@udibo/oauth2 0.14.0 → 0.15.0

package/{esm → dist}/testing/services.d.ts

@@ -25,17 +25,17 @@
  *
  * @module
  */
-import type { ClientInterface } from "../models/client.js";
-import type { AuthorizationCode } from "../models/authorization-code.js";
-import type { RefreshToken, Token } from "../models/token.js";
-import type { DeviceAuthorization } from "../models/device-authorization.js";
-import type { AbstractScope, BasicScope } from "../models/scope.js";
-import type { AuthorizationCodeServiceInterface } from "../server/services/authorization-code.js";
-import type { ClientServiceInterface } from "../server/services/client.js";
-import type { DeviceAuthorizationServiceInterface } from "../server/services/device-authorization.js";
-import type { TokenServiceInterface } from "../server/services/token.js";
-import type { UserServiceInterface } from "../server/services/user.js";
-import { type PasswordCredential, type PasswordHasherLike } from "../identity/password.js";
+import type { ClientInterface } from "../models/client.ts";
+import type { AuthorizationCode } from "../models/authorization-code.ts";
+import type { RefreshToken, Token } from "../models/token.ts";
+import type { DeviceAuthorization } from "../models/device-authorization.ts";
+import type { AbstractScope, BasicScope } from "../models/scope.ts";
+import type { AuthorizationCodeServiceInterface } from "../server/services/authorization-code.ts";
+import type { ClientServiceInterface } from "../server/services/client.ts";
+import type { DeviceAuthorizationServiceInterface } from "../server/services/device-authorization.ts";
+import type { TokenServiceInterface } from "../server/services/token.ts";
+import type { UserServiceInterface } from "../server/services/user.ts";
+import { type PasswordCredential, type PasswordHasherLike } from "../identity/password.ts";
 /** Options for {@link MemoryUserService}. */
 export interface MemoryUserServiceOptions {
     /**

package/{esm → dist}/testing/services.js

@@ -42,8 +42,9 @@ export class MemoryUserService {
     #passwords;
     /** Applies the password-hasher default; construct with no arguments for it. */
     constructor(options = {}) {
-        this.#passwords = options.passwords ??
-            new PasswordIdentityService({ iterations: FIXTURE_PBKDF2_ITERATIONS });
+        this.#passwords =
+            options.passwords ??
+                new PasswordIdentityService({ iterations: FIXTURE_PBKDF2_ITERATIONS });
     }
     /** Adds a user with the given password. Throws on duplicate id or username. */
     async add(user, password) {
@@ -73,7 +74,7 @@ export class MemoryUserService {
         const credential = this.#credentialsByUserId.get(user.id);
         if (!credential)
             return undefined;
-        return await this.#passwords.verify(password, credential)
+        return (await this.#passwords.verify(password, credential))
             ? user
             : undefined;
     }
@@ -163,7 +164,7 @@ export class MemoryClientService {
             return secret ? undefined : client;
         if (!secret)
             return undefined;
-        if (await sha256Hash(secret) !== storedHash)
+        if ((await sha256Hash(secret)) !== storedHash)
             return undefined;
         return client;
     }
@@ -216,8 +217,8 @@ export class MemoryTokenService {
         this.#clientService = options.clientService;
         this.#userService = options.userService;
         this.accessTokenLifetime = options.accessTokenLifetime ?? 60 * 60;
-        this.refreshTokenLifetime = options.refreshTokenLifetime ??
-            14 * 24 * 60 * 60;
+        this.refreshTokenLifetime =
+            options.refreshTokenLifetime ?? 14 * 24 * 60 * 60;
         this.refreshTokenMaxLifetime = options.refreshTokenMaxLifetime;
     }
     /**
@@ -260,8 +261,7 @@ export class MemoryTokenService {
      */
     refreshTokenFamilyExpiresAt(client, _user, familyCreatedAt, _scope) {
         const maxLifetime = client
-            .refreshTokenMaxLifetime ??
