@trokky/trokky 3.5.1 → 3.5.2

package/dist/core/security/auth-flow-store.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Storage for a sign-in that spans two requests.
+ *
+ * OAuth login state with its PKCE verifier, and the WebAuthn challenge behind a
+ * passkey, are both written when a flow begins and read once when it completes.
+ * Held in the server process, a restart between the two halves fails the
+ * sign-in and a second replica cannot serve the second half at all.
+ *
+ * Persists through the data storage adapter when it implements the optional
+ * auth flow methods, and falls back to an in-process map when it does not, so
+ * an adapter written against the older interface keeps working.
+ */
+import type { DataStorageAdapter, AuthFlowState } from '../types/storage-adapters.js';
+/**
+ * Store a pending flow.
+ *
+ * A failure to persist is raised, not swallowed. Keeping the entry in memory
+ * would report a durability the caller does not have and silently reintroduce
+ * the bug this store exists to fix: the sign-in would appear to start and then
+ * fail at the callback if it landed on another process. Failing here costs one
+ * retry and is honest about what happened.
+ */
+export declare function saveAuthFlowState(adapter: DataStorageAdapter | null | undefined, state: AuthFlowState): Promise<void>;
+/**
+ * Take a pending flow: return it and consume it, or return null.
+ *
+ * Single use is the security property here - an OAuth state is CSRF protection
+ * and a WebAuthn challenge must not be answerable twice - so the adapter is
+ * asked to return and delete in one atomic operation rather than being read and
+ * then deleted, which would let two concurrent callbacks both succeed.
+ *
+ * A storage failure propagates: a caller that cannot prove it consumed the
+ * state must not continue as though it had.
+ */
+export declare function consumeAuthFlowState(adapter: DataStorageAdapter | null | undefined, id: string, kind: AuthFlowState['kind']): Promise<AuthFlowState | null>;
+/**
+ * Read a pending flow without consuming it.
+ *
+ * An adapter without a read falls back to take-and-put: correct, at the cost of a brief
+ * window in which a concurrent reader finds nothing.
+ */
+export declare function getAuthFlowState(adapter: DataStorageAdapter | null | undefined, id: string, kind: AuthFlowState['kind']): Promise<AuthFlowState | null>;
+/**
+ * Drop everything that has expired.
+ *
+ * Sweeping is best-effort: expired entries are rejected on read regardless, so
+ * a failed sweep costs storage rather than correctness.
+ */
+export declare function deleteExpiredAuthFlowStates(adapter: DataStorageAdapter | null | undefined): Promise<void>;
+/**
+ * Sweep expired states, driven by a request rather than by a timer.
+ *
+ * This used to be a module-scope `setInterval`, which assumes a process that
+ * outlives any one request. On an edge runtime that assumption fails twice over:
+ * work at import time is restricted, and nothing runs between requests, so the
+ * timer would either be rejected or simply never fire — while still looking
+ * correct in the source.
+ *
+ * Driving it from a request costs nothing, because expiry is already enforced on
+ * read (`isUsable`). Sweeping only reclaims space, so it is safe to skip, safe to
+ * fail, and safe to run on whichever instance happens to take the next request.
+ * The caller is not made to wait for it.
+ */
+export declare function sweepExpiredAuthFlowStates(adapter: DataStorageAdapter | null | undefined, now?: number): void;
+/** Test seam: forget when the last sweep happened. */
+export declare function resetSweepClock(): void;
+/** Test seam: drops the in-process entries without touching the adapter. */
+export declare function clearFallbackAuthFlowStates(): void;
+//# sourceMappingURL=auth-flow-store.d.ts.map

package/dist/core/security/auth-flow-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-flow-store.d.ts","sourceRoot":"","sources":["../../../src/core/security/auth-flow-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AA4BrF;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,EAC9C,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAC1B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAa/B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAC1B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAe/B;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,GAC7C,OAAO,CAAC,IAAI,CAAC,CAYf;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,EAC9C,GAAG,GAAE,MAAmB,GACvB,IAAI,CAIN;AAED,sDAAsD;AACtD,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAED,4EAA4E;AAC5E,wBAAgB,2BAA2B,IAAI,IAAI,CAElD"}

package/dist/core/security/auth-flow-store.js

@@ -0,0 +1,145 @@
+/**
+ * Storage for a sign-in that spans two requests.
