@tumbaland/backend-core 1.36.0 → 1.37.0

package/dist/apiKeys/middleware.d.ts

@@ -1,5 +1,5 @@
 import { RequestHandler } from 'express';
-import type { ApiKeyScope } from './types';
+import { type ApiKeyScope } from './types';
 /**
  * Request-scoped facts about the key a request arrived on. Absent on ordinary
  * session requests, which is itself the signal a handler needs: `req.apiKey`
@@ -40,11 +40,13 @@ export declare const authenticateAgent: (...requiredScopes: ApiKeyScope[]) => Re
  * door for lacking a scope half the router never uses.
  *
  * A session passes unconditionally: scopes narrow what software may do on a
- * person's behalf, not what the person may do themselves.
+ * person's behalf, not what the person may do themselves. Everything that is
+ * not a session — an API key or an OAuth access token alike — arrives with
+ * `req.apiKey` set and is held to it.
  */
 export declare const requireScope: (...requiredScopes: ApiKeyScope[]) => RequestHandler;
 /**
- * Refuse API keys on a route that a session may still use.
+ * Refuse every non-session credential on a route that a session may still use.
  *
  * For the handful of operations that should stay a person's to perform — key
  * management itself, most obviously, since a key that can mint keys is a key

package/dist/apiKeys/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/apiKeys/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,cAAc,EAAY,MAAM,SAAS,CAAC;AAO1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,MAAM,CAAC,EAAE,aAAa,CAAC;SACxB;KACF;CACF;AA0DD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,GAAG,gBAAgB,WAAW,EAAE,KAAG,cA4DlE,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,GAAI,GAAG,gBAAgB,WAAW,EAAE,KAAG,cAiB7D,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,cASzB,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/apiKeys/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,cAAc,EAAY,MAAM,SAAS,CAAC;AAQ1E,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,MAAM,CAAC,EAAE,aAAa,CAAC;SACxB;KACF;CACF;AAgHD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,GAAG,gBAAgB,WAAW,EAAE,KAAG,cA+DlE,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,GAAI,GAAG,gBAAgB,WAAW,EAAE,KAAG,cAiB7D,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,cASzB,CAAC"}

package/dist/apiKeys/middleware.js

@@ -7,8 +7,10 @@ exports.denyApiKeys = exports.requireScope = exports.authenticateAgent = void 0;
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const env_1 = require("../config/env");
 const logger_1 = __importDefault(require("../logging/logger"));
+const tokens_1 = require("../oauth/tokens");
 const crypto_1 = require("./crypto");
 const service_1 = require("./service");
+const types_1 = require("./types");
 /** Both auth paths read the token from the same two places. */
 const extractToken = (req) => req.cookies?.access_token || req.headers.authorization?.replace('Bearer ', '');
 const unauthorized = (res) => {
@@ -58,6 +60,39 @@ const applyTenantPin = (req, groupId) => {
     }
     return true;
 };
+/**
+ * Admit software acting for a user, on the terms its credential carries.
+ *
+ * Shared by both non-session credentials on purpose. An API key and an OAuth
+ * access token differ entirely in how they are issued and verified, and not at
+ * all in what they mean once they are: a user, a set of scopes, and one tenant.
+ * Settling that in one place is what keeps the two from drifting into subtly
+ * different amounts of access.
+ */
+function admitAgent(req, res, next, requiredScopes, credential) {
+    const missing = requiredScopes.filter((scope) => !credential.scopes.includes(scope));
+    if (missing.length > 0) {
+        res.status(403).json({
+            success: false,
+            message: `Credential is missing required scope: ${missing.join(', ')}`
+        });
+        return;
+    }
+    if (!applyTenantPin(req, credential.groupId)) {
+        res.status(403).json({
+            success: false,
+            message: 'Credential is not permitted to act in the requested group'
+        });
+        return;
+    }
+    req.user = { id: credential.userId, email: credential.email, name: credential.name };
+    // Only the pinned group, never the owner's full membership: this is what
+    // stops a credential reaching a group it was not issued for through any
+    // handler that consults `userGroups` instead of the `groupId` parameter.
+    req.userGroups = credential.groupId ? [credential.groupId] : [];
+    req.apiKey = { keyId: credential.credentialId, scopes: credential.scopes, groupId: credential.groupId };
+    next();
+}
 /**
  * Authenticate a request that software may legitimately be making.
  *
@@ -77,15 +112,39 @@ const authenticateAgent = (...requiredScopes) => async function authenticateAgen
         return;
     }
     if (!(0, crypto_1.looksLikeApiKey)(token)) {
+        let claims;
         try {
-            const user = jsonwebtoken_1.default.verify(token, (0, env_1.requireEnv)('JWT_SECRET'));
-            req.user = user;
-            req.userGroups = user.groups ?? [];
-            next();
+            claims = jsonwebtoken_1.default.verify(token, (0, env_1.requireEnv)('JWT_SECRET'));
         }
         catch {
             unauthorized(res);
+            return;
         }
+        if (!(0, tokens_1.isAccessTokenClaims)(claims)) {
+            const user = claims;
+            req.user = user;
+            req.userGroups = user.groups ?? [];
+            next();
+            return;
+        }
+        // An OAuth access token: signed with the same secret as a session and
+        // arriving in the same header, but nothing like one. It names its user in
+        // `sub`, carries scopes, and is pinned to a tenant — so it is admitted
+        // the way a key is, not the way a person is.
+        //
+        // Reading it as a session was the original bug and it failed quietly: the
+        // claims have no `id` and no `groups`, so `req.user.id` arrived as
+        // `undefined`, scoped writes were refused as inaccessible, and a read
+        // whose scope collapsed to nothing fell through to "no user context" and
+        // answered from the whole collection.
+        admitAgent(req, res, next, requiredScopes, {
+            credentialId: claims.jti,
+            userId: claims.sub,
+            email: claims.email ?? '',
+            name: claims.name ?? '',
+            scopes: (claims.scope ?? '').split(' ').filter(types_1.isApiKeyScope),
+            groupId: claims.groupId ?? null
+        });
         return;
     }
     const result = await (0, service_1.verifyApiKey)(token);
@@ -96,34 +155,14 @@ const authenticateAgent = (...requiredScopes) => async function authenticateAgen
         unauthorized(res);
         return;
     }
-    const scopes = result.scopes ?? [];
-    const missing = requiredScopes.filter((scope) => !scopes.includes(scope));
-    if (missing.length > 0) {
-        res.status(403).json({
-            success: false,
-            message: `API key is missing required scope: ${missing.join(', ')}`
-        });
-        return;
-    }
-    const groupId = result.groupId ?? null;
-    if (!applyTenantPin(req, groupId)) {
-        res.status(403).json({
-            success: false,
-            message: 'API key is not permitted to act in the requested group'
-        });
-        return;
-    }
-    req.user = {
-        id: result.userId,
+    admitAgent(req, res, next, requiredScopes, {
+        credentialId: result.keyId,
+        userId: result.userId,
         email: result.userEmail ?? '',
-        name: result.userName ?? ''
-    };
-    // Only the pinned group, never the owner's full membership: this is what
-    // stops a key reaching a group it was not issued for through any handler
-    // that consults `userGroups` instead of the `groupId` parameter.
-    req.userGroups = groupId ? [groupId] : [];
-    req.apiKey = { keyId: result.keyId, scopes, groupId };
-    next();
+        name: result.userName ?? '',
+        scopes: result.scopes ?? [],
+        groupId: result.groupId ?? null
+    });
 };
 exports.authenticateAgent = authenticateAgent;
 /**
@@ -135,7 +174,9 @@ exports.authenticateAgent = authenticateAgent;
  * door for lacking a scope half the router never uses.
  *
  * A session passes unconditionally: scopes narrow what software may do on a
- * person's behalf, not what the person may do themselves.
+ * person's behalf, not what the person may do themselves. Everything that is
+ * not a session — an API key or an OAuth access token alike — arrives with
+ * `req.apiKey` set and is held to it.
  */
 const requireScope = (...requiredScopes) => function requireScopeHandler(req, res, next) {
     if (!req.apiKey) {
@@ -146,7 +187,7 @@ const requireScope = (...requiredScopes) => function requireScopeHandler(req, re
     if (missing.length > 0) {
         res.status(403).json({
             success: false,
-            message: `API key is missing required scope: ${missing.join(', ')}`
+            message: `Credential is missing required scope: ${missing.join(', ')}`
         });
         return;
     }
@@ -154,7 +195,7 @@ const requireScope = (...requiredScopes) => function requireScopeHandler(req, re
 };
 exports.requireScope = requireScope;
 /**
- * Refuse API keys on a route that a session may still use.
+ * Refuse every non-session credential on a route that a session may still use.
  *
  * For the handful of operations that should stay a person's to perform — key
  * management itself, most obviously, since a key that can mint keys is a key