-            this.refreshTokenMaxLifetime;
+            .refreshTokenMaxLifetime ?? this.refreshTokenMaxLifetime;
         return Promise.resolve(maxLifetime == null
             ? undefined
             : new Date(familyCreatedAt.getTime() + maxLifetime * 1000));

package/{esm → dist}/testing/tenant.d.ts

@@ -1,4 +1,4 @@
-import type { ClientInterface } from "../models/client.js";
+import type { ClientInterface } from "../models/client.ts";
 /** A person in a {@linkcode FakeTenant}. */
 export interface FakeTenantUser {
     /** The subject every token and answer names. */
@@ -306,18 +306,22 @@ export interface FakeTenant {
  *
  * @example
  * ```ts
+ * import type { AddressInfo } from "node:net";
+ * import { serve } from "@hono/node-server";
  * import { createFakeTenant } from "@udibo/oauth2/testing";
  *
- * const server = Deno.serve(
- *   { hostname: "127.0.0.1", port: 0, onListen() {} },
- *   (request) => tenant.fetch(request),
- * );
+ * const server = serve({
+ *   fetch: (request) => tenant.fetch(request),
+ *   hostname: "127.0.0.1",
+ *   port: 0,
+ * });
+ * const { port } = server.address() as AddressInfo;
  * const tenant = await createFakeTenant({
- *   issuer: `http://127.0.0.1:${server.addr.port}`,
+ *   issuer: `http://127.0.0.1:${port}`,
  * });
  * await tenant.addUser({ id: "user-1", username: "ada" });
  * tenant.signInAs("user-1");
- * await server.shutdown();
+ * server.close();
  * ```
  */
 export declare function createFakeTenant(options: FakeTenantOptions): Promise<FakeTenant>;

package/{esm → dist}/testing/tenant.js

@@ -40,7 +40,7 @@ const OIDC_SCOPES = ["openid", "profile", "email"];
 const RESOURCE_GRANTS_READ = "resource_grants.read";
 const RESOURCE_TYPE_MAX_LENGTH = 64;
 const RESOURCE_ID_MAX_LENGTH = 255;
-// deno-lint-ignore no-control-regex
+// oxlint-disable-next-line no-control-regex
 const ASCII_CONTROL_CHARACTERS = /[\x00-\x1f\x7f]/;
 const UNSTATED_ALLOWLIST = "A client_credentials application has to state the scopes its tokens may " +
     "be granted: pass `scopes`, an empty list to deny every scope.";
@@ -62,11 +62,11 @@ const LOGIN_SESSION_COOKIE = "fake_tenant_session";
 const ORGANIZATION_NOT_FOUND = "Organization not found";
 const MEMBER_NOT_FOUND = "organization member not found";
 class ConfidentialClientCredentialsGrant extends ClientCredentialsGrant {
-    isConfidential;
     constructor(options, isConfidential) {
         super(options);
         this.isConfidential = isConfidential;
     }
+    isConfidential;
     async getAuthenticatedClient(request, body) {
         const client = await super.getAuthenticatedClient(request, body);
         if (!this.isConfidential(client)) {
@@ -76,29 +76,31 @@ class ConfidentialClientCredentialsGrant extends ClientCredentialsGrant {
     }
 }
 function machineScopeCeiling(client) {
-    return client.scopes?.filter((scope) => MACHINE_SCOPES.includes(scope)) ??
-        [];
+    return client.scopes?.filter((scope) => MACHINE_SCOPES.includes(scope)) ?? [];
 }
 function isBuiltInRole(slug) {
     return BUILT_IN_ROLES.some((role) => role.slug === slug);
 }
 function roleSlugOf(permissions) {
     const slug = permissions
-        .map((permission) => permission.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, ""))
+        .map((permission) => permission
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, ""))
         .filter(Boolean)
         .join("-");
     return slug || "grant";
 }
 class TenantTokenService extends MemoryTokenService {
-    issuanceOf;
-    recordCredential;
-    mintJwt;
     constructor(options, issuanceOf, recordCredential, mintJwt) {
         super(options);
         this.issuanceOf = issuanceOf;
         this.recordCredential = recordCredential;
         this.mintJwt = mintJwt;
     }
+    issuanceOf;
+    recordCredential;
+    mintJwt;
     acceptedScope(client, user, scope) {
         if (!scope || user)
             return Promise.resolve(scope);
@@ -126,7 +128,8 @@ function problem(status, detail, extensions = {}) {
 }
 function asPermissions(value) {
     const list = typeof value === "string" ? [value] : value;
-    if (!Array.isArray(list) || list.length === 0 ||
+    if (!Array.isArray(list) ||
+        list.length === 0 ||
         list.length > MAX_PERMISSIONS ||
         !list.every((entry) => typeof entry === "string" && entry.length > 0)) {
         return undefined;
@@ -181,7 +184,9 @@ function metadataProblem(value) {
     return undefined;
 }
 function nameProblem(value) {
-    if (typeof value !== "string" || value.length < 1 || value.length > 100 ||
+    if (typeof value !== "string" ||
+        value.length < 1 ||
+        value.length > 100 ||
         CONTROL_CHARACTERS.test(value)) {
