253 @@
+import { InvalidInputError } from '../errors/index.js';
+/**
+ * OAuth provider linking and login.
+ */
+export class OAuthService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /**
+     * Link an OAuth provider to an existing user
+     */
+    async linkOAuthProvider(userId, provider) {
+        const user = await this.deps.getUser(userId);
+        if (!user) {
+            throw new InvalidInputError('User not found');
+        }
+        // Check if this provider is already linked to another user
+        const existingUser = await this.getUserByOAuthProvider(provider.provider, provider.providerId);
+        if (existingUser && existingUser.id !== userId) {
+            throw new InvalidInputError('This account is already linked to another user');
+        }
+        // Check if user already has this provider linked
+        const existingProviders = user.oauthProviders || [];
+        const alreadyLinked = existingProviders.some((p) => p.provider === provider.provider);
+        if (alreadyLinked) {
+            throw new InvalidInputError(`${provider.provider} account is already linked`);
+        }
+        // Add the provider
+        const updatedProviders = [...existingProviders, provider];
+        const updatedUser = await this.deps.updateUser(userId, {
+            oauthProviders: updatedProviders,
+        });
+        this.deps.logAuditEvent({
+            type: 'user_updated',
+            userId: user.id,
+            username: user.username,
+            action: `Linked ${provider.provider} OAuth account`,
+            timestamp: new Date().toISOString(),
+            success: true,
+            details: {
+                provider: provider.provider,
+                providerEmail: provider.email,
+            },
+        });
+        return updatedUser;
+    }
+    /**
+     * Unlink an OAuth provider from a user
+     */
+    async unlinkOAuthProvider(userId, providerName) {
+        const user = await this.deps.getUser(userId);
+        if (!user) {
+            throw new InvalidInputError('User not found');
+        }
+        const existingProviders = user.oauthProviders || [];
+        const providerToRemove = existingProviders.find((p) => p.provider === providerName);
+        if (!providerToRemove) {
+            throw new InvalidInputError(`${providerName} account is not linked`);
+        }
+        // Remove the provider
+        const updatedProviders = existingProviders.filter((p) => p.provider !== providerName);
+        const updatedUser = await this.deps.updateUser(userId, {
+            oauthProviders: updatedProviders,
+        });
+        this.deps.logAuditEvent({
+            type: 'user_updated',
+            userId: user.id,
+            username: user.username,
+            action: `Unlinked ${providerName} OAuth account`,
+            timestamp: new Date().toISOString(),
+            success: true,
+            details: {
+                provider: providerName,
+            },
+        });
+        return updatedUser;
+    }
+    /**
+     * Authenticate a user via OAuth provider
+     * Returns null if no user is linked to this provider
+     * Returns AuthenticationResult which may require MFA verification or setup
+     */
+    async authenticateWithOAuth(providerName, providerId, options) {
+        try {
+            // Find user by OAuth provider
+            const user = await this.getUserByOAuthProvider(providerName, providerId);
+            if (!user || !user.isActive) {
+                return null;
+            }
+            // Update last login time and lastUsedAt for the OAuth provider
+            const now = new Date().toISOString();
+            const updatedProviders = (user.oauthProviders || []).map((p) => p.provider === providerName && p.providerId === providerId
+                ? { ...p, lastUsedAt: now }
+                : p);
+            await this.deps.updateUser(user.id, {
+                lastLoginAt: now,
+                oauthProviders: updatedProviders,
+            });
+            // Check MFA requirements (same as regular login)
+            const mfaStatus = await this.deps.checkMFARequired(user.id);
+            if (mfaStatus.required) {
+                // User has MFA set up - check if device is trusted first
+                if (mfaStatus.userHasMFA) {
+                    // Check if device is trusted (can skip MFA)
+                    if (options?.deviceId) {
+                        const isTrusted = await this.deps.isDeviceTrusted(user.id, options.deviceId);
+                        if (isTrusted) {
+                            this.deps.logger.info('OAuth login - skipping MFA for trusted device', {
+                                userId: user.id,