package/dist/apiKeys/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/apiKeys/middleware.ts"],"names":[],"mappings":";;;;;;AACA,gEAA+B;AAC/B,uCAA2C;AAC3C,+DAAuC;AAEvC,qCAA2C;AAC3C,uCAAyC;AAuBzC,+DAA+D;AAC/D,MAAM,YAAY,GAAG,CAAC,GAAY,EAAsB,EAAE,CACxD,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAEjF,MAAM,YAAY,GAAG,CAAC,GAAa,EAAQ,EAAE;IAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;AACtF,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAAsB,EAAE;IAC5D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC;IACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5E,MAAM,QAAQ,GAAI,GAAG,CAAC,IAA4C,EAAE,OAAO,CAAC;IAC5E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEzE,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG,CAAC,GAAY,EAAE,OAAsB,EAAW,EAAE;IACvE,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAEnE,IAAI,OAAO,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAChD,+EAA+E;QAC/E,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE;YAClC,KAAK,EAAE,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE;YAChC,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAgC,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACI,MAAM,iBAAiB,GAAG,CAAC,GAAG,cAA6B,EAAkB,EAAE,CACpF,KAAK,UAAU,wBAAwB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACrF,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAA,wBAAe,EAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAgB,CAAC;YACxE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACnC,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,sBAAY,EAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,yEAAyE;QACzE,+DAA+D;QAC/D,gBAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACpE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;IACvC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,wDAAwD;SAClE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,GAAG;QACT,EAAE,EAAE,MAAM,CAAC,MAAO;QAClB,KAAK,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;KAC5B,CAAC;IACF,yEAAyE;IACzE,yEAAyE;IACzE,iEAAiE;IACjE,GAAG,CAAC,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,GAAG,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAEvD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AA5DS,QAAA,iBAAiB,qBA4D1B;AAEJ;;;;;;;;;;GAUG;AACI,MAAM,YAAY,GAAG,CAAC,GAAG,cAA6B,EAAkB,EAAE,CAC/E,SAAS,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;IACzC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACpE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAjBS,QAAA,YAAY,gBAiBrB;AAEJ;;;;;;GAMG;AACI,MAAM,WAAW,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC5D,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AATW,QAAA,WAAW,eAStB"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/apiKeys/middleware.ts"],"names":[],"mappings":";;;;;;AACA,gEAA+B;AAC/B,uCAA2C;AAC3C,+DAAuC;AACvC,4CAA8E;AAE9E,qCAA2C;AAC3C,uCAAyC;AACzC,mCAA0D;AAsB1D,+DAA+D;AAC/D,MAAM,YAAY,GAAG,CAAC,GAAY,EAAsB,EAAE,CACxD,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAEjF,MAAM,YAAY,GAAG,CAAC,GAAa,EAAQ,EAAE;IAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;AACtF,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAAsB,EAAE;IAC5D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC;IACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5E,MAAM,QAAQ,GAAI,GAAG,CAAC,IAA4C,EAAE,OAAO,CAAC;IAC5E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEzE,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG,CAAC,GAAY,EAAE,OAAsB,EAAW,EAAE;IACvE,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAEnE,IAAI,OAAO,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAChD,+EAA+E;QAC/E,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE;YAClC,KAAK,EAAE,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE;YAChC,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAgC,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAaF;;;;;;;;GAQG;AACH,SAAS,UAAU,CACjB,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,cAA6B,EAC7B,UAA2B;IAE3B,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACvE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,2DAA2D;SACrE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IACrF,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,GAAG,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;IAExG,IAAI,EAAE,CAAC;AACT,CAAC;AAED;;;;;;;;;;;GAWG;AACI,MAAM,iBAAiB,GAAG,CAAC,GAAG,cAA6B,EAAkB,EAAE,CACpF,KAAK,UAAU,wBAAwB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACrF,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAA,wBAAe,EAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,MAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAoC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAA,4BAAmB,EAAC,MAAM,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAqB,CAAC;YACnC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACnC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,6CAA6C;QAC7C,EAAE;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,sEAAsE;QACtE,yEAAyE;QACzE,sCAAsC;QACtC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE;YACzC,YAAY,EAAE,MAAM,CAAC,GAAG;YACxB,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,qBAAa,CAAC;YAC7D,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;SAChC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,sBAAY,EAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,yEAAyE;QACzE,+DAA+D;QAC/D,gBAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE;QACzC,YAAY,EAAE,MAAM,CAAC,KAAM;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAO;QACtB,KAAK,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;KAChC,CAAC,CAAC;AACL,CAAC,CAAC;AA/DS,QAAA,iBAAiB,qBA+D1B;AAEJ;;;;;;;;;;;;GAYG;AACI,MAAM,YAAY,GAAG,CAAC,GAAG,cAA6B,EAAkB,EAAE,CAC/E,SAAS,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;IACzC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACvE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAjBS,QAAA,YAAY,gBAiBrB;AAEJ;;;;;;GAMG;AACI,MAAM,WAAW,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC5D,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AATW,QAAA,WAAW,eAStB"}