         return "name must be 1 to 100 characters with no control characters";
     }
@@ -272,18 +277,22 @@ function noStore(response) {
  *
  * @example
  * ```ts
+ * import type { AddressInfo } from "node:net";
+ * import { serve } from "@hono/node-server";
  * import { createFakeTenant } from "@udibo/oauth2/testing";
  *
- * const server = Deno.serve(
- *   { hostname: "127.0.0.1", port: 0, onListen() {} },
- *   (request) => tenant.fetch(request),
- * );
+ * const server = serve({
+ *   fetch: (request) => tenant.fetch(request),
+ *   hostname: "127.0.0.1",
+ *   port: 0,
+ * });
+ * const { port } = server.address() as AddressInfo;
  * const tenant = await createFakeTenant({
- *   issuer: `http://127.0.0.1:${server.addr.port}`,
+ *   issuer: `http://127.0.0.1:${port}`,
  * });
  * await tenant.addUser({ id: "user-1", username: "ada" });
  * tenant.signInAs("user-1");
- * await server.shutdown();
+ * server.close();
  * ```
  */
 export async function createFakeTenant(options) {
@@ -306,9 +315,10 @@ export async function createFakeTenant(options) {
     const pendingIssuance = new Map();
     const issuanceQueue = new Map();
     const acceptedRoles = (organizationId, userId) => organizationId
-        ? organizations.get(organizationId)?.grants
-            .filter((grant) => grant.userId === userId && grant.acceptedAt)
-            .map((grant) => grant.role) ?? []
+        ? (organizations
+            .get(organizationId)
+            ?.grants.filter((grant) => grant.userId === userId && grant.acceptedAt)
+            .map((grant) => grant.role) ?? [])
         : [];
     const isMember = (organizationId, userId) => acceptedRoles(organizationId, userId).length > 0;
     const holdsAny = (organizationId, userId, roles) => acceptedRoles(organizationId, userId).some((role) => roles.includes(role));
@@ -317,14 +327,14 @@ export async function createFakeTenant(options) {
         assignment.userId === userId);
     const appRolePermissions = (organizationId, userId) => appRolesHeld(organizationId, userId).flatMap((assignment) => definedRoleById(assignment.roleId)?.permissions ?? []);
     const permissionsIn = (userId, organizationId) => new Set([
-        ...users.get(userId)?.permissions ?? [],
-        ...isMember(organizationId, userId)
+        ...(users.get(userId)?.permissions ?? []),
+        ...(isMember(organizationId, userId)
             ? [
-                ...organizations.get(organizationId).permissions.get(userId) ??
-                    [],
+                ...(organizations.get(organizationId).permissions.get(userId) ??
+                    []),
                 ...appRolePermissions(organizationId, userId),
             ]
-            : [],
+            : []),
     ]);
     const organizationClaims = (userId, organizationId) => {
         if (!organizationId || !isMember(organizationId, userId))
@@ -348,9 +358,7 @@ export async function createFakeTenant(options) {
     const clientService = new MemoryClientService(userService);
     const tokenService = new TenantTokenService({ clientService, userService }, (userId) => pendingIssuance.get(userId), (accessToken, issuance, client) => credentials.set(accessToken, {
         ...issuance,
-        boundSessionId: client.type === "third-party"
-            ? undefined
-            : issuance.sessionId,
+        boundSessionId: client.type === "third-party" ? undefined : issuance.sessionId,
     }), (client, user, scope, organizationId) => createJwtAccessTokenGenerator({
         signingKeys,
         issuer,
@@ -400,7 +408,7 @@ export async function createFakeTenant(options) {
             preferred_username: user.username,
             name: user.name,
             email: user.email,
-            email_verified: user.email ? user.emailVerified ?? true : undefined,
+            email_verified: user.email ? (user.emailVerified ?? true) : undefined,
             ...organizationClaims(user.id, signedIn?.userId === user.id ? signedIn.organizationId : undefined),
         }),
         canIntrospectToken: (client, token) => isConfidential(client) && client.id === token.client.id,
@@ -467,7 +475,7 @@ export async function createFakeTenant(options) {
         const caller = await authenticated(request, personOnly);
         if (caller instanceof Response)
             return caller;
-        const body = await request.json().catch(() => null);
+        const body = (await request.json().catch(() => null));
         const asked = asPermissions(body?.permissions);
         if (!asked)
             return problem(400, "permissions is invalid");
@@ -507,13 +515,15 @@ export async function createFakeTenant(options) {
         const caller = await authenticated(request, personOnly);