+ *
+ * OAuth login state with its PKCE verifier, and the WebAuthn challenge behind a
+ * passkey, are both written when a flow begins and read once when it completes.
+ * Held in the server process, a restart between the two halves fails the
+ * sign-in and a second replica cannot serve the second half at all.
+ *
+ * Persists through the data storage adapter when it implements the optional
+ * auth flow methods, and falls back to an in-process map when it does not, so
+ * an adapter written against the older interface keeps working.
+ */
+import { createLogger } from '../utils/logger.js';
+const logger = createLogger('routes', 'AuthFlowStore');
+/** Entries live here only when the adapter cannot store them. */
+const fallbackStore = new Map();
+function adapterSupportsPersistence(adapter) {
+    return Boolean(adapter?.saveAuthFlowState && adapter.consumeAuthFlowState);
+}
+/**
+ * An unparseable expiry is treated as expired rather than as "never expires":
+ * `NaN < Date.now()` is false, so a naive comparison would accept a corrupt
+ * record forever. The boundary is exclusive - a state is dead at its expiry
+ * instant, not one millisecond after.
+ */
+function isUsable(state) {
+    const expiresAt = new Date(state.expiresAt).getTime();
+    return Number.isFinite(expiresAt) && expiresAt > Date.now();
+}
+/**
+ * Store a pending flow.
+ *
+ * A failure to persist is raised, not swallowed. Keeping the entry in memory
+ * would report a durability the caller does not have and silently reintroduce
+ * the bug this store exists to fix: the sign-in would appear to start and then
+ * fail at the callback if it landed on another process. Failing here costs one
+ * retry and is honest about what happened.
+ */
+export async function saveAuthFlowState(adapter, state) {
+    if (adapterSupportsPersistence(adapter)) {
+        await adapter.saveAuthFlowState(state);
+        return;
+    }
+    fallbackStore.set(state.id, state);
+}
+/**
+ * Take a pending flow: return it and consume it, or return null.
+ *
+ * Single use is the security property here - an OAuth state is CSRF protection
+ * and a WebAuthn challenge must not be answerable twice - so the adapter is
+ * asked to return and delete in one atomic operation rather than being read and
+ * then deleted, which would let two concurrent callbacks both succeed.
+ *
+ * A storage failure propagates: a caller that cannot prove it consumed the
+ * state must not continue as though it had.
+ */
+export async function consumeAuthFlowState(adapter, id, kind) {
+    if (adapterSupportsPersistence(adapter)) {
+        const consumed = await adapter.consumeAuthFlowState(id, kind);
+        return consumed && isUsable(consumed) ? consumed : null;
+    }
+    // The fallback map is only reachable on a single process, and there is no
+    // await between the read and the delete, so this is atomic by the same
+    // argument that made the original in-process map safe.
+    const fallback = fallbackStore.get(id);
+    fallbackStore.delete(id);
+    if (!fallback || fallback.kind !== kind || !isUsable(fallback))
+        return null;
+    return fallback;
+}
+/**
+ * Read a pending flow without consuming it.
+ *
+ * An adapter without a read falls back to take-and-put: correct, at the cost of a brief
+ * window in which a concurrent reader finds nothing.
+ */
+export async function getAuthFlowState(adapter, id, kind) {
+    if (adapterSupportsPersistence(adapter)) {
+        if (adapter.getAuthFlowState) {
+            const state = await adapter.getAuthFlowState(id, kind);
+            return state && isUsable(state) ? state : null;
+        }
+        const taken = await adapter.consumeAuthFlowState(id, kind);
+        if (!taken || !isUsable(taken))
+            return null;
+        await adapter.saveAuthFlowState(taken);
+        return taken;
+    }
+    const fallback = fallbackStore.get(id);
+    if (!fallback || fallback.kind !== kind || !isUsable(fallback))
+        return null;
+    return fallback;
+}
+/**
+ * Drop everything that has expired.