package/dist/middleware/authMiddleware.d.ts

@@ -4,6 +4,13 @@ import { Request, Response, NextFunction } from 'express';
  * Verifies JWT token and attaches user info (and its embedded groups) to
  * the request — typed via the global `Express.Request` augmentation in
  * `../types/auth`, no `(req as any)` cast needed.
+ *
+ * OAuth access tokens are refused outright. They are signed with the same
+ * secret, so they verify here, but they mean something this middleware has no
+ * way to honour: an assistant acting within scopes, pinned to one tenant.
+ * Routes that software may legitimately reach use `authenticateAgent`, which
+ * enforces both — so anything still guarded by this one is a person's to do,
+ * and letting a token through would be handing an assistant the account.
  */
 export declare function authenticateToken(req: Request, res: Response, next: NextFunction): void;
 /**

package/dist/middleware/authMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authMiddleware.d.ts","sourceRoot":"","sources":["../../src/middleware/authMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAK1D;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAiBvF;AACD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAcnF"}
+{"version":3,"file":"authMiddleware.d.ts","sourceRoot":"","sources":["../../src/middleware/authMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAM1D;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CA0BvF;AACD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAmBnF"}

package/dist/middleware/authMiddleware.js

@@ -7,11 +7,19 @@ exports.authenticateToken = authenticateToken;
 exports.optionalAuth = optionalAuth;
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const env_1 = require("../config/env");
+const tokens_1 = require("../oauth/tokens");
 /**
  * JWT authentication middleware
  * Verifies JWT token and attaches user info (and its embedded groups) to
  * the request — typed via the global `Express.Request` augmentation in
  * `../types/auth`, no `(req as any)` cast needed.
+ *
+ * OAuth access tokens are refused outright. They are signed with the same
+ * secret, so they verify here, but they mean something this middleware has no
+ * way to honour: an assistant acting within scopes, pinned to one tenant.
+ * Routes that software may legitimately reach use `authenticateAgent`, which
+ * enforces both — so anything still guarded by this one is a person's to do,
+ * and letting a token through would be handing an assistant the account.
  */
 function authenticateToken(req, res, next) {
     try {
@@ -21,7 +29,15 @@ function authenticateToken(req, res, next) {
             res.status(401).json({ success: false, message: 'Access token required' });
             return;
         }
-        const user = jsonwebtoken_1.default.verify(token, JWT_SECRET);
+        const claims = jsonwebtoken_1.default.verify(token, JWT_SECRET);
+        if ((0, tokens_1.isAccessTokenClaims)(claims)) {
+            res.status(403).json({
+                success: false,
+                message: 'This operation requires an interactive session, not a connected assistant'
+            });
+            return;
+        }
+        const user = claims;
         req.user = user;
         req.userGroups = user.groups ?? [];
         next();
@@ -48,9 +64,14 @@ function optionalAuth(req, _res, next) {
         const JWT_SECRET = (0, env_1.requireEnv)('JWT_SECRET');
         const token = req.cookies?.access_token || req.headers.authorization?.replace('Bearer ', '');
         if (token) {
-            const user = jsonwebtoken_1.default.verify(token, JWT_SECRET);
-            req.user = user;
-            req.userGroups = user.groups ?? [];
+            const claims = jsonwebtoken_1.default.verify(token, JWT_SECRET);
+            // An access token is not a session; treated as none, exactly like an
+            // expired cookie, so the route still answers with its public form.
+            if (!(0, tokens_1.isAccessTokenClaims)(claims)) {
+                const user = claims;
+                req.user = user;
+                req.userGroups = user.groups ?? [];
+            }
         }
     }
     catch {

package/dist/middleware/authMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"authMiddleware.js","sourceRoot":"","sources":["../../src/middleware/authMiddleware.ts"],"names":[],"mappings":";;;;;AAWA,8CAiBC;AAcD,oCAcC;AAvDD,gEAA+B;AAC/B,uCAA2C;AAG3C;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC/E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7F,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAgB,CAAC;QAC1D,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AACD;;;;;;;;;;;;GAYG;AACH,SAAgB,YAAY,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IAC3E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7F,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAgB,CAAC;YAC1D,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC"}
+{"version":3,"file":"authMiddleware.js","sourceRoot":"","sources":["../../src/middleware/authMiddleware.ts"],"names":[],"mappings":";;;;;AAmBA,8CA0BC;AAcD,oCAmBC;AA7ED,gEAA+B;AAC/B,uCAA2C;AAC3C,4CAAsD;AAGtD;;;;;;;;;;;;GAYG;AACH,SAAgB,iBAAiB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC/E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7F,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,IAAA,4BAAmB,EAAC,MAAM,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,2EAA2E;aACrF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAqB,CAAC;QACnC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AACD;;;;;;;;;;;;GAYG;AACH,SAAgB,YAAY,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IAC3E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7F,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC7C,qEAAqE;YACrE,mEAAmE;YACnE,IAAI,CAAC,IAAA,4BAAmB,EAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAqB,CAAC;gBACnC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/oauth/index.d.ts

@@ -2,6 +2,6 @@ export { OAuthClient, AuthorizationCode, RefreshToken } from './models';
 export type { IOAuthClient, IAuthorizationCode, IRefreshToken } from './models';
 export { registerClient, findClient, isRegisteredRedirect, issueAuthorizationCode, redeemAuthorizationCode, issueRefreshToken, redeemRefreshToken, revokeRefreshTokensForUser, listConnections } from './service';
 export type { RegisterClientInput, RegisteredClient, IssueCodeInput, CodeRedemption, CodeRejection, RefreshRedemption } from './service';
-export { mintAccessToken, verifyAccessToken, parseScopes } from './tokens';
+export { mintAccessToken, verifyAccessToken, parseScopes, isAccessTokenClaims, ACCESS_TOKEN_TYPE } from './tokens';
 export type { AccessTokenClaims, MintAccessTokenInput, MintedAccessToken, AccessTokenVerification } from './tokens';
 //# sourceMappingURL=index.d.ts.map

package/dist/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAChF,OAAO,EACL,cAAc,EACd,UAAU,EACV,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,0BAA0B,EAC1B,eAAe,EAChB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,aAAa,EACb,iBAAiB,EAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC3E,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAChF,OAAO,EACL,cAAc,EACd,UAAU,EACV,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,0BAA0B,EAC1B,eAAe,EAChB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,aAAa,EACb,iBAAiB,EAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC"}