         if (caller instanceof Response)
             return caller;
-        const body = await request.json().catch(() => null);
+        const body = (await request.json().catch(() => null));
         const asked = asPermissions(body?.permissions);
         if (!asked)
             return problem(400, "permissions is invalid");
         const type = body?.resource?.type;
         const ids = body?.resource?.ids;
-        if (typeof type !== "string" || !Array.isArray(ids) || ids.length === 0 ||
+        if (typeof type !== "string" ||
+            !Array.isArray(ids) ||
+            ids.length === 0 ||
             ids.length > MAX_BATCH_IDS ||
             !ids.every((id) => typeof id === "string" && id.length > 0)) {
             return problem(400, "resource is invalid");
@@ -585,7 +595,7 @@ export async function createFakeTenant(options) {
         "Path=/",
         "HttpOnly",
         "SameSite=Lax",
-        ...issuer.startsWith("https:") ? ["Secure"] : [],
+        ...(issuer.startsWith("https:") ? ["Secure"] : []),
     ].join("; ");
     const authorize = async (request) => {
         const chosen = signedIn;
@@ -598,7 +608,7 @@ export async function createFakeTenant(options) {
                 return Promise.resolve(null);
             const organizationId = requested
                 ? requestedOrganization(requested, user.id)
-                : chosen.organizationId ?? soleOrganizationOf(user.id);
+                : (chosen.organizationId ?? soleOrganizationOf(user.id));
             const continued = continuedSession(request, user.id);
             if (continued)
                 continued.lastActiveAt = new Date();
@@ -625,11 +635,11 @@ export async function createFakeTenant(options) {
             headers,
         });
     };
-    const isLive = async (accessToken) => await tokenService.getToken(accessToken) !== undefined;
+    const isLive = async (accessToken) => (await tokenService.getToken(accessToken)) !== undefined;
     const liveCredentials = async (matches) => {
         const live = [];
         for (const [accessToken, credential] of credentials) {
-            if (matches(credential, accessToken) && await isLive(accessToken)) {
+            if (matches(credential, accessToken) && (await isLive(accessToken))) {
                 live.push([accessToken, credential]);
             }
         }
@@ -659,9 +669,13 @@ export async function createFakeTenant(options) {
         }
     };
     const token = async (request) => {
-        const form = await request.clone().formData().catch(() => null);
+        const form = await request
+            .clone()
+            .formData()
+            .catch(() => null);
         const organizationId = form?.get("organization_id");
-        if (typeof organizationId === "string" && organizationId.length > 0 &&
+        if (typeof organizationId === "string" &&
+            organizationId.length > 0 &&
             form?.get("grant_type") !== "refresh_token") {
             return Response.json({
                 error: "invalid_request",
@@ -693,7 +707,7 @@ export async function createFakeTenant(options) {
                     : undefined;
                 if (session)
                     session.lastActiveAt = new Date();
-                const issued = await response.clone().json();
+                const issued = (await response.clone().json());
                 const credential = credentials.get(issued.access_token);
                 if (credential) {
                     credential.signIn = signIn;
@@ -710,7 +724,10 @@ export async function createFakeTenant(options) {
         });
     };
     const revocation = async (request) => {
-        const form = await request.clone().formData().catch(() => null);
+        const form = await request
+            .clone()
+            .formData()
+            .catch(() => null);
         const value = form?.get("token");
         const presented = typeof value === "string"
             ? await liveCredentials((credential, accessToken) => accessToken === value || credential.refreshToken === value)
@@ -851,7 +868,8 @@ export async function createFakeTenant(options) {
         const now = new Date();
         for (const invitation of invitations.values()) {
             if (invitation.organizationId === organization.id &&
-                invitation.email === email && !invitation.acceptedAt &&
+                invitation.email === email &&
+                !invitation.acceptedAt &&
                 !invitation.deletedAt) {
                 invitation.deletedAt = now;
                 invitation.updatedAt = now;
@@ -879,9 +897,7 @@ export async function createFakeTenant(options) {
         const slugRefusal = slugProblem(body.slug);
         if (slugRefusal)