+ *
+ * Sweeping is best-effort: expired entries are rejected on read regardless, so
+ * a failed sweep costs storage rather than correctness.
+ */
+export async function deleteExpiredAuthFlowStates(adapter) {
+    for (const [id, state] of fallbackStore.entries()) {
+        if (!isUsable(state))
+            fallbackStore.delete(id);
+    }
+    if (adapter?.deleteExpiredAuthFlowStates) {
+        try {
+            await adapter.deleteExpiredAuthFlowStates();
+        }
+        catch (error) {
+            logger.error('Failed to sweep expired auth flow states', { error });
+        }
+    }
+}
+/** At most one sweep per interval, per process. */
+const SWEEP_INTERVAL_MS = 60_000;
+let lastSweepAt = 0;
+/**
+ * Sweep expired states, driven by a request rather than by a timer.
+ *
+ * This used to be a module-scope `setInterval`, which assumes a process that
+ * outlives any one request. On an edge runtime that assumption fails twice over:
+ * work at import time is restricted, and nothing runs between requests, so the
+ * timer would either be rejected or simply never fire — while still looking
+ * correct in the source.
+ *
+ * Driving it from a request costs nothing, because expiry is already enforced on
+ * read (`isUsable`). Sweeping only reclaims space, so it is safe to skip, safe to
+ * fail, and safe to run on whichever instance happens to take the next request.
+ * The caller is not made to wait for it.
+ */
+export function sweepExpiredAuthFlowStates(adapter, now = Date.now()) {
+    if (now - lastSweepAt < SWEEP_INTERVAL_MS)
+        return;
+    lastSweepAt = now;
+    void deleteExpiredAuthFlowStates(adapter);
+}
+/** Test seam: forget when the last sweep happened. */
+export function resetSweepClock() {
+    lastSweepAt = 0;
+}
+/** Test seam: drops the in-process entries without touching the adapter. */
+export function clearFallbackAuthFlowStates() {
+    fallbackStore.clear();
+}
+//# sourceMappingURL=auth-flow-store.js.map

package/dist/core/security/auth-flow-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-flow-store.js","sourceRoot":"","sources":["../../../src/core/security/auth-flow-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;AAEtD,iEAAiE;AACjE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAyB,CAAA;AAKtD,SAAS,0BAA0B,CACjC,OAA8C;IAE9C,OAAO,OAAO,CAAC,OAAO,EAAE,iBAAiB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,KAAoB;IACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAA;IACrD,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA8C,EAC9C,KAAoB;IAEpB,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;QACtC,OAAM;IACR,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA8C,EAC9C,EAAU,EACV,IAA2B;IAE3B,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC7D,OAAO,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;IACzD,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,uDAAuD;IACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACtC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACxB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3E,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA8C,EAC9C,EAAU,EACV,IAA2B;IAE3B,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;YACtD,OAAO,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;QAChD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC1D,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC3C,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;QACtC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACtC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3E,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA8C;IAE9C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,IAAI,OAAO,EAAE,2BAA2B,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,2BAA2B,EAAE,CAAA;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAChC,IAAI,WAAW,GAAG,CAAC,CAAA;AAEnB;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA8C,EAC9C,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,GAAG,GAAG,WAAW,GAAG,iBAAiB;QAAE,OAAM;IACjD,WAAW,GAAG,GAAG,CAAA;IACjB,KAAK,2BAA2B,CAAC,OAAO,CAAC,CAAA;AAC3C,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,eAAe;IAC7B,WAAW,GAAG,CAAC,CAAA;AACjB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,2BAA2B;IACzC,aAAa,CAAC,KAAK,EAAE,CAAA;AACvB,CAAC"}

package/dist/core/security/oauth2/authorization-server.d.ts

@@ -10,6 +10,20 @@
  */
 import type { OAuth2Client, OAuth2Scope, DeviceCodeState, TokenResponse, OAuth2ErrorCode } from '../../types/oauth2.js';
 import type { Permission } from '../../types/user.js';
+import type { AuthFlowState } from '../../types/storage-adapters.js';
+/**
+ * Where device and authorization codes live between the requests of a flow.