package/dist/oauth/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseScopes = exports.verifyAccessToken = exports.mintAccessToken = exports.listConnections = exports.revokeRefreshTokensForUser = exports.redeemRefreshToken = exports.issueRefreshToken = exports.redeemAuthorizationCode = exports.issueAuthorizationCode = exports.isRegisteredRedirect = exports.findClient = exports.registerClient = exports.RefreshToken = exports.AuthorizationCode = exports.OAuthClient = void 0;
+exports.ACCESS_TOKEN_TYPE = exports.isAccessTokenClaims = exports.parseScopes = exports.verifyAccessToken = exports.mintAccessToken = exports.listConnections = exports.revokeRefreshTokensForUser = exports.redeemRefreshToken = exports.issueRefreshToken = exports.redeemAuthorizationCode = exports.issueAuthorizationCode = exports.isRegisteredRedirect = exports.findClient = exports.registerClient = exports.RefreshToken = exports.AuthorizationCode = exports.OAuthClient = void 0;
 var models_1 = require("./models");
 Object.defineProperty(exports, "OAuthClient", { enumerable: true, get: function () { return models_1.OAuthClient; } });
 Object.defineProperty(exports, "AuthorizationCode", { enumerable: true, get: function () { return models_1.AuthorizationCode; } });
@@ -19,4 +19,6 @@ var tokens_1 = require("./tokens");
 Object.defineProperty(exports, "mintAccessToken", { enumerable: true, get: function () { return tokens_1.mintAccessToken; } });
 Object.defineProperty(exports, "verifyAccessToken", { enumerable: true, get: function () { return tokens_1.verifyAccessToken; } });
 Object.defineProperty(exports, "parseScopes", { enumerable: true, get: function () { return tokens_1.parseScopes; } });
+Object.defineProperty(exports, "isAccessTokenClaims", { enumerable: true, get: function () { return tokens_1.isAccessTokenClaims; } });
+Object.defineProperty(exports, "ACCESS_TOKEN_TYPE", { enumerable: true, get: function () { return tokens_1.ACCESS_TOKEN_TYPE; } });
 //# sourceMappingURL=index.js.map

package/dist/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":";;;AAAA,mCAAwE;AAA/D,qGAAA,WAAW,OAAA;AAAE,2GAAA,iBAAiB,OAAA;AAAE,sGAAA,YAAY,OAAA;AAErD,qCAUmB;AATjB,yGAAA,cAAc,OAAA;AACd,qGAAA,UAAU,OAAA;AACV,+GAAA,oBAAoB,OAAA;AACpB,iHAAA,sBAAsB,OAAA;AACtB,kHAAA,uBAAuB,OAAA;AACvB,4GAAA,iBAAiB,OAAA;AACjB,6GAAA,kBAAkB,OAAA;AAClB,qHAAA,0BAA0B,OAAA;AAC1B,0GAAA,eAAe,OAAA;AAUjB,mCAA2E;AAAlE,yGAAA,eAAe,OAAA;AAAE,2GAAA,iBAAiB,OAAA;AAAE,qGAAA,WAAW,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":";;;AAAA,mCAAwE;AAA/D,qGAAA,WAAW,OAAA;AAAE,2GAAA,iBAAiB,OAAA;AAAE,sGAAA,YAAY,OAAA;AAErD,qCAUmB;AATjB,yGAAA,cAAc,OAAA;AACd,qGAAA,UAAU,OAAA;AACV,+GAAA,oBAAoB,OAAA;AACpB,iHAAA,sBAAsB,OAAA;AACtB,kHAAA,uBAAuB,OAAA;AACvB,4GAAA,iBAAiB,OAAA;AACjB,6GAAA,kBAAkB,OAAA;AAClB,qHAAA,0BAA0B,OAAA;AAC1B,0GAAA,eAAe,OAAA;AAUjB,mCAMkB;AALhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,qGAAA,WAAW,OAAA;AACX,6GAAA,mBAAmB,OAAA;AACnB,2GAAA,iBAAiB,OAAA"}

package/dist/oauth/tokens.d.ts

@@ -10,7 +10,7 @@ import { type ApiKeyScope } from '../apiKeys/types';
  * token, which is the thing that actually persists.
  */
 /** Marks a token as issued by the OAuth flow, for the MCP resource specifically. */
-declare const TOKEN_TYPE = "mcp_access";
+export declare const ACCESS_TOKEN_TYPE = "mcp_access";
 export interface AccessTokenClaims {
     /** the user the assistant is acting for */
     sub: string;
@@ -22,7 +22,7 @@ export interface AccessTokenClaims {
     groupId: string | null;
     email: string;
     name: string;
-    typ: typeof TOKEN_TYPE;
+    typ: typeof ACCESS_TOKEN_TYPE;
     jti: string;
     exp: number;
     iat: number;
@@ -63,7 +63,16 @@ export interface AccessTokenVerification {
  * pin — cannot be presented as an access token and quietly get everything.
  */
 export declare const verifyAccessToken: (token: string, expectedAudience: string) => AccessTokenVerification;
+/**
+ * Tell an OAuth access token apart from an ordinary session JWT.
+ *
+ * They are signed with the same secret and arrive in the same header, so
+ * anything holding one has to ask which it got. Getting this wrong is not a
+ * subtle failure: read as a session, an access token has no `id` and no
+ * `groups`, so `req.user.id` lands as `undefined` and every scoped query goes
+ * out unbounded.
+ */
+export declare const isAccessTokenClaims: (claims: unknown) => claims is AccessTokenClaims;
 /** Parse a space-separated `scope` parameter, dropping anything we do not define. */
 export declare const parseScopes: (scope: unknown) => ApiKeyScope[];
-export {};
 //# sourceMappingURL=tokens.d.ts.map

package/dist/oauth/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/oauth/tokens.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEnE;;;;;;;;;GASG;AAEH,oFAAoF;AACpF,QAAA,MAAM,UAAU,eAAe,CAAC;AAKhC,MAAM,WAAW,iBAAiB;IAChC,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,OAAO,UAAU,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,eAAe,GAAI,OAAO,oBAAoB,KAAG,iBAoB7D,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,CAAC,EAAE,WAAW,GAAG,SAAS,GAAG,gBAAgB,GAAG,YAAY,GAAG,eAAe,CAAC;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAC5B,OAAO,MAAM,EACb,kBAAkB,MAAM,KACvB,uBAqBF,CAAC;AAEF,qFAAqF;AACrF,eAAO,MAAM,WAAW,GAAI,OAAO,OAAO,KAAG,WAAW,EACmB,CAAC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/oauth/tokens.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEnE;;;;;;;;;GASG;AAEH,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAK9C,MAAM,WAAW,iBAAiB;IAChC,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,OAAO,iBAAiB,CAAC;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,eAAe,GAAI,OAAO,oBAAoB,KAAG,iBAoB7D,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,CAAC,EAAE,WAAW,GAAG,SAAS,GAAG,gBAAgB,GAAG,YAAY,GAAG,eAAe,CAAC;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAC5B,OAAO,MAAM,EACb,kBAAkB,MAAM,KACvB,uBAqBF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,QAAQ,OAAO,KAAG,MAAM,IAAI,iBAGP,CAAC;AAE1D,qFAAqF;AACrF,eAAO,MAAM,WAAW,GAAI,OAAO,OAAO,KAAG,WAAW,EACmB,CAAC"}

