@ttoss/auth-postgresdb 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024, Terezinha Tech Operations (ttoss)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,76 @@
+# @ttoss/auth-postgresdb
+
+Durable Postgres persistence for the OAuth 2.1 authorization server in [`@ttoss/auth-core`](https://ttoss.dev/docs/modules/packages/auth-core): the Sequelize models for the RFC data model, plus the store adapters `createOAuthHandlers`, `createRefreshRotation`, and `createRedirectConsentOnAuthorize` expect.
+
+`@ttoss/auth-core` ships `Map`-backed stores for tests and local development; this package is what production swaps in behind the same interfaces, without reaching around your ORM to inject a raw `pg` query runner.
+
+## Installation
+
+```bash
+pnpm add @ttoss/auth-postgresdb @ttoss/auth-core @ttoss/postgresdb
+```
+
+## Usage
+
+Register `oauthModels` alongside your own models so `ttoss-postgresdb sync` and `erd` manage these tables like any other, then build the stores from the `db` handle:
+
+```typescript
+import {
+  createPostgresdbOAuthStores,
+  oauthModels,
+} from '@ttoss/auth-postgresdb';
+import { initialize } from '@ttoss/postgresdb';
+
+import { User } from './models/User';
+
+export const db = await initialize({ models: { ...oauthModels, User } });
+
+export const { clientStore, authCodeStore, consentStore, refreshTokenStore } =
+  createPostgresdbOAuthStores({ db });
+```
+
+The stores drop straight into the OAuth server:
+
+```typescript
+import { createRefreshRotation } from '@ttoss/auth-core';
+import { oauthServer } from '@ttoss/http-server-auth';
+
+const refresh = createRefreshRotation({ store: refreshTokenStore });
+
+const authServer = oauthServer({
+  issuer: 'https://api.example.com',
+  clientStore,
+  authCodeStore,
+  onRefreshToken: refresh.onRefreshToken,
+  // …issueTokens, onAuthorize…
+});
+```
+
+Each store is also exported on its own (`createClientStore`, `createAuthCodeStore`, `createConsentStore`, `createRefreshTokenStore`) for apps that register only some of the models.
+
+## Schema
+
+| Model               | Table                  | Primary key      |
+| ------------------- | ---------------------- | ---------------- |
+| `OAuthClient`       | `oauth_clients`        | `client_id`      |
+| `OAuthAuthCode`     | `oauth_auth_codes`     | `code_hash`      |
+| `OAuthConsent`      | `oauth_consents`       | `code_challenge` |
+| `OAuthRefreshToken` | `oauth_refresh_tokens` | `token_hash`     |
+
+Credentials are stored by SHA-256 hash, never in plaintext, so a database dump yields nothing replayable. `OAuthClient` keeps the registered RFC 7591 fields in their own columns and any additional submitted metadata in a `metadata` JSONB column, so a registration document round-trips unchanged.
+
+## Two traps these adapters absorb
+
+**Authorization codes are hashed at rest.** `AuthCodeStore.get` is handed the plaintext code, but a code travels through a browser redirect and a client's URL bar. The engine never compares the returned `code` against anything — it reads only `clientId`, `redirectUri`, `codeChallenge`, `scopes`, `subject`, and `expiresAt` — so the adapter hashes to find the row and echoes the presented value back.
+
+**A live refresh token reports no `consumedAt` at all.** `createRefreshRotation` treats `stored.consumedAt !== undefined` as reuse. A nullable timestamp column reads back as `null`, which is `!== undefined`, so a naive adapter makes every live token look consumed: the first refresh is treated as a replay and revokes the owner's entire token set — "refresh works once, then the client must re-authorize forever". The adapter omits the key instead of setting it to `null`.
+
+## Consent
+
+`consentStore` satisfies the `ConsentGrantStore` that `createRedirectConsentOnAuthorize` consumes, and adds `saveConsentGrant` for the write your consent page performs on approval. It is the single-use handoff keyed by the PKCE `code_challenge` — not a durable "user X trusts client Y" record, which is an app-level authorization decision and belongs in your own schema.