+                                provider: providerName,
+                                deviceId: options.deviceId.substring(0, 8) + '...',
+                            });
+                            // Device is trusted, issue full tokens (skip MFA)
+                            return this.deps.issueFullTokens(user, {});
+                        }
+                    }
+                    const mfaToken = await this.deps.generateMFAPendingToken(user, mfaStatus.methods);
+                    this.deps.logAuditEvent({
+                        type: 'user_login',
+                        userId: user.id,
+                        username: user.username,
+                        action: `OAuth login - MFA verification required`,
+                        timestamp: now,
+                        success: true,
+                        details: {
+                            mfaRequired: true,
+                            methods: mfaStatus.methods,
+                            provider: providerName,
+                        },
+                    });
+                    return {
+                        type: 'mfa_required',
+                        requiresMFA: true,
+                        mfaToken,
+                        methods: mfaStatus.methods,
+                        expiresIn: 300, // 5 minutes
+                    };
+                }
+                // Org/role requires MFA but user hasn't set it up
+                if (mfaStatus.reason === 'org_required' || mfaStatus.reason === 'role_required') {
+                    const setupToken = await this.deps.generateMFASetupToken(user, mfaStatus.methods);
+                    const message = mfaStatus.reason === 'role_required'
+                        ? `Your role (${user.role}) requires MFA. Please set up multi-factor authentication.`
+                        : 'Your organization requires MFA. Please set up multi-factor authentication.';
+                    this.deps.logAuditEvent({
+                        type: 'user_login',
+                        userId: user.id,
+                        username: user.username,
+                        action: `OAuth login - MFA setup required`,
+                        timestamp: now,
+                        success: true,
+                        details: {
+                            mfaSetupRequired: true,
+                            allowedMethods: mfaStatus.methods,
+                            reason: mfaStatus.reason,
+                            provider: providerName,
+                        },
+                    });
+                    return {
+                        type: 'mfa_setup_required',
+                        requiresMFASetup: true,
+                        setupToken,
+                        allowedMethods: mfaStatus.methods,
+                        message,
+                        expiresIn: 900, // 15 minutes
+                    };
+                }
+            }
+            // No MFA required - generate full tokens
+            const securityConfig = this.deps.config.security?.tokens;
+            const tokenExpiresIn = securityConfig?.accessTokenTtl || '2h';
+            const refreshTokenExpiresIn = securityConfig?.refreshTokenTtl || '7d';
+            const token = await this.deps.generateAuthToken(user, tokenExpiresIn, false);
+            const refreshToken = await this.deps.generateAuthToken(user, refreshTokenExpiresIn, false);
+            // Log successful login
+            this.deps.logAuditEvent({
+                type: 'user_login',
+                userId: user.id,
+                username: user.username,
+                action: `User authenticated via ${providerName} OAuth`,
+                timestamp: now,
+                success: true,
+                details: {
+                    role: user.role,
+                    provider: providerName,
+                },
+            });
+            // Return user without password hash
+            const { passwordHash, ...safeUser } = user;
+            // Get token expiration time
+            const session = await this.deps.verifyAuthToken(token);
+            return {
+                type: 'success',
+                user: { ...safeUser, passwordHash: '' },
+                token,
+                refreshToken,
+                expiresAt: session?.expiresAt || new Date(Date.now() + 2 * 60 * 60 * 1000).toISOString(),
+            };
+        }
+        catch (error) {
+            this.deps.logger.error('OAuth authentication failed', {
+                error: error instanceof Error ? error.message : String(error),
+                provider: providerName,
+            });
+            return null;
+        }
+    }
+    /**
+     * Find a user by OAuth provider