package/dist/oauth/tokens.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseScopes = exports.verifyAccessToken = exports.mintAccessToken = void 0;
+exports.parseScopes = exports.isAccessTokenClaims = exports.verifyAccessToken = exports.mintAccessToken = exports.ACCESS_TOKEN_TYPE = void 0;
 const crypto_1 = require("crypto");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const env_1 = require("../config/env");
@@ -19,7 +19,7 @@ const types_1 = require("../apiKeys/types");
  * token, which is the thing that actually persists.
  */
 /** Marks a token as issued by the OAuth flow, for the MCP resource specifically. */
-const TOKEN_TYPE = 'mcp_access';
+exports.ACCESS_TOKEN_TYPE = 'mcp_access';
 /** Short enough that a leaked token is a small window, long enough to be usable. */
 const ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
 const mintAccessToken = (input) => {
@@ -32,7 +32,7 @@ const mintAccessToken = (input) => {
         groupId: input.groupId,
         email: input.email,
         name: input.name,
-        typ: TOKEN_TYPE,
+        typ: exports.ACCESS_TOKEN_TYPE,
         jti: (0, crypto_1.randomUUID)()
     }, (0, env_1.requireEnv)('JWT_SECRET'), { expiresIn: ACCESS_TOKEN_TTL_SECONDS });
     return { accessToken, expiresIn: ACCESS_TOKEN_TTL_SECONDS, scope };
@@ -57,7 +57,7 @@ const verifyAccessToken = (token, expectedAudience) => {
         const expired = error?.name === 'TokenExpiredError';
         return { ok: false, rejection: expired ? 'expired' : 'bad-signature' };
     }
-    if (claims.typ !== TOKEN_TYPE)
+    if (!(0, exports.isAccessTokenClaims)(claims))
         return { ok: false, rejection: 'wrong-type' };
     if (claims.aud !== expectedAudience)
         return { ok: false, rejection: 'wrong-audience' };
@@ -73,6 +73,19 @@ const verifyAccessToken = (token, expectedAudience) => {
     };
 };
 exports.verifyAccessToken = verifyAccessToken;
+/**
+ * Tell an OAuth access token apart from an ordinary session JWT.
+ *
+ * They are signed with the same secret and arrive in the same header, so
+ * anything holding one has to ask which it got. Getting this wrong is not a
+ * subtle failure: read as a session, an access token has no `id` and no
+ * `groups`, so `req.user.id` lands as `undefined` and every scoped query goes
+ * out unbounded.
+ */
+const isAccessTokenClaims = (claims) => typeof claims === 'object' &&
+    claims !== null &&
+    claims.typ === exports.ACCESS_TOKEN_TYPE;
+exports.isAccessTokenClaims = isAccessTokenClaims;
 /** Parse a space-separated `scope` parameter, dropping anything we do not define. */
 const parseScopes = (scope) => typeof scope === 'string' ? scope.split(/\s+/).filter(types_1.isApiKeyScope) : [];
 exports.parseScopes = parseScopes;

package/dist/oauth/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/oauth/tokens.ts"],"names":[],"mappings":";;;;;;AAAA,mCAAoC;AACpC,gEAA+B;AAC/B,uCAA2C;AAC3C,4CAAmE;AAEnE;;;;;;;;;GASG;AAEH,oFAAoF;AACpF,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC,oFAAoF;AACpF,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAoClC,MAAM,eAAe,GAAG,CAAC,KAA2B,EAAqB,EAAE;IAChF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAErC,MAAM,WAAW,GAAG,sBAAG,CAAC,IAAI,CAC1B;QACE,GAAG,EAAE,KAAK,CAAC,MAAM;QACjB,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,GAAG,EAAE,KAAK,CAAC,MAAM;QACjB,KAAK;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,IAAA,mBAAU,GAAE;KAClB,EACD,IAAA,gBAAU,EAAC,YAAY,CAAC,EACxB,EAAE,SAAS,EAAE,wBAAwB,EAAE,CACxC,CAAC;IAEF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;AACrE,CAAC,CAAC;AApBW,QAAA,eAAe,mBAoB1B;AAYF;;;;;;;;;GASG;AACI,MAAM,iBAAiB,GAAG,CAC/B,KAAa,EACb,gBAAwB,EACC,EAAE;IAC3B,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAsB,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAI,KAAe,EAAE,IAAI,KAAK,mBAAmB,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;IACzE,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IAC7E,IAAI,MAAM,CAAC,GAAG,KAAK,gBAAgB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;IACvF,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAE9D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;QACvB,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,qBAAa,CAAC;QAC7D,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;KAChC,CAAC;AACJ,CAAC,CAAC;AAxBW,QAAA,iBAAiB,qBAwB5B;AAEF,qFAAqF;AAC9E,MAAM,WAAW,GAAG,CAAC,KAAc,EAAiB,EAAE,CAC3D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,qBAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAD/D,QAAA,WAAW,eACoD"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/oauth/tokens.ts"],"names":[],"mappings":";;;;;;AAAA,mCAAoC;AACpC,gEAA+B;AAC/B,uCAA2C;AAC3C,4CAAmE;AAEnE;;;;;;;;;GASG;AAEH,oFAAoF;AACvE,QAAA,iBAAiB,GAAG,YAAY,CAAC;AAE9C,oFAAoF;AACpF,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAoClC,MAAM,eAAe,GAAG,CAAC,KAA2B,EAAqB,EAAE;IAChF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAErC,MAAM,WAAW,GAAG,sBAAG,CAAC,IAAI,CAC1B;QACE,GAAG,EAAE,KAAK,CAAC,MAAM;QACjB,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,GAAG,EAAE,KAAK,CAAC,MAAM;QACjB,KAAK;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,EAAE,yBAAiB;QACtB,GAAG,EAAE,IAAA,mBAAU,GAAE;KAClB,EACD,IAAA,gBAAU,EAAC,YAAY,CAAC,EACxB,EAAE,SAAS,EAAE,wBAAwB,EAAE,CACxC,CAAC;IAEF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;AACrE,CAAC,CAAC;AApBW,QAAA,eAAe,mBAoB1B;AAYF;;;;;;;;;GASG;AACI,MAAM,iBAAiB,GAAG,CAC/B,KAAa,EACb,gBAAwB,EACC,EAAE;IAC3B,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAsB,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAI,KAAe,EAAE,IAAI,KAAK,mBAAmB,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,IAAA,2BAAmB,EAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IAChF,IAAI,MAAM,CAAC,GAAG,KAAK,gBAAgB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;IACvF,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAE9D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;QACvB,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,qBAAa,CAAC;QAC7D,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;KAChC,CAAC;AACJ,CAAC,CAAC;AAxBW,QAAA,iBAAiB,qBAwB5B;AAEF;;;;;;;;GAQG;AACI,MAAM,mBAAmB,GAAG,CAAC,MAAe,EAA+B,EAAE,CAClF,OAAO,MAAM,KAAK,QAAQ;IAC1B,MAAM,KAAK,IAAI;IACd,MAA4B,CAAC,GAAG,KAAK,yBAAiB,CAAC;AAH7C,QAAA,mBAAmB,uBAG0B;AAE1D,qFAAqF;AAC9E,MAAM,WAAW,GAAG,CAAC,KAAc,EAAiB,EAAE,CAC3D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,qBAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAD/D,QAAA,WAAW,eACoD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tumbaland/backend-core",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "description": "Core shared functionality for Tumbaland backend services",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/apiKeys/middleware.test.ts