+
+## Related
+
+- [OAuth Authorization Server](https://ttoss.dev/docs/engineering/guidelines/oauth-authorization-server) — the full server setup and the ttoss-vs-app responsibility split
+- [MCP Server with OAuth](https://ttoss.dev/docs/engineering/guidelines/mcp-server-oauth) — the MCP application of these primitives
+- [`@ttoss/postgresdb`](https://ttoss.dev/docs/modules/packages/postgresdb) — `initialize`, and the `sync` / `erd` CLI

package/dist/index.cjs

@@ -0,0 +1,507 @@
+/** Powered by @ttoss/config. https://ttoss.dev/docs/modules/packages/config/ */
+Object.defineProperty(exports, Symbol.toStringTag, {
+  value: 'Module'
+});
+let _ttoss_auth_core = require("@ttoss/auth-core");
+let _ttoss_postgresdb = require("@ttoss/postgresdb");
+
+//#region src/stores/createAuthCodeStore.ts
+/**
+* Creates an {@link AuthCodeStore} backed by the `oauth_auth_codes` table,
+* storing codes by SHA-256 hash.
+*
+* The engine hands the store the plaintext code on every call and never compares
+* the returned `code` against anything — it reads only `clientId`,
+* `redirectUri`, `codeChallenge`, `scopes`, `subject`, and `expiresAt`. So the
+* adapter hashes to find the row and echoes the presented value back, and a
+* database dump yields no replayable codes.
+*/
+var createAuthCodeStore = ({
+  model
+}) => {
+  return {
+    save: async code => {
+      await model.upsert({
+        codeHash: (0, _ttoss_auth_core.hashAuthorizationCode)({
+          code: code.code
+        }),
+        clientId: code.clientId,
+        redirectUri: code.redirectUri,
+        codeChallenge: code.codeChallenge,
+        scopes: code.scopes,
+        subject: code.subject,
+        expiresAt: new Date(code.expiresAt)
+      });
+    },
+    get: async code => {
+      const row = await model.findByPk((0, _ttoss_auth_core.hashAuthorizationCode)({
+        code
+      }));
+      if (!row) return;
+      return {
+        code,
+        clientId: row.clientId,
+        redirectUri: row.redirectUri,
+        codeChallenge: row.codeChallenge,
+        scopes: row.scopes,
+        subject: row.subject,
+        expiresAt: row.expiresAt.getTime()
+      };
+    },
+    delete: async code => {
+      await model.destroy({
+        where: {
+          codeHash: (0, _ttoss_auth_core.hashAuthorizationCode)({
+            code
+          })
+        }
+      });
+    }
+  };
+};
+
+//#endregion
+//#region src/stores/createClientStore.ts
+/**
+* Registration fields that have their own column. Everything else a client
+* submits goes to `metadata`, so the document round-trips unchanged.
+*/
+var COLUMN_FIELDS = ["client_id", "client_secret", "client_name", "redirect_uris", "grant_types", "response_types", "token_endpoint_auth_method", "scope", "client_id_issued_at"];
+var toRecord = row => {
+  return {
+    ...row.metadata,
+    client_id: row.clientId,
+    redirect_uris: row.redirectUris,
+    ...(row.clientSecret !== null && {
+      client_secret: row.clientSecret
+    }),
+    ...(row.clientName !== null && {
+      client_name: row.clientName
+    }),
+    ...(row.grantTypes !== null && {
+      grant_types: row.grantTypes
+    }),
+    ...(row.responseTypes !== null && {
+      response_types: row.responseTypes
+    }),
+    ...(row.tokenEndpointAuthMethod !== null && {
+      token_endpoint_auth_method: row.tokenEndpointAuthMethod
+    }),
+    ...(row.scope !== null && {
+      scope: row.scope
+    }),
+    ...(row.clientIdIssuedAt !== null && {
+      client_id_issued_at: Number(row.clientIdIssuedAt)
+    })
+  };
+};
+var toMetadata = client => {
+  const metadata = {};
+  for (const [key, value] of Object.entries(client)) if (!COLUMN_FIELDS.includes(key)) metadata[key] = value;
+  return metadata;
+};
+/**
+* Creates a {@link ClientStore} backed by the `oauth_clients` table.