             return invalid("slug", slugRefusal);
-        const metadataRefusal = body.metadata === undefined
-            ? undefined
-            : metadataProblem(body.metadata);
+        const metadataRefusal = body.metadata === undefined ? undefined : metadataProblem(body.metadata);
         if (metadataRefusal)
             return invalid("metadata", metadataRefusal);
         const slug = body.slug;
@@ -957,7 +973,10 @@ export async function createFakeTenant(options) {
         }
         const held = holdsGrantOnResource(organization.id);
         if (held.length > 0) {
-            const named = held.slice(0, 3).map((grant) => `${grant.resource.type} ${grant.resource.id}`).join(", ");
+            const named = held
+                .slice(0, 3)
+                .map((grant) => `${grant.resource.type} ${grant.resource.id}`)
+                .join(", ");
             return problem(409, `This organization still holds a role on ${named}. Revoke what it holds before deleting it.`);
         }
         organizations.delete(organization.id);
@@ -994,7 +1013,8 @@ export async function createFakeTenant(options) {
         if (refusal)
             return refusal;
         const grant = grantOf(organization, userId, role);
-        if (role === OWNER && grant?.acceptedAt &&
+        if (role === OWNER &&
+            grant?.acceptedAt &&
             organization.grants.filter((g) => g.role === OWNER && g.acceptedAt)
                 .length <= 1) {
             return problem(409, "This is the organization's last owner — make someone else an owner before revoking this membership.");
@@ -1034,7 +1054,8 @@ export async function createFakeTenant(options) {
         if (organization instanceof Response)
             return organization;
         const body = await jsonBody(request);
-        if (!isRecord(body) || typeof body.roleId !== "string" ||
+        if (!isRecord(body) ||
+            typeof body.roleId !== "string" ||
             body.roleId.length === 0) {
             return invalid("roleId", "A role id is required");
         }
@@ -1069,9 +1090,7 @@ export async function createFakeTenant(options) {
         if (organization instanceof Response)
             return organization;
         if (BUILT_IN_APP_ROLES.includes(roleId)) {
-            const who = roleId === OWNER
-                ? "Only an owner"
-                : "Only an admin or owner";
+            const who = roleId === OWNER ? "Only an owner" : "Only an admin or owner";
             return problem(403, `${who} can grant or revoke ${roleId} access.`);
         }
         const held = appRolesHeld(organization.id, userId).find((assignment) => assignment.roleId === roleId);
@@ -1109,8 +1128,10 @@ export async function createFakeTenant(options) {
             return invalid("return_to", "return_to must be a path on this tenant's host or an absolute URL on the origin of a redirect URI registered on one of its live applications");
         }
         const offered = [...invitations.values()].find((invitation) => invitation.organizationId === organization.id &&
-            invitation.email === email && invitation.role === role &&
-            !invitation.acceptedAt && !invitation.deletedAt);
+            invitation.email === email &&
+            invitation.role === role &&
+            !invitation.acceptedAt &&
+            !invitation.deletedAt);
         if (offered) {
             return problem(409, `${email} was already invited to the ${role} role. Withdraw that invitation before sending another.`);
         }
@@ -1166,7 +1187,8 @@ export async function createFakeTenant(options) {
             .filter((invitation) => invitation.organizationId === organization.id &&
             !invitation.deletedAt &&
             (status === "" || !invitation.acceptedAt) &&
-            (status !== "outstanding" || invitation.expiresAt.getTime() > now))
+            (status !== "outstanding" ||
+                invitation.expiresAt.getTime() > now))
             .map(invitationJson), request));
     });
     const withdrawInvitation = organizationApi((caller, _request, [id, invitationId]) => {
@@ -1174,8 +1196,10 @@ export async function createFakeTenant(options) {
         if (organization instanceof Response)
             return organization;
         const invitation = invitations.get(invitationId);
-        if (!invitation || invitation.organizationId !== organization.id ||
-            invitation.acceptedAt || invitation.deletedAt) {
+        if (!invitation ||
+            invitation.organizationId !== organization.id ||
+            invitation.acceptedAt ||
+            invitation.deletedAt) {
             return problem(404, "Organization invitation not found");
