@ttoss/auth-postgresdb 0.1.0 → 0.1.1

package/README.md

@@ -57,12 +57,16 @@ Each store is also exported on its own (`createClientStore`, `createAuthCodeStor
 | `OAuthConsent`      | `oauth_consents`       | `code_challenge` |
 | `OAuthRefreshToken` | `oauth_refresh_tokens` | `token_hash`     |
 
-Credentials are stored by SHA-256 hash, never in plaintext, so a database dump yields nothing replayable. `OAuthClient` keeps the registered RFC 7591 fields in their own columns and any additional submitted metadata in a `metadata` JSONB column, so a registration document round-trips unchanged.
+Every credential — authorization codes (`code_hash`), refresh tokens (`token_hash`), and client secrets (`client_secret_hash`) — is stored by SHA-256 hash, never in plaintext, so a database dump yields nothing replayable. `OAuthClient` keeps the registered RFC 7591 fields in their own columns and any additional submitted metadata in a `metadata` JSONB column, so a registration document round-trips unchanged.
 
-## Two traps these adapters absorb
+## Three traps these adapters absorb
 
 **Authorization codes are hashed at rest.** `AuthCodeStore.get` is handed the plaintext code, but a code travels through a browser redirect and a client's URL bar. The engine never compares the returned `code` against anything — it reads only `clientId`, `redirectUri`, `codeChallenge`, `scopes`, `subject`, and `expiresAt` — so the adapter hashes to find the row and echoes the presented value back.
 
+**Client secrets are hashed at rest too, which takes a different mechanism.** A secret _is_ compared, so the adapter cannot simply hash the row away and echo the presented value back. Instead `clientStore` implements `ClientStore.verifyClientSecret`: the engine hands over the presented secret and the store compares it against the stored hash in constant time, so the raw value never has to be recoverable. Consequently `get` omits `client_secret` from the document it returns — nothing in the engine needs it, since the registration response echoes the secret from the document it just generated rather than from a read.
+
+Implementing `verifyClientSecret` is what makes hashing possible at all. A store that omits it falls back to the engine comparing the `client_secret` returned by `get`, which forces the store to keep the secret recoverable — plaintext, or encrypted with a key the app has to manage.
+
 **A live refresh token reports no `consumedAt` at all.** `createRefreshRotation` treats `stored.consumedAt !== undefined` as reuse. A nullable timestamp column reads back as `null`, which is `!== undefined`, so a naive adapter makes every live token look consumed: the first refresh is treated as a replay and revokes the owner's entire token set — "refresh works once, then the client must re-authorize forever". The adapter omits the key instead of setting it to `null`.
 
 ## Consent

package/dist/index.cjs

@@ -65,6 +65,9 @@ var createAuthCodeStore = ({
 /**
 * Registration fields that have their own column. Everything else a client
 * submits goes to `metadata`, so the document round-trips unchanged.
+*
+* `client_secret` is listed here even though no column holds it verbatim: it
+* must never fall through to the `metadata` JSONB, which would defeat hashing.
 */
 var COLUMN_FIELDS = ["client_id", "client_secret", "client_name", "redirect_uris", "grant_types", "response_types", "token_endpoint_auth_method", "scope", "client_id_issued_at"];
 var toRecord = row => {
@@ -72,9 +75,6 @@ var toRecord = row => {
     ...row.metadata,
     client_id: row.clientId,
     redirect_uris: row.redirectUris,
-    ...(row.clientSecret !== null && {
-      client_secret: row.clientSecret
-    }),
     ...(row.clientName !== null && {
       client_name: row.clientName
     }),
@@ -101,7 +101,14 @@ var toMetadata = client => {
   return metadata;
 };
 /**
-* Creates a {@link ClientStore} backed by the `oauth_clients` table.
+* Creates a {@link ClientStore} backed by the `oauth_clients` table, storing
+* client secrets by SHA-256 hash.
+*
+* Because the secret is not recoverable, `get` omits `client_secret` and client
+* authentication goes through `verifyClientSecret`, which compares the
+* presented value against the stored hash. The engine only ever needs that
+* comparison — the registration response echoes the secret from the document it
+* just generated, never from a read — so nothing is lost by not keeping it.
 *
 * `register` upserts, so re-registering an existing `client_id` replaces the
 * stored document rather than failing on the primary key.
@@ -114,10 +121,24 @@ var createClientStore = ({
       const row = await model.findByPk(clientId);
       return row ? toRecord(row) : void 0;
     },
+    verifyClientSecret: async ({
+      clientId,
+      clientSecret
+    }) => {
+      const row = await model.findByPk(clientId);
+      if (!row) return false;
+      if (row.clientSecretHash === null) return true;
+      return (0, _ttoss_auth_core.verifyClientSecret)({
+        clientSecret,
+        clientSecretHash: row.clientSecretHash
+      });
+    },
     register: async client => {
       await model.upsert({
         clientId: client.client_id,
-        clientSecret: client.client_secret ?? null,
+        clientSecretHash: client.client_secret ? (0, _ttoss_auth_core.hashClientSecret)({
+          clientSecret: client.client_secret
+        }) : null,
         clientName: client.client_name ?? null,
         redirectUris: client.redirect_uris,
         grantTypes: client.grant_types ?? null,
@@ -349,7 +370,7 @@ __decorate([_ttoss_postgresdb.PrimaryKey, (0, _ttoss_postgresdb.Column)({
 __decorate([(0, _ttoss_postgresdb.Column)({
   type: _ttoss_postgresdb.DataType.STRING,
   allowNull: true
-}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "clientSecret", void 0);
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "clientSecretHash", void 0);
 __decorate([(0, _ttoss_postgresdb.Column)({
   type: _ttoss_postgresdb.DataType.STRING,
   allowNull: true