+*
+* `register` upserts, so re-registering an existing `client_id` replaces the
+* stored document rather than failing on the primary key.
+*/
+var createClientStore = ({
+  model
+}) => {
+  return {
+    get: async clientId => {
+      const row = await model.findByPk(clientId);
+      return row ? toRecord(row) : void 0;
+    },
+    register: async client => {
+      await model.upsert({
+        clientId: client.client_id,
+        clientSecret: client.client_secret ?? null,
+        clientName: client.client_name ?? null,
+        redirectUris: client.redirect_uris,
+        grantTypes: client.grant_types ?? null,
+        responseTypes: client.response_types ?? null,
+        tokenEndpointAuthMethod: client.token_endpoint_auth_method ?? null,
+        scope: client.scope ?? null,
+        clientIdIssuedAt: client.client_id_issued_at ?? null,
+        metadata: toMetadata(client)
+      });
+    }
+  };
+};
+
+//#endregion
+//#region src/stores/createConsentStore.ts
+/**
+* Creates a consent store backed by the `oauth_consents` table, for use with
+* `createRedirectConsentOnAuthorize`.
+*
+* Reads and deletes satisfy `ConsentGrantStore`; `saveConsentGrant` covers the
+* write the consent page performs. Grants are single-use — the `onAuthorize`
+* hook deletes each one as it consumes it.
+*/
+var createConsentStore = ({
+  model
+}) => {
+  return {
+    saveConsentGrant: async ({
+      codeChallenge,
+      subject,
+      scopes,
+      expiresAt
+    }) => {
+      await model.upsert({
+        codeChallenge,
+        subject,
+        scopes,
+        expiresAt: new Date(expiresAt)
+      });
+    },
+    getConsentGrant: async ({
+      codeChallenge
+    }) => {
+      const row = await model.findByPk(codeChallenge);
+      if (!row) return;
+      return {
+        subject: row.subject,
+        scopes: row.scopes,
+        expiresAt: row.expiresAt.getTime()
+      };
+    },
+    deleteConsentGrant: async ({
+      codeChallenge
+    }) => {
+      await model.destroy({
+        where: {
+          codeChallenge
+        }
+      });
+    }
+  };
+};
+
+//#endregion
+//#region src/stores/createRefreshTokenStore.ts
+/**
+* Creates a {@link RefreshTokenStore} backed by the `oauth_refresh_tokens`
+* table, keyed by token hash and by the `(clientId, subject)` owner that
+* `deleteByOwner` revokes on reuse detection.
+*/
+var createRefreshTokenStore = ({
+  model
+}) => {
+  return {
+    save: async token => {
+      await model.upsert({
+        tokenHash: token.tokenHash,
+        clientId: token.clientId,
+        subject: token.subject,
+        scopes: token.scopes,
+        expiresAt: new Date(token.expiresAt),
+        consumedAt: token.consumedAt === void 0 ? null : new Date(token.consumedAt)
+      });
+    },
+    get: async tokenHash => {
+      const row = await model.findByPk(tokenHash);
+      if (!row) return;
+      return {
+        tokenHash: row.tokenHash,
+        clientId: row.clientId,
+        subject: row.subject,
+        scopes: row.scopes,
+        expiresAt: row.expiresAt.getTime(),
+        /**
+        * The key is omitted, not set to `null`. Rotation tests
+        * `stored.consumedAt !== undefined` to detect reuse, and a nullable
+        * timestamp column reads back as `null` — which would make every live
+        * token look consumed, so the first refresh would be treated as a
+        * replay and revoke the owner's entire token set.