@@ -8,6 +8,7 @@ jest.mock('../logging/logger', () => ({
 
 import jwt from 'jsonwebtoken';
 import { verifyApiKey } from './service';
+import { mintAccessToken, type MintAccessTokenInput } from '../oauth/tokens';
 import { authenticateAgent, requireScope, denyApiKeys } from './middleware';
 
 const mockedVerify = verifyApiKey as jest.Mock;
@@ -351,3 +352,110 @@ describe('denyApiKeys', () => {
     expect(next).not.toHaveBeenCalled();
   });
 });
+
+describe('authenticateAgent — OAuth access tokens', () => {
+  /**
+   * Minted by the real thing rather than hand-signed. The bug this covers was
+   * that an access token verified as a session — same secret, same header — and
+   * its claims were then read as a session's: `sub` instead of `id`, no
+   * `groups`. Every one of those details has to come from the code that issues
+   * them, or the test simply re-encodes whatever the middleware happens to do.
+   */
+  const mint = (over: Partial<MintAccessTokenInput> = {}) =>
+    mintAccessToken({
+      userId: 'u1',
+      email: 'u1@example.com',
+      name: 'Tester',
+      resource: 'https://mcp.example.com',
+      issuer: 'https://auth.example.com',
+      scopes: ['relationship:read', 'relationship:write'],
+      groupId: null,
+      ...over
+    }).accessToken;
+
+  const withToken = (token: string, over: Partial<Request> = {}) =>
+    req({ headers: { authorization: `Bearer ${token}` }, ...over });
+
+  it('names the user, so scoped queries are bounded', async () => {
+    const request = withToken(mint());
+    const next = jest.fn();
+
+    await authenticateAgent('relationship:write')(request, mockRes(), next);
+
+    expect(next).toHaveBeenCalled();
+    // Read as a session this was `undefined`, which reached handlers as "no
+    // user" rather than as a refusal: writes were rejected as inaccessible and
+    // reads fell through to an unscoped query.
+    expect(request.user?.id).toBe('u1');
+    expect(request.user?.email).toBe('u1@example.com');
+  });
+
+  it('is held to its scopes, exactly as a key is', async () => {
+    const res = mockRes();
+    const next = jest.fn();
+    const request = withToken(mint({ scopes: ['relationship:read'] }));
+
+    await authenticateAgent('relationship:write')(request, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('carries an apiKey context, so requireScope applies downstream', async () => {
+    const request = withToken(mint({ scopes: ['relationship:read'] }));
+
+    await authenticateAgent()(request, mockRes(), jest.fn());
+
+    // Without this the token looked like a session and every requireScope on
+    // every route waved it through.
+    expect(request.apiKey?.scopes).toEqual(['relationship:read']);
+
+    const res = mockRes();
+    const next = jest.fn();
+    requireScope('relationship:write')(request, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('is pinned to the tenant chosen at consent', async () => {
+    const request = withToken(mint({ groupId: 'g1' }));
+    const next = jest.fn();
+
+    await authenticateAgent()(request, mockRes(), next);
+
+    expect(next).toHaveBeenCalled();
+    expect(request.userGroups).toEqual(['g1']);
+    // Written in for a caller that named none, so a handler's group branch
+    // lands where the person who approved the connection intended.
+    expect(request.query.groupId).toBe('g1');
+  });
+
+  it('refuses a request naming a different tenant', async () => {
+    const res = mockRes();
+    const next = jest.fn();
+    const request = withToken(mint({ groupId: 'g1' }), { query: { groupId: 'g2' } });
+
+    await authenticateAgent()(request, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('is refused by denyApiKeys, like any other credential software holds', async () => {
+    const request = withToken(mint());
+    await authenticateAgent()(request, mockRes(), jest.fn());
+
+    const res = mockRes();
+    const next = jest.fn();
+    denyApiKeys(request, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('never consults the API key store', async () => {
+    await authenticateAgent()(withToken(mint()), mockRes(), jest.fn());
+    expect(mockedVerify).not.toHaveBeenCalled();
+  });
+});

package/src/apiKeys/middleware.ts

@@ -2,10 +2,11 @@ import { NextFunction, Request, RequestHandler, Response } from 'express';
 import jwt from 'jsonwebtoken';
 import { requireEnv } from '../config/env';
 import logger from '../logging/logger';
+import { isAccessTokenClaims, type AccessTokenClaims } from '../oauth/tokens';
 import type { UserPayload } from '../types/auth';
 import { looksLikeApiKey } from './crypto';
 import { verifyApiKey } from './service';
-import type { ApiKeyScope } from './types';
+import { isApiKeyScope, type ApiKeyScope } from './types';
 
 /**
  * Request-scoped facts about the key a request arrived on. Absent on ordinary
@@ -83,6 +84,60 @@ const applyTenantPin = (req: Request, groupId: string | null): boolean => {
   return true;
 };
 