+     */
+    async getUserByOAuthProvider(providerName, providerId) {
+        // First try storage adapter method if available
+        if (this.deps.dataStorage.getUserByOAuthProvider) {
+            return this.deps.dataStorage.getUserByOAuthProvider(providerName, providerId);
+        }
+        // Fallback: list all users and search (inefficient, but works as fallback)
+        this.deps.logger.warn('getUserByOAuthProvider not implemented in storage adapter, using fallback');
+        const users = await this.deps.listUsers({ limit: 10000 });
+        for (const user of users) {
+            const provider = (user.oauthProviders || []).find((p) => p.provider === providerName && p.providerId === providerId);
+            if (provider) {
+                return user;
+            }
+        }
+        return null;
+    }
+    /**
+     * Check if OAuth is configured for a provider
+     */
+    isOAuthConfigured(providerName) {
+        if (providerName === 'google') {
+            const config = this.deps.config.oauth?.google;
+            return !!(config?.clientId && config?.clientSecret && config?.redirectUri);
+        }
+        return false;
+    }
+    /**
+     * Get OAuth configuration for a provider
+     */
+    getOAuthConfig(providerName) {
+        if (providerName === 'google' && this.isOAuthConfigured('google')) {
+            const config = this.deps.config.oauth.google;
+            return {
+                clientId: config.clientId,
+                clientSecret: config.clientSecret,
+                redirectUri: config.redirectUri,
+            };
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=oauth-service.js.map

package/dist/core/services/oauth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-service.js","sourceRoot":"","sources":["../../../src/core/services/oauth-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAmCtD;;GAEG;AACH,MAAM,OAAO,YAAY;IACM;IAA7B,YAA6B,IAA8B;QAA9B,SAAI,GAAJ,IAAI,CAA0B;IAAG,CAAC;IAE/D;;OAEG;IACI,KAAK,CAAC,iBAAiB,CAC5B,MAAc,EACd,QAAuB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAA;QAC/C,CAAC;QAED,2DAA2D;QAC3D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,sBAAsB,CACpD,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,UAAU,CACpB,CAAA;QACD,IAAI,YAAY,IAAI,YAAY,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;YAC/C,MAAM,IAAI,iBAAiB,CACzB,gDAAgD,CACjD,CAAA;QACH,CAAC;QAED,iDAAiD;QACjD,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAA;QACnD,MAAM,aAAa,GAAG,iBAAiB,CAAC,IAAI,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CACxC,CAAA;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,iBAAiB,CACzB,GAAG,QAAQ,CAAC,QAAQ,4BAA4B,CACjD,CAAA;QACH,CAAC;QAED,mBAAmB;QACnB,MAAM,gBAAgB,GAAG,CAAC,GAAG,iBAAiB,EAAE,QAAQ,CAAC,CAAA;QACzD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;YACrD,cAAc,EAAE,gBAAgB;SAC1B,CAAC,CAAA;QAET,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,UAAU,QAAQ,CAAC,QAAQ,gBAAgB;YACnD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,aAAa,EAAE,QAAQ,CAAC,KAAK;aAC9B;SACF,CAAC,CAAA;QAEF,OAAO,WAAW,CAAA;IACpB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,mBAAmB,CAC9B,MAAc,EACd,YAA+B;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAA;QAC/C,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAA;QACnD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,IAAI,CAC7C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CACnC,CAAA;QAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,iBAAiB,CAAC,GAAG,YAAY,wBAAwB,CAAC,CAAA;QACtE,CAAC;QAED,sBAAsB;QACtB,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,MAAM,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CACnC,CAAA;QACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;YACrD,cAAc,EAAE,gBAAgB;SAC1B,CAAC,CAAA;QAET,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,YAAY,YAAY,gBAAgB;YAChD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,QAAQ,EAAE,YAAY;aACvB;SACF,CAAC,CAAA;QAEF,OAAO,WAAW,CAAA;IACpB,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,qBAAqB,CAChC,YAA+B,EAC/B,UAAkB,EAClB,OAA+B;QAE/B,IAAI,CAAC;YACH,8BAA8B;YAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;YACxE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAA;YACb,CAAC;YAED,+DAA+D;YAC/D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YACpC,MAAM,gBAAgB,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7D,CAAC,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU;gBACxD,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE;gBAC3B,CAAC,CAAC,CAAC,CACN,CAAA;YAED,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;gBAClC,WAAW,EAAE,GAAG;gBAChB,cAAc,EAAE,gBAAgB;aAC1B,CAAC,CAAA;YAET,iDAAiD;YACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAE3D,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,yDAAyD;gBACzD,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;oBACzB,4CAA4C;oBAC5C,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;wBACtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;wBAC5E,IAAI,SAAS,EAAE,CAAC;4BACd,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;gCACrE,MAAM,EAAE,IAAI,CAAC,EAAE;gCACf,QAAQ,EAAE,YAAY;gCACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;6BACnD,CAAC,CAAA;4BACF,kDAAkD;4BAClD,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;wBAC5C,CAAC;oBACH,CAAC;oBAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;oBAEjF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;wBACtB,IAAI,EAAE,YAAY;wBAClB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,yCAAyC;wBACjD,SAAS,EAAE,GAAG;wBACd,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE;4BACP,WAAW,EAAE,IAAI;4BACjB,OAAO,EAAE,SAAS,CAAC,OAAO;4BAC1B,QAAQ,EAAE,YAAY;yBACvB;qBACF,CAAC,CAAA;oBAEF,OAAO;wBACL,IAAI,EAAE,cAAc;wBACpB,WAAW,EAAE,IAAI;wBACjB,QAAQ;wBACR,OAAO,EAAE,SAAS,CAAC,OAAO;wBAC1B,SAAS,EAAE,GAAG,EAAE,YAAY;qBAC7B,CAAA;gBACH,CAAC;gBAED,kDAAkD;gBAClD,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,IAAI,SAAS,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;oBAChF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;oBAEjF,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,KAAK,eAAe;wBAClD,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,4DAA4D;wBACrF,CAAC,CAAC,4EAA4E,CAAA;oBAEhF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;wBACtB,IAAI,EAAE,YAAY;wBAClB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,kCAAkC;wBAC1C,SAAS,EAAE,GAAG;wBACd,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE;4BACP,gBAAgB,EAAE,IAAI;4BACtB,cAAc,EAAE,SAAS,CAAC,OAAO;4BACjC,MAAM,EAAE,SAAS,CAAC,MAAM;4BACxB,QAAQ,EAAE,YAAY;yBACvB;qBACF,CAAC,CAAA;oBAEF,OAAO;wBACL,IAAI,EAAE,oBAAoB;wBAC1B,gBAAgB,EAAE,IAAI;wBACtB,UAAU;wBACV,cAAc,EAAE,SAAS,CAAC,OAAO;wBACjC,OAAO;wBACP,SAAS,EAAE,GAAG,EAAE,aAAa;qBAC9B,CAAA;gBACH,CAAC;YACH,CAAC;YAED,yCAAyC;YACzC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAA;YACxD,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,IAAI,IAAI,CAAA;YAC7D,MAAM,qBAAqB,GAAG,cAAc,EAAE,eAAe,IAAI,IAAI,CAAA;YAErE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,CAAA;YAC5E,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CACpD,IAAI,EACJ,qBAAqB,EACrB,KAAK,CACN,CAAA;YAED,uBAAuB;YACvB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;gBACtB,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,0BAA0B,YAAY,QAAQ;gBACtD,SAAS,EAAE,GAAG;gBACd,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,YAAY;iBACvB;aACF,CAAC,CAAA;YAEF,oCAAoC;YACpC,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAA;YAE1C,4BAA4B;YAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;YAEtD,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAU;gBAC/C,KAAK;gBACL,YAAY;gBACZ,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;aACzF,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;gBACpD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,QAAQ,EAAE,YAAY;aACvB,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,sBAAsB,CACjC,YAA+B,EAC/B,UAAkB;QAElB,gDAAgD;QAChD,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;QAC/E,CAAC;QAED,2EAA2E;QAC3E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,2EAA2E,CAC5E,CAAA;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,CAClE,CAAA;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;OAEG;IACI,iBAAiB,CAAC,YAA+B;QACtD,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAA;YAC7C,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,MAAM,EAAE,YAAY,IAAI,MAAM,EAAE,WAAW,CAAC,CAAA;QAC5E,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;OAEG;IACI,cAAc,CAAC,YAA+B;QACnD,IAAI,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC,MAAO,CAAA;YAC9C,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;CACF"}

package/dist/core/services/oauth2-server-service.d.ts

@@ -0,0 +1,61 @@
+import type { CryptoAdapter } from '../crypto/adapter.js';
+import type { TrokkyLogger } from '../utils/logger.js';
+import { OAuth2AuthorizationServer } from '../security/oauth2/index.js';
+import type { OAuth2Scope, TokenResponse } from '../types/oauth2.js';
+import { User, UpdateUserData } from '../types/index.js';
+export interface OAuth2ServerServiceDependencies {
+    logger: TrokkyLogger;
+    cryptoAdapter: CryptoAdapter;
+    jwtSecret: string;
+    getOAuth2Server: () => OAuth2AuthorizationServer | null;
+    getOAuth2Options: () => {
+        accessTokenTtl?: number;
+        refreshTokenTtl?: number;
+    } | undefined;
+    getUser: (id: string) => Promise<User | null>;
+    updateUser: (id: string, userData: UpdateUserData) => Promise<User>;
+}
+/**
+ * OAuth2 authorization-server token issuance and consent management.