+ *
+ * Not process memory: on Workers every request may land on another isolate, and behind a
+ * load balancer on another replica, so a device approved on one would poll as unknown on the
+ * next. The engine passes the data adapter's auth-flow store; without one this falls back to
+ * the store's in-process map, which is only correct on a single process.
+ */
+export interface OAuth2FlowStore {
+    save(state: AuthFlowState): Promise<void>;
+    get(id: string, kind: AuthFlowState['kind']): Promise<AuthFlowState | null>;
+    consume(id: string, kind: AuthFlowState['kind']): Promise<AuthFlowState | null>;
+}
 /**
  * Configuration for registering an OAuth2 client
  */
@@ -30,6 +44,12 @@ export interface OAuth2ClientConfig {
     allowedScopes?: string[];
     /** Allowed grant types (default: authorization_code, refresh_token) */
     grantTypes?: string[];
+    /**
+     * First-party application: its tokens act as the signed-in user with the user's own role
+     * and permissions, whatever scopes they carry. Still barred from account and security
+     * routes. Default false.
+     */
+    trusted?: boolean;
 }
 /**
  * Configuration for the OAuth2 Authorization Server
@@ -53,6 +73,8 @@ export interface OAuth2ServerConfig {
     pollingInterval?: number;
     /** External OAuth2 clients to register */
     clients?: OAuth2ClientConfig[];
+    /** Persistent storage for device and authorization codes. Default: in-process only. */
+    flowStore?: OAuth2FlowStore;
 }
 /**
  * OAuth2 Authorization Server
@@ -62,10 +84,8 @@ export interface OAuth2ServerConfig {
 export declare class OAuth2AuthorizationServer {
     private config;
     private externalClients;
-    private deviceCodes;
-    private authorizationCodes;
+    private store;
     private clients;
-    private cleanupInterval;
     constructor(config: OAuth2ServerConfig);
     /**
      * Register the built-in CLI client
@@ -78,9 +98,9 @@ export declare class OAuth2AuthorizationServer {
     /**
      * Start periodic cleanup of expired codes
      */
-    private startCleanup;
     /**
-     * Stop cleanup interval (for testing/shutdown)
+     * Kept for callers that stop the server on shutdown. Codes now expire in the flow store,
+     * which sweeps on request, so there is no timer to stop.
      */
     stopCleanup(): void;
     /**
@@ -107,7 +127,7 @@ export declare class OAuth2AuthorizationServer {
      * Start device authorization flow
      * Returns device_code, user_code, and verification URI
      */
-    startDeviceAuthorization(clientId: string, requestedScopes: string[]): {
+    startDeviceAuthorization(clientId: string, requestedScopes: string[]): Promise<{
         success: true;
         response: {
             device_code: string;
@@ -121,19 +141,33 @@ export declare class OAuth2AuthorizationServer {
         success: false;
         error: OAuth2ErrorCode;
         error_description: string;
-    };
+    }>;
+    /** The device record behind a user code, with its expiry, or null. */
+    private findByUserCode;
     /**
      * Get device code state by user code (for verification page)
      */
-    getDeviceCodeByUserCode(userCode: string): DeviceCodeState | null;
+    getDeviceCodeByUserCode(userCode: string): Promise<DeviceCodeState | null>;
     /**
-     * Authorize a device code (called when user approves in Studio)
+     * Authorize a device code (called when user approves in Studio).
+     *
+     * `approvedScopes` is what the person left ticked on the consent screen. It can only
+     * narrow the request: anything not requested is ignored, and approving nothing is refused.
      */
-    authorizeDeviceCode(userCode: string, userId: string): boolean;
+    authorizeDeviceCode(userCode: string, userId: string, approvedScopes?: string[]): Promise<boolean>;
     /**
      * Deny a device code (called when user denies in Studio)
      */
-    denyDeviceCode(userCode: string): boolean;
+    denyDeviceCode(userCode: string): Promise<boolean>;
+    /**
+     * Record one decision on a pending code.
+     *
+     * Taking the user-code index is the lock: of two decisions racing (two clicks, an approve
+     * and a deny), exactly one gets it, and the other is refused rather than both reporting
+     * success while the last write wins. The index goes back afterwards so the approval page
+     * can still show that this code was already handled.