+        */
+        ...(row.consumedAt !== null && {
+          consumedAt: row.consumedAt.getTime()
+        })
+      };
+    },
+    delete: async tokenHash => {
+      await model.destroy({
+        where: {
+          tokenHash
+        }
+      });
+    },
+    deleteByOwner: async ({
+      clientId,
+      subject
+    }) => {
+      await model.destroy({
+        where: {
+          clientId,
+          subject
+        }
+      });
+    }
+  };
+};
+
+//#endregion
+//#region src/createPostgresdbOAuthStores.ts
+/**
+* Creates every durable OAuth store from a `@ttoss/postgresdb` `db` handle.
+*
+* The stores are mechanical adapters between the `@ttoss/auth-core` store
+* contracts and Sequelize, so an app that already uses `@ttoss/postgresdb` does
+* not have to write them — nor reach around its own ORM to inject a raw `pg`
+* query runner.
+*
+* @example
+* ```typescript
+* import { createPostgresdbOAuthStores, oauthModels } from '@ttoss/auth-postgresdb';
+* import { initialize } from '@ttoss/postgresdb';
+*
+* const db = await initialize({ models: { ...oauthModels, User } });
+*
+* const { clientStore, authCodeStore, consentStore, refreshTokenStore } =
+*   createPostgresdbOAuthStores({ db });
+* ```
+*/
+var createPostgresdbOAuthStores = ({
+  db
+}) => {
+  return {
+    clientStore: createClientStore({
+      model: db.OAuthClient
+    }),
+    authCodeStore: createAuthCodeStore({
+      model: db.OAuthAuthCode
+    }),
+    consentStore: createConsentStore({
+      model: db.OAuthConsent
+    }),
+    refreshTokenStore: createRefreshTokenStore({
+      model: db.OAuthRefreshToken
+    })
+  };
+};
+
+//#endregion
+//#region \0@oxc-project+runtime@0.134.0/helpers/esm/decorateMetadata.js
+function __decorateMetadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+
+//#endregion
+//#region \0@oxc-project+runtime@0.134.0/helpers/esm/decorate.js
+function __decorate(decorators, target, key, desc) {
+  var c = arguments.length,
+    r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc,
+    d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+
+//#endregion
+//#region src/models/OAuthAuthCode.ts
+var OAuthAuthCode = class OAuthAuthCode extends _ttoss_postgresdb.Model {};
+__decorate([_ttoss_postgresdb.PrimaryKey, (0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthAuthCode.prototype, "codeHash", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthAuthCode.prototype, "clientId", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.TEXT,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthAuthCode.prototype, "redirectUri", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthAuthCode.prototype, "codeChallenge", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.JSONB,
+  allowNull: false
+}), __decorateMetadata("design:type", Array)], OAuthAuthCode.prototype, "scopes", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthAuthCode.prototype, "subject", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.DATE,
+  allowNull: false
+}), __decorateMetadata("design:type", typeof Date === "undefined" ? Object : Date)], OAuthAuthCode.prototype, "expiresAt", void 0);
+OAuthAuthCode = __decorate([(0, _ttoss_postgresdb.Table)({
+  tableName: "oauth_auth_codes",
+  modelName: "oauthAuthCode",
+  indexes: [{
+    fields: ["expires_at"]
+  }]
+})], OAuthAuthCode);
+
+//#endregion
+//#region src/models/OAuthClient.ts
+var OAuthClient = class OAuthClient extends _ttoss_postgresdb.Model {};
+__decorate([_ttoss_postgresdb.PrimaryKey, (0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthClient.prototype, "clientId", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.STRING,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "clientSecret", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.STRING,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "clientName", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.JSONB,
+  allowNull: false
+}), __decorateMetadata("design:type", Array)], OAuthClient.prototype, "redirectUris", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.JSONB,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "grantTypes", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.JSONB,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "responseTypes", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.STRING,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "tokenEndpointAuthMethod", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.STRING,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "scope", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.BIGINT,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "clientIdIssuedAt", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.JSONB,