package/dist/index.d.cts

@@ -39,10 +39,14 @@ declare class OAuthClient extends Model {
   /** The `client_id` issued by the authorization server. */
   clientId: string;
   /**
-   * Client secret for confidential clients, `null` for public clients
-   * (`token_endpoint_auth_method: 'none'`).
+   * SHA-256 hash (hex) of the client secret for confidential clients, `null`
+   * for public clients (`token_endpoint_auth_method: 'none'`).
+   *
+   * The secret itself is never stored: the token endpoint only ever compares a
+   * presented value, so a hash is enough and a database dump yields nothing
+   * replayable.
    */
-  clientSecret: string | null;
+  clientSecretHash: string | null;
   /** Human-readable client name shown on consent screens. */
   clientName: string | null;
   /** Exact redirect URIs registered for this client. */
@@ -218,7 +222,14 @@ declare const createAuthCodeStore: ({
 //#endregion
 //#region src/stores/createClientStore.d.ts
 /**
- * Creates a {@link ClientStore} backed by the `oauth_clients` table.
+ * Creates a {@link ClientStore} backed by the `oauth_clients` table, storing
+ * client secrets by SHA-256 hash.
+ *
+ * Because the secret is not recoverable, `get` omits `client_secret` and client
+ * authentication goes through `verifyClientSecret`, which compares the
+ * presented value against the stored hash. The engine only ever needs that
+ * comparison — the registration response echoes the secret from the document it
+ * just generated, never from a read — so nothing is lost by not keeping it.
  *
  * `register` upserts, so re-registering an existing `client_id` replaces the
  * stored document rather than failing on the primary key.

package/dist/index.d.mts

@@ -39,10 +39,14 @@ declare class OAuthClient extends Model {
   /** The `client_id` issued by the authorization server. */
   clientId: string;
   /**
-   * Client secret for confidential clients, `null` for public clients
-   * (`token_endpoint_auth_method: 'none'`).
+   * SHA-256 hash (hex) of the client secret for confidential clients, `null`
+   * for public clients (`token_endpoint_auth_method: 'none'`).
+   *
+   * The secret itself is never stored: the token endpoint only ever compares a
+   * presented value, so a hash is enough and a database dump yields nothing
+   * replayable.
    */
-  clientSecret: string | null;
+  clientSecretHash: string | null;
   /** Human-readable client name shown on consent screens. */
   clientName: string | null;
   /** Exact redirect URIs registered for this client. */
@@ -218,7 +222,14 @@ declare const createAuthCodeStore: ({
 //#endregion
 //#region src/stores/createClientStore.d.ts
 /**
- * Creates a {@link ClientStore} backed by the `oauth_clients` table.
+ * Creates a {@link ClientStore} backed by the `oauth_clients` table, storing
+ * client secrets by SHA-256 hash.
+ *
+ * Because the secret is not recoverable, `get` omits `client_secret` and client
+ * authentication goes through `verifyClientSecret`, which compares the
+ * presented value against the stored hash. The engine only ever needs that
+ * comparison — the registration response echoes the secret from the document it
+ * just generated, never from a read — so nothing is lost by not keeping it.
  *
  * `register` upserts, so re-registering an existing `client_id` replaces the
  * stored document rather than failing on the primary key.