+     */
+    private decide;
     /**
      * Poll for device token (called by CLI)
      */
@@ -145,7 +179,6 @@ export declare class OAuth2AuthorizationServer {
         error: OAuth2ErrorCode;
         error_description: string;
     }>;
-    private checkDeviceCodeAndGenerateToken;
     /**
      * Validate authorization request parameters
      */
@@ -169,7 +202,29 @@ export declare class OAuth2AuthorizationServer {
     /**
      * Generate authorization code after user approval
      */
-    generateAuthorizationCode(clientId: string, redirectUri: string, scopes: OAuth2Scope[], codeChallenge: string, userId: string): string;
+    generateAuthorizationCode(clientId: string, redirectUri: string, scopes: OAuth2Scope[], codeChallenge: string, userId: string): Promise<string>;
+    /**
+     * Check an approval posted from the consent screen before issuing a code for it.
+     *
+     * The approval arrives as a fresh request, so everything the authorization request was
+     * checked for is checked again: the client, its grant, the redirect URI, the PKCE
+     * challenge, and scopes the client may have. The person may have unticked scopes, but the
+     * result must still be within what the client is allowed.
+     */
+    validateApproval(params: {
+        client_id: string;
+        redirect_uri: string;
+        scopes: unknown;
+        code_challenge: string;
+        /** A denial only redirects back: it needs a real client and redirect, not valid scopes */
+        denial?: boolean;
+    }): {
+        valid: true;
+        scopes: OAuth2Scope[];
+    } | {
+        valid: false;
+        error_description: string;
+    };
     /**
      * Exchange authorization code for tokens
      */

package/dist/core/security/oauth2/authorization-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-server.d.ts","sourceRoot":"","sources":["../../../../src/core/security/oauth2/authorization-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EAEX,eAAe,EAEf,aAAa,EACb,eAAe,EAEhB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAQ,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAG3D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sFAAsF;IACtF,IAAI,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAA;IAChC,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4BAA4B;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAA;IACd,sGAAsG;IACtG,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAA;CAC/B;AAED;;;;GAIG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,MAAM,CAA+C;IAC7D,OAAO,CAAC,eAAe,CAAsB;IAG7C,OAAO,CAAC,WAAW,CAA0C;IAC7D,OAAO,CAAC,kBAAkB,CAAiD;IAC3E,OAAO,CAAC,OAAO,CAAuC;IAGtD,OAAO,CAAC,eAAe,CAA8B;gBAEzC,MAAM,EAAE,kBAAkB;IAuBtC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAuB/B;;OAEG;IACH,OAAO,CAAC,YAAY;IAoBpB;;OAEG;IACI,WAAW,IAAI,IAAI;IAW1B;;OAEG;IACI,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAIvD;;OAEG;IACI,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAY1E;;OAEG;IACH,OAAO,CAAC,UAAU;IAQlB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAYxB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAI1B;;;OAGG;IACI,wBAAwB,CAC7B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EAAE,GACxB;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE;YAC5B,WAAW,EAAE,MAAM,CAAA;YACnB,SAAS,EAAE,MAAM,CAAA;YACjB,gBAAgB,EAAE,MAAM,CAAA;YACxB,yBAAyB,EAAE,MAAM,CAAA;YACjC,UAAU,EAAE,MAAM,CAAA;YAClB,QAAQ,EAAE,MAAM,CAAA;SACjB,CAAA;KAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,eAAe,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;IA2E1E;;OAEG;IACI,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAQxE;;OAEG;IACI,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAsBrE;;OAEG;IACI,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAgBhD;;OAEG;IACI,eAAe,CACpB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,GACjG,OAAO,CACN;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAA;KAAE,GAC1C;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,eAAe,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CACxE;YAIa,+BAA+B;IAsG7C;;OAEG;IACI,4BAA4B,CAAC,MAAM,EAAE;QAC1C,aAAa,EAAE,MAAM,CAAA;QACrB,SAAS,EAAE,MAAM,CAAA;QACjB,YAAY,EAAE,MAAM,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,EAAE,MAAM,CAAA;QACb,cAAc,EAAE,MAAM,CAAA;QACtB,qBAAqB,EAAE,MAAM,CAAA;KAC9B,GAAG;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,WAAW,EAAE,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,eAAe,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;IA2EtI;;OAEG;IACI,yBAAyB,CAC9B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,EAAE,EACrB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,GACb,MAAM;IAmBT;;OAEG;IACU,yBAAyB,CACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,GACjG,OAAO,CACN;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAA;KAAE,GAC1C;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,eAAe,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CACxE;IAwED;;OAEG;IACH,OAAO,CAAC,cAAc;IAmBtB;;OAEG;IACI,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE;IAe/D;;OAEG;IACI,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CA2BpD"}