         }
         invitation.deletedAt = new Date();
@@ -1189,18 +1213,22 @@ export async function createFakeTenant(options) {
         const address = email?.toLowerCase();
         const now = Date.now();
         const invited = address && !unverifiedEmail
-            ? [...invitations.values()].filter((invitation) => invitation.email === address && !invitation.acceptedAt &&
-                !invitation.deletedAt && invitation.expiresAt.getTime() > now)
+            ? [...invitations.values()].filter((invitation) => invitation.email === address &&
+                !invitation.acceptedAt &&
+                !invitation.deletedAt &&
+                invitation.expiresAt.getTime() > now)
             : [];
         return Response.json({
             offers: [...pendingGrantsOf(caller.user.id), ...invited].flatMap((offer) => {
                 const organization = organizations.get(offer.organizationId);
                 return organization
-                    ? [{
+                    ? [
+                        {
                             id: offer.id,
                             organizationName: organization.name,
                             roleName: roleName(offer.role),
-                        }]
+                        },
+                    ]
                     : [];
             }),
             unverifiedEmail,
@@ -1210,7 +1238,8 @@ export async function createFakeTenant(options) {
         const invitation = invitations.get(offerId);
         if (invitation && !invitation.acceptedAt && !invitation.deletedAt) {
             const email = caller.user.email?.toLowerCase();
-            if (!email || caller.user.emailVerified === false ||
+            if (!email ||
+                caller.user.emailVerified === false ||
                 email !== invitation.email) {
                 return Response.json({ status: "wrong-account" });
             }
@@ -1260,14 +1289,15 @@ export async function createFakeTenant(options) {
     }));
     const patchAccount = accountApi(async (caller, request) => {
         const body = await jsonBody(request);
-        if (!isRecord(body) || Object.keys(body).length !== 1 ||
+        if (!isRecord(body) ||
+            Object.keys(body).length !== 1 ||
             !("userMetadata" in body)) {
             return problem(400, "Only userMetadata may be written here");
         }
         const incoming = metadataProblem(body.userMetadata);
         if (incoming)
             return invalid("userMetadata", incoming);
-        const merged = { ...userMetadata.get(caller.user.id) ?? {} };
+        const merged = { ...(userMetadata.get(caller.user.id) ?? {}) };
         for (const [key, value] of Object.entries(body.userMetadata)) {
             if (value === null)
                 delete merged[key];
@@ -1302,7 +1332,7 @@ export async function createFakeTenant(options) {
         });
     });
     const revokeSession = accountApi(async (caller, request, [sessionId]) => {
-        if (!await isEmptyBody(request)) {
+        if (!(await isEmptyBody(request))) {
             return problem(400, "The request body must be empty");
         }
         if (sessionId === currentSessionOf(caller)) {
@@ -1317,7 +1347,7 @@ export async function createFakeTenant(options) {
         return new Response(null, { status: 204 });
     });
     const revokeOtherSessions = accountApi(async (caller, request) => {
-        if (!await isEmptyBody(request)) {
+        if (!(await isEmptyBody(request))) {
             return problem(400, "The request body must be empty");
         }
         const current = currentSessionOf(caller);
@@ -1344,7 +1374,7 @@ export async function createFakeTenant(options) {
         connectable: [],
     }));
     const unlinkAccount = accountApi(async (caller, request, [identityId]) => {
-        if (!await isEmptyBody(request)) {
+        if (!(await isEmptyBody(request))) {
             return problem(400, "Only an empty request body is accepted");
         }
         const account = linkedAccounts.get(identityId);
@@ -1375,9 +1405,7 @@ export async function createFakeTenant(options) {
         };
     };
     const resourceGrantJson = (grant) => {
-        const holder = grant.subject.type === "user"
-            ? users.get(grant.subject.id)
-            : undefined;
+        const holder = grant.subject.type === "user" ? users.get(grant.subject.id) : undefined;
         const organization = grant.subject.type === "organization"
             ? organizations.get(grant.subject.id)
             : undefined;
@@ -1387,8 +1415,8 @@ export async function createFakeTenant(options) {
             subjectId: grant.subject.id,
             subjectRole: null,
             subjectName: holder