package/dist/index.mjs

@@ -1,5 +1,5 @@
 /** Powered by @ttoss/config. https://ttoss.dev/docs/modules/packages/config/ */
-import { hashAuthorizationCode } from "@ttoss/auth-core";
+import { hashAuthorizationCode, hashClientSecret, verifyClientSecret } from "@ttoss/auth-core";
 import { Column, DataType, Model, PrimaryKey, Table } from "@ttoss/postgresdb";
 
 //#region src/stores/createAuthCodeStore.ts
@@ -62,6 +62,9 @@ var createAuthCodeStore = ({
 /**
 * Registration fields that have their own column. Everything else a client
 * submits goes to `metadata`, so the document round-trips unchanged.
+*
+* `client_secret` is listed here even though no column holds it verbatim: it
+* must never fall through to the `metadata` JSONB, which would defeat hashing.
 */
 var COLUMN_FIELDS = ["client_id", "client_secret", "client_name", "redirect_uris", "grant_types", "response_types", "token_endpoint_auth_method", "scope", "client_id_issued_at"];
 var toRecord = row => {
@@ -69,9 +72,6 @@ var toRecord = row => {
     ...row.metadata,
     client_id: row.clientId,
     redirect_uris: row.redirectUris,
-    ...(row.clientSecret !== null && {
-      client_secret: row.clientSecret
-    }),
     ...(row.clientName !== null && {
       client_name: row.clientName
     }),
@@ -98,7 +98,14 @@ var toMetadata = client => {
   return metadata;
 };
 /**
-* Creates a {@link ClientStore} backed by the `oauth_clients` table.
+* Creates a {@link ClientStore} backed by the `oauth_clients` table, storing
+* client secrets by SHA-256 hash.
+*
+* Because the secret is not recoverable, `get` omits `client_secret` and client
+* authentication goes through `verifyClientSecret`, which compares the
+* presented value against the stored hash. The engine only ever needs that
+* comparison — the registration response echoes the secret from the document it
+* just generated, never from a read — so nothing is lost by not keeping it.
 *
 * `register` upserts, so re-registering an existing `client_id` replaces the
 * stored document rather than failing on the primary key.
@@ -111,10 +118,24 @@ var createClientStore = ({
       const row = await model.findByPk(clientId);
       return row ? toRecord(row) : void 0;
     },
+    verifyClientSecret: async ({
+      clientId,
+      clientSecret
+    }) => {
+      const row = await model.findByPk(clientId);
+      if (!row) return false;
+      if (row.clientSecretHash === null) return true;
+      return verifyClientSecret({
+        clientSecret,
+        clientSecretHash: row.clientSecretHash
+      });
+    },
     register: async client => {
       await model.upsert({
         clientId: client.client_id,
-        clientSecret: client.client_secret ?? null,
+        clientSecretHash: client.client_secret ? hashClientSecret({
+          clientSecret: client.client_secret
+        }) : null,
         clientName: client.client_name ?? null,
         redirectUris: client.redirect_uris,
         grantTypes: client.grant_types ?? null,
@@ -346,7 +367,7 @@ __decorate([PrimaryKey, Column({
 __decorate([Column({
   type: DataType.STRING,
   allowNull: true
-}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "clientSecret", void 0);
+}), __decorateMetadata("design:type", Object)], OAuthClient.prototype, "clientSecretHash", void 0);
 __decorate([Column({
   type: DataType.STRING,
   allowNull: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/auth-postgresdb",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Durable Postgres OAuth stores and models for @ttoss/auth-core",
   "keywords": [
     "auth",
@@ -34,12 +34,12 @@
   "devDependencies": {
     "jest": "^30.4.2",
     "tsdown": "^0.22.2",
+    "@ttoss/auth-core": "^0.13.1",
     "@ttoss/config": "^1.37.17",
-    "@ttoss/postgresdb": "^0.11.0",
-    "@ttoss/auth-core": "^0.13.0"
+    "@ttoss/postgresdb": "^0.11.0"
   },
   "peerDependencies": {
-    "@ttoss/auth-core": "^0.13.0",
+    "@ttoss/auth-core": "^0.13.1",
     "@ttoss/postgresdb": "^0.11.0"
   },
   "publishConfig": {