+ */
+export declare class OAuth2ServerService {
+    private readonly deps;
+    constructor(deps: OAuth2ServerServiceDependencies);
+    /**
+     * Get the OAuth2 Authorization Server instance
+     * Returns null if OAuth2 is not enabled
+     */
+    getOAuth2Server(): OAuth2AuthorizationServer | null;
+    /**
+     * Generate OAuth2 tokens for a user
+     * Used by the OAuth2 routes to create access and refresh tokens
+     */
+    generateOAuth2Tokens(user: User, scopes: OAuth2Scope[], clientId: string): Promise<{
+        accessToken: string;
+        refreshToken?: string;
+        expiresIn: number;
+    }>;
+    /**
+     * Refresh an OAuth2 access token using a refresh token
+     * Returns new tokens if the refresh token is valid
+     */
+    refreshOAuth2Token(refreshToken: string, clientId: string, requestedScope?: string): Promise<TokenResponse | null>;
+    /**
+     * Check if a user has an existing consent for a client with the given scopes
+     * Returns the consent if all requested scopes are already consented, null otherwise
+     */
+    getUserConsent(userId: string, clientId: string, requestedScopes: OAuth2Scope[]): Promise<{
+        hasConsent: boolean;
+        consentedScopes: OAuth2Scope[];
+    }>;
+    /**
+     * Save user consent for a client
+     * Stores in user preferences for persistence
+     */
+    saveUserConsent(userId: string, clientId: string, scopes: OAuth2Scope[], expiresInDays?: number): Promise<boolean>;
+    /**
+     * Revoke user consent for a client
+     */
+    revokeUserConsent(userId: string, clientId: string): Promise<boolean>;
+}
+//# sourceMappingURL=oauth2-server-service.d.ts.map

package/dist/core/services/oauth2-server-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-server-service.d.ts","sourceRoot":"","sources":["../../../src/core/services/oauth2-server-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACpE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAExD,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,YAAY,CAAA;IACpB,aAAa,EAAE,aAAa,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,yBAAyB,GAAG,IAAI,CAAA;IACvD,gBAAgB,EAAE,MAAM;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAA;IACzF,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAC7C,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACpE;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,+BAA+B;IAElE;;;OAGG;IACI,eAAe,IAAI,yBAAyB,GAAG,IAAI;IAI1D;;;OAGG;IACU,oBAAoB,CAC/B,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,WAAW,EAAE,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QACT,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC;IAoDF;;;OAGG;IACU,kBAAkB,CAC7B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAqEhC;;;OAGG;IACU,cAAc,CACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,WAAW,EAAE,GAC7B,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,WAAW,EAAE,CAAA;KAAE,CAAC;IAsDnE;;;OAGG;IACU,eAAe,CAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,EAAE,EACrB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC;IAqEnB;;OAEG;IACU,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CA+BnF"}

package/dist/core/services/oauth2-server-service.js

@@ -0,0 +1,259 @@
+/**
+ * OAuth2 authorization-server token issuance and consent management.