-                ? holder.name ?? holder.username
-                : organization?.name ?? null,
+                ? (holder.name ?? holder.username)
+                : (organization?.name ?? null),
             subjectActive: holder !== undefined || organization !== undefined,
             roleId: grant.roleId,
             builtInRole: isBuiltInRole(grant.role) ? grant.role : null,
@@ -1407,8 +1435,11 @@ export async function createFakeTenant(options) {
         const params = new URL(request.url).searchParams;
         const type = params.get("type");
         const id = params.get("id");
-        if (!type || type.length > RESOURCE_TYPE_MAX_LENGTH || !id ||
-            id.length > RESOURCE_ID_MAX_LENGTH || ASCII_CONTROL_CHARACTERS.test(id)) {
+        if (!type ||
+            type.length > RESOURCE_TYPE_MAX_LENGTH ||
+            !id ||
+            id.length > RESOURCE_ID_MAX_LENGTH ||
+            ASCII_CONTROL_CHARACTERS.test(id)) {
             return noStore(invalid("resource", "Pass the resource as `type` and `id` query parameters."));
         }
         if (!resourceTypes.has(type)) {
@@ -1454,11 +1485,7 @@ export async function createFakeTenant(options) {
             new RegExp(`^/api/organizations/${segment}$`),
             deleteOrganization,
         ],
-        [
-            "GET",
-            new RegExp(`^/api/organizations/${segment}/members$`),
-            listMembers,
-        ],
+        ["GET", new RegExp(`^/api/organizations/${segment}/members$`), listMembers],
         [
             "GET",
             new RegExp(`^/api/organizations/${segment}/member-roles$`),
@@ -1484,11 +1511,7 @@ export async function createFakeTenant(options) {
             new RegExp(`^/api/organizations/${segment}/members/${segment}/${segment}$`),
             revokeMembership,
         ],
-        [
-            "POST",
-            new RegExp(`^/api/organizations/${segment}/invitations$`),
-            invite,
-        ],
+        ["POST", new RegExp(`^/api/organizations/${segment}/invitations$`), invite],
         [
             "GET",
             new RegExp(`^/api/organizations/${segment}/invitations$`),
@@ -1502,16 +1525,8 @@ export async function createFakeTenant(options) {
         ["GET", /^\/api\/account$/, readAccount],
         ["PATCH", /^\/api\/account$/, patchAccount],
         ["GET", /^\/api\/account\/sessions$/, listSessions],
-        [
-            "POST",
-            /^\/api\/account\/sessions\/revoke-others$/,
-            revokeOtherSessions,
-        ],
-        [
-            "DELETE",
-            new RegExp(`^/api/account/sessions/${segment}$`),
-            revokeSession,
-        ],
+        ["POST", /^\/api\/account\/sessions\/revoke-others$/, revokeOtherSessions],
+        ["DELETE", new RegExp(`^/api/account/sessions/${segment}$`), revokeSession],
         ["GET", /^\/api\/account\/linked-accounts$/, listLinkedAccounts],
         [
             "DELETE",
@@ -1570,7 +1585,7 @@ export async function createFakeTenant(options) {
         addUser: async (user) => {
             await userService.add(user, crypto.randomUUID());
             users.set(user.id, user);
-            userMetadata.set(user.id, { ...user.userMetadata ?? {} });
+            userMetadata.set(user.id, { ...(user.userMetadata ?? {}) });
         },
         addOrganization: (organization) => {
             if (organizations.has(organization.id)) {
@@ -1629,7 +1644,7 @@ export async function createFakeTenant(options) {
                 id: roleId,
                 slug,
                 name: name ?? slug,
-                permissions: [...permissions ?? []],
+                permissions: [...(permissions ?? [])],
             });
             return roleId;
         },
@@ -1640,7 +1655,7 @@ export async function createFakeTenant(options) {
             const role = grant.role ?? roleSlugOf(grant.permissions);
             let roleId = isBuiltInRole(role)
                 ? null
-                : definedRoles.get(role)?.id ?? resourceRoleIds.get(role);
+                : (definedRoles.get(role)?.id ?? resourceRoleIds.get(role));
             if (roleId === undefined) {
                 roleId = crypto.randomUUID();
                 resourceRoleIds.set(role, roleId);

package/dist/utils/_constant-time.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Internal constant-time byte comparison for modules that also run in
+ * browsers, where `node:crypto` is unavailable.
+ *
+ * @module
+ */
+/**
+ * Compares two byte arrays without an early exit on the first differing byte.
+ * Returns `false` immediately when the lengths differ, so the length is not
+ * secret.
+ */
+export declare function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean;