@ttoss/http-server-auth 0.11.0 → 0.12.0

package/README.md

@@ -172,7 +172,7 @@ path when the app versions its API; individual paths are overridable through
 
 ## OAuth authorization server
 
-The package also ships `oauthServer()` — a Koa `Router` that issues tokens (`/authorize`, `/token`, `/register`, discovery), a thin adapter over `createOAuthHandlers` from [`@ttoss/auth-core`](https://ttoss.dev/docs/modules/packages/auth-core). Pair it with the `oauth` verification strategy above when one deployment both issues and verifies. See the [OAuth Authorization Server](https://ttoss.dev/docs/engineering/guidelines/oauth-authorization-server) guideline.
+The package also ships `oauthServer()` — a Koa `Router` that issues tokens (`/authorize`, `/token`, `/register`, discovery), a thin adapter over `createOAuthHandlers` from [`@ttoss/auth-core`](https://ttoss.dev/docs/modules/packages/auth-core). Pair it with the `oauth` verification strategy above when one deployment both issues and verifies. The discovery document and `/register` advertise the `refresh_token` grant only when you pass `onRefreshToken`; otherwise they advertise just `authorization_code`, and a registration asking for `refresh_token` has it dropped (or is refused with `invalid_client_metadata` when it asked for nothing else). See the [OAuth Authorization Server](https://ttoss.dev/docs/engineering/guidelines/oauth-authorization-server) guideline.
 
 ### Protected resource metadata (RFC 9728)
 

package/dist/index.cjs

@@ -272,8 +272,10 @@ var emailAuth = options => {
 /**
 * Mounts an OAuth 2.1 Authorization Server (issuing tokens) as a Koa `Router`,
 * adapting the runner-agnostic engine from `@ttoss/auth-core`. Exposes the
-* authorization endpoint (PKCE S256), token endpoint (`authorization_code` +
-* `refresh_token`), Dynamic Client Registration, and discovery metadata.
+* authorization endpoint (PKCE S256), token endpoint (`authorization_code`,
+* plus `refresh_token` when `onRefreshToken` is set), Dynamic Client
+* Registration, and discovery metadata. Discovery and registration advertise
+* `refresh_token` only when `onRefreshToken` is set.
 *
 * This is the issuing side of OAuth; pair it with `authMiddleware`'s `oauth`
 * strategy (the verifying side) when one deployment both issues and verifies.

package/dist/index.d.cts

@@ -141,8 +141,10 @@ export declare const emailAuth: (options: EmailAuthOptions$1 & {
 /**
  * Mounts an OAuth 2.1 Authorization Server (issuing tokens) as a Koa `Router`,
  * adapting the runner-agnostic engine from `@ttoss/auth-core`. Exposes the
- * authorization endpoint (PKCE S256), token endpoint (`authorization_code` +
- * `refresh_token`), Dynamic Client Registration, and discovery metadata.
+ * authorization endpoint (PKCE S256), token endpoint (`authorization_code`,
+ * plus `refresh_token` when `onRefreshToken` is set), Dynamic Client
+ * Registration, and discovery metadata. Discovery and registration advertise
+ * `refresh_token` only when `onRefreshToken` is set.
  *
  * This is the issuing side of OAuth; pair it with `authMiddleware`'s `oauth`
  * strategy (the verifying side) when one deployment both issues and verifies.

package/dist/index.d.mts

@@ -141,8 +141,10 @@ export declare const emailAuth: (options: EmailAuthOptions$1 & {
 /**
  * Mounts an OAuth 2.1 Authorization Server (issuing tokens) as a Koa `Router`,
  * adapting the runner-agnostic engine from `@ttoss/auth-core`. Exposes the
- * authorization endpoint (PKCE S256), token endpoint (`authorization_code` +
- * `refresh_token`), Dynamic Client Registration, and discovery metadata.
+ * authorization endpoint (PKCE S256), token endpoint (`authorization_code`,
+ * plus `refresh_token` when `onRefreshToken` is set), Dynamic Client
+ * Registration, and discovery metadata. Discovery and registration advertise
+ * `refresh_token` only when `onRefreshToken` is set.
  *
  * This is the issuing side of OAuth; pair it with `authMiddleware`'s `oauth`
  * strategy (the verifying side) when one deployment both issues and verifies.

package/dist/index.mjs

@@ -241,8 +241,10 @@ var emailAuth = options => {
 /**
 * Mounts an OAuth 2.1 Authorization Server (issuing tokens) as a Koa `Router`,
 * adapting the runner-agnostic engine from `@ttoss/auth-core`. Exposes the
-* authorization endpoint (PKCE S256), token endpoint (`authorization_code` +
-* `refresh_token`), Dynamic Client Registration, and discovery metadata.
+* authorization endpoint (PKCE S256), token endpoint (`authorization_code`,
+* plus `refresh_token` when `onRefreshToken` is set), Dynamic Client
+* Registration, and discovery metadata. Discovery and registration advertise
+* `refresh_token` only when `onRefreshToken` is set.
 *
 * This is the issuing side of OAuth; pair it with `authMiddleware`'s `oauth`
 * strategy (the verifying side) when one deployment both issues and verifies.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/http-server-auth",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Authentication middleware for @ttoss/http-server",
   "keywords": [
     "auth",
@@ -32,7 +32,7 @@
     "dist"
   ],
   "dependencies": {
-    "@ttoss/auth-core": "^0.21.0"
+    "@ttoss/auth-core": "^0.22.0"
   },
   "devDependencies": {
     "@types/koa": "^3.0.3",