+ */
+export class OAuth2ServerService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /**
+     * Get the OAuth2 Authorization Server instance
+     * Returns null if OAuth2 is not enabled
+     */
+    getOAuth2Server() {
+        return this.deps.getOAuth2Server();
+    }
+    /**
+     * Generate OAuth2 tokens for a user
+     * Used by the OAuth2 routes to create access and refresh tokens
+     */
+    async generateOAuth2Tokens(user, scopes, clientId) {
+        const accessTokenTtl = this.deps.getOAuth2Options()?.accessTokenTtl ?? 3600;
+        const refreshTokenTtl = this.deps.getOAuth2Options()?.refreshTokenTtl ?? 2592000;
+        const includeRefreshToken = scopes.includes('offline_access');
+        // Convert OAuth2 scopes to permissions for the token payload
+        const permissions = this.deps.getOAuth2Server()?.scopesToPermissions(scopes) || [];
+        // Generate access token
+        const accessTokenPayload = {
+            sub: user.id,
+            type: 'oauth2_access',
+            clientId,
+            scopes,
+            permissions,
+            username: user.username,
+            email: user.email,
+            role: user.role
+        };
+        const accessToken = await this.deps.cryptoAdapter.generateJWT(accessTokenPayload, this.deps.jwtSecret, {
+            expiresIn: accessTokenTtl
+        });
+        let refreshToken;
+        if (includeRefreshToken) {
+            const refreshTokenPayload = {
+                sub: user.id,
+                type: 'oauth2_refresh',
+                clientId,
+                scopes
+            };
+            refreshToken = await this.deps.cryptoAdapter.generateJWT(refreshTokenPayload, this.deps.jwtSecret, {
+                expiresIn: refreshTokenTtl
+            });
+        }
+        this.deps.logger.info('OAuth2 tokens generated', {
+            userId: user.id,
+            clientId,
+            scopes,
+            includeRefreshToken
+        });
+        return {
+            accessToken,
+            refreshToken,
+            expiresIn: accessTokenTtl
+        };
+    }
+    /**
+     * Refresh an OAuth2 access token using a refresh token
+     * Returns new tokens if the refresh token is valid
+     */
+    async refreshOAuth2Token(refreshToken, clientId, requestedScope) {
+        try {
+            // Verify refresh token
+            const payload = await this.deps.cryptoAdapter.verifyJWT(refreshToken, this.deps.jwtSecret);
+            if (!payload) {
+                this.deps.logger.warn('Invalid refresh token');
+                return null;
+            }
+            // Validate token type and client
+            if (payload.type !== 'oauth2_refresh') {
+                this.deps.logger.warn('Invalid token type for refresh', { type: payload.type });
+                return null;
+            }
+            if (payload.clientId !== clientId) {
+                this.deps.logger.warn('Client ID mismatch for refresh', {
+                    expected: payload.clientId,
+                    received: clientId
+                });
+                return null;
+            }
+            // Get user to ensure they still exist and are active
+            const user = await this.deps.getUser(payload.sub);
+            if (!user || !user.isActive) {
+                this.deps.logger.warn('User not found or inactive for refresh', { userId: payload.sub });
+                return null;
+            }
+            // Determine scopes - can only narrow, not expand
+            let scopes = payload.scopes;
+            if (requestedScope) {
+                const requestedScopes = requestedScope.split(' ').filter(Boolean);
+                scopes = requestedScopes.filter(s => payload.scopes.includes(s));
+            }
+            // Generate new tokens
+            const tokens = await this.generateOAuth2Tokens(user, scopes, clientId);
+            this.deps.logger.info('OAuth2 token refreshed', {
+                userId: user.id,
+                clientId,
+                scopes
+            });
+            return {
+                access_token: tokens.accessToken,
+                token_type: 'Bearer',
+                expires_in: tokens.expiresIn,
+                refresh_token: tokens.refreshToken,
+                scope: scopes.join(' ')
+            };
+        }
+        catch (error) {
+            this.deps.logger.warn('OAuth2 token refresh failed', { error });
+            return null;
+        }
+    }
+    // ============================================
+    // OAuth2 Consent Management
+    // ============================================
+    /**
+     * Check if a user has an existing consent for a client with the given scopes
+     * Returns the consent if all requested scopes are already consented, null otherwise
+     */
+    async getUserConsent(userId, clientId, requestedScopes) {
+        try {
+            const user = await this.deps.getUser(userId);
+            if (!user) {
+                this.deps.logger.debug('getUserConsent: user not found', { userId });
+                return { hasConsent: false, consentedScopes: [] };
+            }
+            this.deps.logger.debug('getUserConsent: checking consent', {