+/** A verified non-session credential, whichever kind it arrived as. */
+interface AgentCredential {
+  /** the key id or token id, for the request-scoped context */
+  credentialId: string;
+  userId: string;
+  email: string;
+  name: string;
+  scopes: ApiKeyScope[];
+  groupId: string | null;
+}
+
+/**
+ * Admit software acting for a user, on the terms its credential carries.
+ *
+ * Shared by both non-session credentials on purpose. An API key and an OAuth
+ * access token differ entirely in how they are issued and verified, and not at
+ * all in what they mean once they are: a user, a set of scopes, and one tenant.
+ * Settling that in one place is what keeps the two from drifting into subtly
+ * different amounts of access.
+ */
+function admitAgent(
+  req: Request,
+  res: Response,
+  next: NextFunction,
+  requiredScopes: ApiKeyScope[],
+  credential: AgentCredential
+): void {
+  const missing = requiredScopes.filter((scope) => !credential.scopes.includes(scope));
+  if (missing.length > 0) {
+    res.status(403).json({
+      success: false,
+      message: `Credential is missing required scope: ${missing.join(', ')}`
+    });
+    return;
+  }
+
+  if (!applyTenantPin(req, credential.groupId)) {
+    res.status(403).json({
+      success: false,
+      message: 'Credential is not permitted to act in the requested group'
+    });
+    return;
+  }
+
+  req.user = { id: credential.userId, email: credential.email, name: credential.name };
+  // Only the pinned group, never the owner's full membership: this is what
+  // stops a credential reaching a group it was not issued for through any
+  // handler that consults `userGroups` instead of the `groupId` parameter.
+  req.userGroups = credential.groupId ? [credential.groupId] : [];
+  req.apiKey = { keyId: credential.credentialId, scopes: credential.scopes, groupId: credential.groupId };
+
+  next();
+}
+
 /**
  * Authenticate a request that software may legitimately be making.
  *
@@ -104,14 +159,40 @@ export const authenticateAgent = (...requiredScopes: ApiKeyScope[]): RequestHand
     }
 
     if (!looksLikeApiKey(token)) {
+      let claims: UserPayload | AccessTokenClaims;
       try {
-        const user = jwt.verify(token, requireEnv('JWT_SECRET')) as UserPayload;
+        claims = jwt.verify(token, requireEnv('JWT_SECRET')) as UserPayload | AccessTokenClaims;
+      } catch {
+        unauthorized(res);
+        return;
+      }
+
+      if (!isAccessTokenClaims(claims)) {
+        const user = claims as UserPayload;
         req.user = user;
         req.userGroups = user.groups ?? [];
         next();
-      } catch {
-        unauthorized(res);
+        return;
       }
+
+      // An OAuth access token: signed with the same secret as a session and
+      // arriving in the same header, but nothing like one. It names its user in
+      // `sub`, carries scopes, and is pinned to a tenant — so it is admitted
+      // the way a key is, not the way a person is.
+      //
+      // Reading it as a session was the original bug and it failed quietly: the
+      // claims have no `id` and no `groups`, so `req.user.id` arrived as
+      // `undefined`, scoped writes were refused as inaccessible, and a read
+      // whose scope collapsed to nothing fell through to "no user context" and
+      // answered from the whole collection.
+      admitAgent(req, res, next, requiredScopes, {
+        credentialId: claims.jti,
+        userId: claims.sub,
+        email: claims.email ?? '',
+        name: claims.name ?? '',
+        scopes: (claims.scope ?? '').split(' ').filter(isApiKeyScope),
+        groupId: claims.groupId ?? null
+      });
       return;
     }
 
@@ -124,37 +205,14 @@ export const authenticateAgent = (...requiredScopes: ApiKeyScope[]): RequestHand
       return;
     }
 
-    const scopes = result.scopes ?? [];
-    const missing = requiredScopes.filter((scope) => !scopes.includes(scope));
-    if (missing.length > 0) {
-      res.status(403).json({
-        success: false,
-        message: `API key is missing required scope: ${missing.join(', ')}`
-      });
-      return;
-    }
-
-    const groupId = result.groupId ?? null;
-    if (!applyTenantPin(req, groupId)) {
-      res.status(403).json({
-        success: false,
-        message: 'API key is not permitted to act in the requested group'
-      });
-      return;
-    }
-
-    req.user = {
-      id: result.userId!,
+    admitAgent(req, res, next, requiredScopes, {
+      credentialId: result.keyId!,
+      userId: result.userId!,
       email: result.userEmail ?? '',
-      name: result.userName ?? ''
-    };
-    // Only the pinned group, never the owner's full membership: this is what
-    // stops a key reaching a group it was not issued for through any handler
-    // that consults `userGroups` instead of the `groupId` parameter.
-    req.userGroups = groupId ? [groupId] : [];
-    req.apiKey = { keyId: result.keyId!, scopes, groupId };
-
-    next();
+      name: result.userName ?? '',
+      scopes: result.scopes ?? [],
+      groupId: result.groupId ?? null
+    });
   };
 
 /**
@@ -166,7 +224,9 @@ export const authenticateAgent = (...requiredScopes: ApiKeyScope[]): RequestHand
  * door for lacking a scope half the router never uses.
  *
  * A session passes unconditionally: scopes narrow what software may do on a
- * person's behalf, not what the person may do themselves.
+ * person's behalf, not what the person may do themselves. Everything that is
+ * not a session — an API key or an OAuth access token alike — arrives with
+ * `req.apiKey` set and is held to it.
  */
 export const requireScope = (...requiredScopes: ApiKeyScope[]): RequestHandler =>
   function requireScopeHandler(req, res, next) {
@@ -179,7 +239,7 @@ export const requireScope = (...requiredScopes: ApiKeyScope[]): RequestHandler =
     if (missing.length > 0) {
       res.status(403).json({
         success: false,
-        message: `API key is missing required scope: ${missing.join(', ')}`
+        message: `Credential is missing required scope: ${missing.join(', ')}`
       });
       return;
     }
@@ -188,7 +248,7 @@ export const requireScope = (...requiredScopes: ApiKeyScope[]): RequestHandler =
   };
 
 /**
- * Refuse API keys on a route that a session may still use.
+ * Refuse every non-session credential on a route that a session may still use.
  *
  * For the handful of operations that should stay a person's to perform — key
  * management itself, most obviously, since a key that can mint keys is a key

package/src/middleware/authMiddleware.test.ts

@@ -1,6 +1,7 @@
 import { Request, Response } from 'express';
 import jwt from 'jsonwebtoken';
 import { authenticateToken, optionalAuth } from './authMiddleware';
+import { mintAccessToken } from '../oauth/tokens';
 import { UserPayload } from '../types/auth';
 