+{"version":3,"file":"authorization-server.d.ts","sourceRoot":"","sources":["../../../../src/core/security/oauth2/authorization-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EAEX,eAAe,EAEf,aAAa,EACb,eAAe,EAEhB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAQ,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAA;AAOpE;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IAC3E,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;CAChF;AAqBD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sFAAsF;IACtF,IAAI,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAA;IAChC,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4BAA4B;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAA;IACd,sGAAsG;IACtG,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAA;IAC9B,uFAAuF;IACvF,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED;;;;GAIG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,MAAM,CAA6D;IAC3E,OAAO,CAAC,eAAe,CAAsB;IAC7C,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,OAAO,CAAuC;gBAE1C,MAAM,EAAE,kBAAkB;IAqBtC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAO7B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAuB/B;;OAEG;IACH;;;OAGG;IACI,WAAW,IAAI,IAAI;IAM1B;;OAEG;IACI,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAIvD;;OAEG;IACI,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAY1E;;OAEG;IACH,OAAO,CAAC,UAAU;IAQlB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAYxB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAI1B;;;OAGG;IACU,wBAAwB,CACnC,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE;YACpC,WAAW,EAAE,MAAM,CAAA;YACnB,SAAS,EAAE,MAAM,CAAA;YACjB,gBAAgB,EAAE,MAAM,CAAA;YACxB,yBAAyB,EAAE,MAAM,CAAA;YACjC,UAAU,EAAE,MAAM,CAAA;YAClB,QAAQ,EAAE,MAAM,CAAA;SACjB,CAAA;KAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,eAAe,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAyE3E,sEAAsE;YACxD,cAAc;IAU5B;;OAEG;IACU,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAMvF;;;;;OAKG;IACU,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAW/G;;OAEG;IACU,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI/D;;;;;;;OAOG;YACW,MAAM;IAuBpB;;OAEG;IACU,eAAe,CAC1B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,GACjG,OAAO,CACN;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAA;KAAE,GAC1C;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,eAAe,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CACxE;IAsDD;;OAEG;IACI,4BAA4B,CAAC,MAAM,EAAE;QAC1C,aAAa,EAAE,MAAM,CAAA;QACrB,SAAS,EAAE,MAAM,CAAA;QACjB,YAAY,EAAE,MAAM,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,EAAE,MAAM,CAAA;QACb,cAAc,EAAE,MAAM,CAAA;QACtB,qBAAqB,EAAE,MAAM,CAAA;KAC9B,GAAG;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,WAAW,EAAE,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,eAAe,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;IA2EtI;;OAEG;IACU,yBAAyB,CACpC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,EAAE,EACrB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC;IAwBlB;;;;;;;OAOG;IACI,gBAAgB,CAAC,MAAM,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAA;QACjB,YAAY,EAAE,MAAM,CAAA;QACpB,MAAM,EAAE,OAAO,CAAA;QACf,cAAc,EAAE,MAAM,CAAA;QACtB,0FAA0F;QAC1F,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,GAAG;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,WAAW,EAAE,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;IAwBxF;;OAEG;IACU,yBAAyB,CACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,GACjG,OAAO,CACN;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAA;KAAE,GAC1C;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,eAAe,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CACxE;IAsED;;OAEG;IACH,OAAO,CAAC,cAAc;IAmBtB;;OAEG;IACI,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE;IAe/D;;OAEG;IACI,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAkBpD"}