@udibo/oauth2 0.34.0 → 0.36.0

package/dist/testing/services.js

@@ -208,11 +208,19 @@ export class MemoryTokenService {
     #tokensByCodeHash = new Map();
     #revokedByRefreshHash = new Map();
     #revokedFamilies = new Set();
+    /**
+     * Claims a code from the paired `authorizationCodeService` and saves the
+     * token issued from it in one step, or does neither, resolving `undefined`
+     * when the code was already claimed. Present only when the service was
+     * constructed with `authorizationCodeService`, so the grant falls back to
+     * two calls for a token service that has no code store to claim from.
+     */
+    exchangeCode;
     /**
      * Creates an empty token store.
      *
-     * @param options Backing client/user services and optional default token
-     * lifetimes.
+     * @param options Backing client/user services, optional default token
+     * lifetimes, and the code store that enables `exchangeCode`.
      */
     constructor(options) {
         this.#clientService = options.clientService;
@@ -221,6 +229,21 @@ export class MemoryTokenService {
         this.refreshTokenLifetime =
             options.refreshTokenLifetime ?? 14 * 24 * 60 * 60;
         this.refreshTokenMaxLifetime = options.refreshTokenMaxLifetime;
+        const codes = options.authorizationCodeService;
+        if (codes) {
+            this.exchangeCode = (authorizationCode, token) => this.#exchangeCode(codes, authorizationCode, token);
+        }
+    }
+    async #exchangeCode(codes, authorizationCode, token) {
+        const codeHash = await sha256Hash(authorizationCode.code);
+        const stored = await this.#prepare({
+            ...token,
+            code: authorizationCode.code,
+        });
+        if (!claimStoredCode(codes, codeHash))
+            return undefined;
+        this.#store(stored);
+        return token;
     }
     /**
      * Accepts the requested scope verbatim; the stub performs no scope
@@ -344,10 +367,16 @@ export class MemoryTokenService {
         if (stored.codeHash) {
             let bucket = this.#tokensByCodeHash.get(stored.codeHash);
             if (!bucket) {
-                bucket = new Set();
+                bucket = {
+                    clientId: stored.clientId,
+                    accessTokenHashes: new Set(),
+                    familyIds: new Set(),
+                };
                 this.#tokensByCodeHash.set(stored.codeHash, bucket);
             }
-            bucket.add(stored.accessTokenHash);
+            bucket.accessTokenHashes.add(stored.accessTokenHash);
+            if (stored.familyId)
+                bucket.familyIds.add(stored.familyId);
         }
         if (stored.refreshTokenHash) {
             if (stored.familyId && this.#revokedFamilies.has(stored.familyId)) {
@@ -460,6 +489,9 @@ export class MemoryTokenService {
      * live token was removed.
      */
     revokeFamily(familyId) {
+        return Promise.resolve(this.#revokeFamily(familyId));
+    }
+    #revokeFamily(familyId) {
         this.#revokedFamilies.add(familyId);
         let revoked = false;
         for (const [hash, stored] of this.#tokensByRefreshHash) {
@@ -476,18 +508,27 @@ export class MemoryTokenService {
                 revoked = true;
             }
         }
-        return Promise.resolve(revoked);
+        return revoked;
     }
     /**
      * Removes every token issued from the given authorization code, used when a
-     * code is replayed. Resolves `true` when at least one token was removed.
+     * code is replayed, and revokes the rotation families of those tokens as
+     * {@linkcode revokeFamily} does, so their rotated successors end with them.
+     * Resolves `true` when tokens were issued from the code.
+     * Removes nothing and resolves `false` when `client` is given and is not the
+     * client the code's tokens were issued to.
      */
-    async revokeCode(code) {
+    async revokeCode(code, client) {
         const codeHash = await sha256Hash(code);
-        const tokenHashes = this.#tokensByCodeHash.get(codeHash);
-        if (!tokenHashes || tokenHashes.size === 0)
+        const bucket = this.#tokensByCodeHash.get(codeHash);
+        if (!bucket || bucket.accessTokenHashes.size === 0)
+            return false;
+        if (client && client.id.toString() !== bucket.clientId.toString()) {
             return false;
-        for (const accessTokenHash of tokenHashes) {
+        }
+        for (const familyId of bucket.familyIds)
+            this.#revokeFamily(familyId);
+        for (const accessTokenHash of bucket.accessTokenHashes) {
             const stored = this.#tokensByAccessHash.get(accessTokenHash);
             if (stored) {
                 this.#tokensByAccessHash.delete(accessTokenHash);
@@ -500,6 +541,7 @@ export class MemoryTokenService {
         return true;
     }
 }
+let claimStoredCode;
 /** In-memory `AuthorizationCodeServiceInterface` implementation. */
 export class MemoryAuthorizationCodeService {
     /** Authorization-code lifetime in seconds applied by {@linkcode expiresAt}. */
@@ -507,6 +549,9 @@ export class MemoryAuthorizationCodeService {
     #clientService;
     #userService;
     #codes = new Map();
+    static {
+        claimStoredCode = (service, codeHash) => service.#codes.delete(codeHash);
+    }
     /**
      * Creates an empty authorization-code store.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.34.0",
+  "version": "0.36.0",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",