 function mockReq(overrides: Partial<Request> = {}): Request {
@@ -171,3 +172,51 @@ describe('optionalAuth', () => {
     expect(res.status).not.toHaveBeenCalled();
   });
 });
+
+describe('OAuth access tokens are not sessions', () => {
+  const ORIGINAL_ENV = process.env;
+
+  beforeEach(() => {
+    process.env = { ...ORIGINAL_ENV, JWT_SECRET: 'test-secret' };
+  });
+
+  afterEach(() => {
+    process.env = ORIGINAL_ENV;
+  });
+
+  const accessToken = () =>
+    mintAccessToken({
+      userId: 'u1',
+      email: 'u1@example.com',
+      name: 'Tester',
+      resource: 'https://mcp.example.com',
+      issuer: 'https://auth.example.com',
+      scopes: ['relationship:read'],
+      groupId: null
+    }).accessToken;
+
+  it('refuses one on a session-only route', () => {
+    const res = mockRes();
+    const next = jest.fn();
+    const req = mockReq({ headers: { authorization: `Bearer ${accessToken()}` } });
+
+    // It verifies — same secret — so nothing but the type check stands between
+    // an assistant and every route that has no scopes to be held to.
+    authenticateToken(req, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(next).not.toHaveBeenCalled();
+    expect(req.user).toBeUndefined();
+  });
+
+  it('treats one as no session at all on an optional-auth route', () => {
+    const next = jest.fn();
+    const req = mockReq({ headers: { authorization: `Bearer ${accessToken()}` } });
+
+    optionalAuth(req, mockRes(), next);
+
+    // The route still answers, in its public form — the same as a stale cookie.
+    expect(next).toHaveBeenCalled();
+    expect(req.user).toBeUndefined();
+  });
+});

package/src/middleware/authMiddleware.ts

@@ -1,6 +1,7 @@
 import { Request, Response, NextFunction } from 'express';
 import jwt from 'jsonwebtoken';
 import { requireEnv } from '../config/env';
+import { isAccessTokenClaims } from '../oauth/tokens';
 import { UserPayload } from '../types/auth';
 
 /**
@@ -8,6 +9,13 @@ import { UserPayload } from '../types/auth';
  * Verifies JWT token and attaches user info (and its embedded groups) to
  * the request — typed via the global `Express.Request` augmentation in
  * `../types/auth`, no `(req as any)` cast needed.
+ *
+ * OAuth access tokens are refused outright. They are signed with the same
+ * secret, so they verify here, but they mean something this middleware has no
+ * way to honour: an assistant acting within scopes, pinned to one tenant.
+ * Routes that software may legitimately reach use `authenticateAgent`, which
+ * enforces both — so anything still guarded by this one is a person's to do,
+ * and letting a token through would be handing an assistant the account.
  */
 export function authenticateToken(req: Request, res: Response, next: NextFunction): void {
   try {
@@ -19,7 +27,16 @@ export function authenticateToken(req: Request, res: Response, next: NextFunctio
       return;
     }
 
-    const user = jwt.verify(token, JWT_SECRET) as UserPayload;
+    const claims = jwt.verify(token, JWT_SECRET);
+    if (isAccessTokenClaims(claims)) {
+      res.status(403).json({
+        success: false,
+        message: 'This operation requires an interactive session, not a connected assistant'
+      });
+      return;
+    }
+
+    const user = claims as UserPayload;
     req.user = user;
     req.userGroups = user.groups ?? [];
     next();
@@ -46,9 +63,14 @@ export function optionalAuth(req: Request, _res: Response, next: NextFunction):
     const token = req.cookies?.access_token || req.headers.authorization?.replace('Bearer ', '');
 
     if (token) {
-      const user = jwt.verify(token, JWT_SECRET) as UserPayload;
-      req.user = user;
-      req.userGroups = user.groups ?? [];
+      const claims = jwt.verify(token, JWT_SECRET);
+      // An access token is not a session; treated as none, exactly like an
+      // expired cookie, so the route still answers with its public form.
+      if (!isAccessTokenClaims(claims)) {
+        const user = claims as UserPayload;
+        req.user = user;
+        req.userGroups = user.groups ?? [];
+      }
     }
   } catch {
     // Deliberately ignored — see above.

package/src/oauth/index.ts

@@ -19,5 +19,11 @@ export type {
   CodeRejection,
   RefreshRedemption
 } from './service';
-export { mintAccessToken, verifyAccessToken, parseScopes } from './tokens';
+export {
+  mintAccessToken,
+  verifyAccessToken,
+  parseScopes,
+  isAccessTokenClaims,
+  ACCESS_TOKEN_TYPE
+} from './tokens';
 export type { AccessTokenClaims, MintAccessTokenInput, MintedAccessToken, AccessTokenVerification } from './tokens';

package/src/oauth/tokens.ts

@@ -15,7 +15,7 @@ import { isApiKeyScope, type ApiKeyScope } from '../apiKeys/types';
  */
 
 /** Marks a token as issued by the OAuth flow, for the MCP resource specifically. */
-const TOKEN_TYPE = 'mcp_access';
+export const ACCESS_TOKEN_TYPE = 'mcp_access';
 
 /** Short enough that a leaked token is a small window, long enough to be usable. */
 const ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
@@ -31,7 +31,7 @@ export interface AccessTokenClaims {
   groupId: string | null;
   email: string;
   name: string;
-  typ: typeof TOKEN_TYPE;
+  typ: typeof ACCESS_TOKEN_TYPE;
   jti: string;
   exp: number;
   iat: number;
@@ -66,7 +66,7 @@ export const mintAccessToken = (input: MintAccessTokenInput): MintedAccessToken
       groupId: input.groupId,
       email: input.email,
       name: input.name,
-      typ: TOKEN_TYPE,
+      typ: ACCESS_TOKEN_TYPE,
       jti: randomUUID()
     },
     requireEnv('JWT_SECRET'),
@@ -108,7 +108,7 @@ export const verifyAccessToken = (
     return { ok: false, rejection: expired ? 'expired' : 'bad-signature' };
   }
 
-  if (claims.typ !== TOKEN_TYPE) return { ok: false, rejection: 'wrong-type' };
+  if (!isAccessTokenClaims(claims)) return { ok: false, rejection: 'wrong-type' };
   if (claims.aud !== expectedAudience) return { ok: false, rejection: 'wrong-audience' };
   if (!claims.sub) return { ok: false, rejection: 'malformed' };
 
@@ -122,6 +122,20 @@ export const verifyAccessToken = (
   };
 };
 
+/**
+ * Tell an OAuth access token apart from an ordinary session JWT.
+ *
+ * They are signed with the same secret and arrive in the same header, so
+ * anything holding one has to ask which it got. Getting this wrong is not a
+ * subtle failure: read as a session, an access token has no `id` and no
+ * `groups`, so `req.user.id` lands as `undefined` and every scoped query goes
+ * out unbounded.
+ */
+export const isAccessTokenClaims = (claims: unknown): claims is AccessTokenClaims =>
+  typeof claims === 'object' &&
+  claims !== null &&
+  (claims as AccessTokenClaims).typ === ACCESS_TOKEN_TYPE;
+
 /** Parse a space-separated `scope` parameter, dropping anything we do not define. */
 export const parseScopes = (scope: unknown): ApiKeyScope[] =>
   typeof scope === 'string' ? scope.split(/\s+/).filter(isApiKeyScope) : [];