+  allowNull: false,
+  defaultValue: {}
+}), __decorateMetadata("design:type", typeof Record === "undefined" ? Object : Record)], OAuthClient.prototype, "metadata", void 0);
+OAuthClient = __decorate([(0, _ttoss_postgresdb.Table)({
+  tableName: "oauth_clients",
+  modelName: "oauthClient"
+})], OAuthClient);
+
+//#endregion
+//#region src/models/OAuthConsent.ts
+var OAuthConsent = class OAuthConsent extends _ttoss_postgresdb.Model {};
+__decorate([_ttoss_postgresdb.PrimaryKey, (0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthConsent.prototype, "codeChallenge", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthConsent.prototype, "subject", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.JSONB,
+  allowNull: false
+}), __decorateMetadata("design:type", Array)], OAuthConsent.prototype, "scopes", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.DATE,
+  allowNull: false
+}), __decorateMetadata("design:type", typeof Date === "undefined" ? Object : Date)], OAuthConsent.prototype, "expiresAt", void 0);
+OAuthConsent = __decorate([(0, _ttoss_postgresdb.Table)({
+  tableName: "oauth_consents",
+  modelName: "oauthConsent",
+  indexes: [{
+    fields: ["expires_at"]
+  }]
+})], OAuthConsent);
+
+//#endregion
+//#region src/models/OAuthRefreshToken.ts
+var OAuthRefreshToken = class OAuthRefreshToken extends _ttoss_postgresdb.Model {};
+__decorate([_ttoss_postgresdb.PrimaryKey, (0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthRefreshToken.prototype, "tokenHash", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthRefreshToken.prototype, "clientId", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.STRING,
+  allowNull: false
+}), __decorateMetadata("design:type", String)], OAuthRefreshToken.prototype, "subject", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.JSONB,
+  allowNull: false
+}), __decorateMetadata("design:type", Array)], OAuthRefreshToken.prototype, "scopes", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.DATE,
+  allowNull: false
+}), __decorateMetadata("design:type", typeof Date === "undefined" ? Object : Date)], OAuthRefreshToken.prototype, "expiresAt", void 0);
+__decorate([(0, _ttoss_postgresdb.Column)({
+  type: _ttoss_postgresdb.DataType.DATE,
+  allowNull: true
+}), __decorateMetadata("design:type", Object)], OAuthRefreshToken.prototype, "consumedAt", void 0);
+OAuthRefreshToken = __decorate([(0, _ttoss_postgresdb.Table)({
+  tableName: "oauth_refresh_tokens",
+  modelName: "oauthRefreshToken",
+  indexes: [{
+    fields: ["client_id", "subject"]
+  }, {
+    fields: ["expires_at"]
+  }]
+})], OAuthRefreshToken);
+
+//#endregion
+//#region src/models/index.ts
+/**
+* The OAuth data model, ready to register alongside the application's own
+* models so `ttoss-postgresdb sync` and `erd` cover these tables like any
+* other instead of them being a side-channel schema the CLI cannot see.
+*
+* @example
+* ```typescript
+* import { oauthModels } from '@ttoss/auth-postgresdb';
+* import { initialize } from '@ttoss/postgresdb';
+*
+* export const db = await initialize({ models: { ...oauthModels, User } });
+* ```
+*/
+var oauthModels = {
+  OAuthAuthCode,
+  OAuthClient,
+  OAuthConsent,
+  OAuthRefreshToken
+};
+
+//#endregion
+Object.defineProperty(exports, 'OAuthAuthCode', {
+  enumerable: true,
+  get: function () {
+    return OAuthAuthCode;
+  }
+});
+Object.defineProperty(exports, 'OAuthClient', {
+  enumerable: true,
+  get: function () {
+    return OAuthClient;
+  }
+});
+Object.defineProperty(exports, 'OAuthConsent', {
+  enumerable: true,
+  get: function () {
+    return OAuthConsent;
+  }
+});
+Object.defineProperty(exports, 'OAuthRefreshToken', {
+  enumerable: true,
+  get: function () {
+    return OAuthRefreshToken;
+  }
+});
+exports.createAuthCodeStore = createAuthCodeStore;
+exports.createClientStore = createClientStore;
+exports.createConsentStore = createConsentStore;
+exports.createPostgresdbOAuthStores = createPostgresdbOAuthStores;
+exports.createRefreshTokenStore = createRefreshTokenStore;
+exports.oauthModels = oauthModels;