+                userId,
+                clientId,
+                requestedScopes,
+                userPreferences: user.preferences
+            });
+            // Get consents from user preferences
+            const consents = (user.preferences?._oauth2Consents || {});
+            const consent = consents[clientId];
+            if (!consent) {
+                this.deps.logger.debug('getUserConsent: no consent found for client', { clientId, consents });
+                return { hasConsent: false, consentedScopes: [] };
+            }
+            // Check if consent has expired
+            if (consent.expiresAt && new Date(consent.expiresAt) < new Date()) {
+                this.deps.logger.debug('getUserConsent: consent expired', { consent });
+                return { hasConsent: false, consentedScopes: [] };
+            }
+            // Check if all requested scopes are already consented
+            const consentedScopes = consent.scopes || [];
+            const hasAllScopes = requestedScopes.every(scope => consentedScopes.includes(scope));
+            this.deps.logger.debug('getUserConsent: result', {
+                hasAllScopes,
+                consentedScopes,
+                requestedScopes
+            });
+            return {
+                hasConsent: hasAllScopes,
+                consentedScopes
+            };
+        }
+        catch (error) {
+            this.deps.logger.warn('Failed to check user consent', { error, userId, clientId });
+            return { hasConsent: false, consentedScopes: [] };
+        }
+    }
+    /**
+     * Save user consent for a client
+     * Stores in user preferences for persistence
+     */
+    async saveUserConsent(userId, clientId, scopes, expiresInDays) {
+        try {
+            this.deps.logger.info('saveUserConsent: starting', { userId, clientId, scopes });
+            const user = await this.deps.getUser(userId);
+            if (!user) {
+                this.deps.logger.warn('Cannot save consent - user not found', { userId });
+                return false;
+            }
+            // Get existing consents
+            const currentPreferences = user.preferences || {};
+            const existingConsents = (currentPreferences._oauth2Consents || {});
+            this.deps.logger.debug('saveUserConsent: existing state', {
+                currentPreferences,
+                existingConsents
+            });
+            // Merge scopes if consent already exists
+            const existingConsent = existingConsents[clientId];
+            const mergedScopes = existingConsent
+                ? [...new Set([...existingConsent.scopes, ...scopes])]
+                : scopes;
+            // Calculate expiry (default: 365 days, or never if not specified)
+            const expiresAt = expiresInDays
+                ? new Date(Date.now() + expiresInDays * 24 * 60 * 60 * 1000).toISOString()
+                : undefined;
+            // Update consents
+            const updatedConsents = {
+                ...existingConsents,
+                [clientId]: {
+                    scopes: mergedScopes,
+                    grantedAt: new Date().toISOString(),
+                    expiresAt
+                }
+            };
+            const newPreferences = {
+                ...currentPreferences,
+                _oauth2Consents: updatedConsents
+            };
+            this.deps.logger.debug('saveUserConsent: saving new preferences', { newPreferences });
+            // Save to user preferences
+            await this.deps.updateUser(userId, {
+                preferences: newPreferences
+            });
+            this.deps.logger.info('User consent saved successfully', {
+                userId,
+                clientId,
+                scopes: mergedScopes
+            });
+            return true;
+        }
+        catch (error) {
+            this.deps.logger.error('Failed to save user consent', { error, userId, clientId });
+            return false;
+        }
+    }
+    /**
+     * Revoke user consent for a client
+     */
+    async revokeUserConsent(userId, clientId) {
+        try {
+            const user = await this.deps.getUser(userId);
+            if (!user) {
+                return false;
+            }
+            const currentPreferences = user.preferences || {};
+            const existingConsents = (currentPreferences._oauth2Consents || {});
+            if (!existingConsents[clientId]) {
+                return true; // Already revoked
+            }
+            // Remove the consent for this client
+            const { [clientId]: _removed, ...remainingConsents } = existingConsents;
+            await this.deps.updateUser(userId, {
+                preferences: {
+                    ...currentPreferences,
+                    _oauth2Consents: remainingConsents
+                }
+            });
+            this.deps.logger.info('User consent revoked', { userId, clientId });
+            return true;
+        }
+        catch (error) {
+            this.deps.logger.error('Failed to revoke user consent', { error, userId, clientId });
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=oauth2-server-service.js.map