@udibo/oauth2 0.7.0 → 0.8.0

package/esm/testing/tenant.js

@@ -4,6 +4,7 @@ import { AuthorizationServer } from "../server/authorization-server.js";
 import { createJwtAccessTokenGenerator, generateSigningKey, StaticSigningKeyProvider, } from "../server/signing-keys.js";
 import { BasicScope } from "../models/scope.js";
 import { InvalidRequestError } from "../errors.js";
+import { safeReturnTo } from "../utils/url.js";
 import { MemoryAuthorizationCodeService, MemoryClientService, MemoryTokenService, MemoryUserService, } from "./services.js";
 const PATHS = {
     authorization: "/api/oauth2/authorize",
@@ -15,27 +16,45 @@ const PATHS = {
 };
 const MAX_PERMISSIONS = 50;
 const MAX_BATCH_IDS = 100;
+const DEFAULT_PAGE_SIZE = 20;
+const MAX_PAGE_SIZE = 100;
+const METADATA_MAX_BYTES = 16 * 1024;
+const METADATA_MAX_DEPTH = 8;
+const INVITATION_LIFETIME_MS = 7 * 24 * 60 * 60 * 1000;
+const RETURN_TO_MAX_LENGTH = 2048;
+const SLUG = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const CONTROL_CHARACTERS = /\p{Cc}/u;
+const BUILT_IN_ROLES = [
+    { slug: "owner", name: "Owner" },
+    { slug: "admin", name: "Admin" },
+    { slug: "member", name: "Member" },
+];
+const OWNER = "owner";
+const MANAGER_ROLES = ["owner", "admin"];
+const DEFAULT_ROLES = ["member"];
+const ORGANIZATION_NOT_FOUND = "Organization not found";
 class TenantTokenService extends MemoryTokenService {
-    organizationOf;
+    issuanceOf;
     recordCredential;
     mintJwt;
-    constructor(options, organizationOf, recordCredential, mintJwt) {
+    constructor(options, issuanceOf, recordCredential, mintJwt) {
         super(options);
-        this.organizationOf = organizationOf;
+        this.issuanceOf = issuanceOf;
         this.recordCredential = recordCredential;
         this.mintJwt = mintJwt;
     }
     async generateAccessToken(client, user, scope) {
-        const organizationId = user ? this.organizationOf(user.id) : undefined;
+        const issuance = (user ? this.issuanceOf(user.id) : undefined) ?? {};
         const accessToken = client.accessTokenFormat === "jwt" && user
-            ? await this.mintJwt(client, user, scope, organizationId)
+            ? await this.mintJwt(client, user, scope, issuance.organizationId)
             : await super.generateAccessToken(client, user, scope);
-        this.recordCredential(accessToken, organizationId);
+        this.recordCredential(accessToken, issuance, client);
         return accessToken;
     }
 }
-function problem(status, detail) {
-    return Response.json({ status, detail }, {
+function problem(status, detail, extensions = {}) {
+    return Response.json({ status, detail, ...extensions }, {
         status,
         headers: { "content-type": "application/problem+json" },
     });
@@ -49,6 +68,128 @@ function asPermissions(value) {
     }
     return list;
 }
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function jsonBody(request) {
+    const text = await request.text();
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function isEmptyBody(request) {
+    const text = await request.text();
+    if (!text.trim())
+        return true;
+    try {
+        const body = JSON.parse(text);
+        return isRecord(body) && Object.keys(body).length === 0;
+    }
+    catch {
+        return false;
+    }
+}
+function depthOf(value) {
+    if (value === null || typeof value !== "object")
+        return 0;
+    const children = Array.isArray(value) ? value : Object.values(value);
+    return 1 + Math.max(0, ...children.map(depthOf));
+}
+function metadataProblem(value) {
+    if (!isRecord(value))
+        return "Metadata must be a JSON object";
+    if (depthOf(value) > METADATA_MAX_DEPTH) {
+        return `Metadata must not nest deeper than ${METADATA_MAX_DEPTH} levels`;
+    }
+    const json = JSON.stringify(value);
+    if (new TextEncoder().encode(json).length > METADATA_MAX_BYTES) {
+        return `Metadata must be at most ${METADATA_MAX_BYTES} bytes`;
+    }
+    if (json.includes("\\u0000")) {
+        return "Metadata must not contain NUL characters";
+    }
+    return undefined;
+}
+function nameProblem(value) {
+    if (typeof value !== "string" || value.length < 1 || value.length > 100 ||
+        CONTROL_CHARACTERS.test(value)) {
+        return "name must be 1 to 100 characters with no control characters";
+    }
+    return undefined;
+}
+function slugProblem(value) {
+    if (typeof value !== "string" || value.length > 100 || !SLUG.test(value)) {
+        return "Must be lowercase letters, numbers and single hyphens";
+    }
+    return undefined;
+}
+function invalid(field, message) {
+    return problem(400, message, { fieldErrors: { [field]: message } });
+}
+function iso(date) {
+    return date ? date.toISOString() : null;
+}
+function encodeCursor(id, direction) {
+    return btoa(JSON.stringify({ id, direction }));
+}
+function decodeCursor(value) {
+    if (!value)
+        return null;
+    try {
+        const cursor = JSON.parse(atob(value));
+        return typeof cursor?.id === "string" &&
+            (cursor.direction === "next" || cursor.direction === "prev")
+            ? cursor
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function page(rows, request) {
+    const params = new URL(request.url).searchParams;
+    const requested = Number(params.get("limit") ?? DEFAULT_PAGE_SIZE);
+    const limit = Number.isFinite(requested)
+        ? Math.min(Math.max(Math.floor(requested), 1), MAX_PAGE_SIZE)
+        : DEFAULT_PAGE_SIZE;
+    const sorted = [...rows].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+    const cursor = decodeCursor(params.get("cursor"));
+    let data;
+    let hasMore;
+    if (cursor?.direction === "prev") {
+        const before = sorted.filter((row) => row.id < cursor.id);
+        data = before.slice(-limit);
+        hasMore = before.length > limit;
+    }
+    else {
+        const after = cursor ? sorted.filter((row) => row.id > cursor.id) : sorted;
+        data = after.slice(0, limit);
+        hasMore = after.length > limit;
+    }
+    if (data.length === 0) {
+        return { data, cursors: { next: null, prev: null }, hasMore: false };
+    }
+    const first = data[0].id;
+    return {
+        data,
+        cursors: {
+            next: encodeCursor(data[data.length - 1].id, "next"),
+            prev: sorted.some((row) => row.id < first)
+                ? encodeCursor(first, "prev")
+                : null,
+        },
+        hasMore,
+    };
+}
+function noStore(response) {
+    response.headers.set("cache-control", "no-store");
+    return response;
+}
 /**
  * Creates a {@linkcode FakeTenant}. Serve its `fetch` on the origin you pass
  * as `issuer`, then point the app under test at that origin.
@@ -73,27 +214,39 @@ export async function createFakeTenant(options) {
     const issuer = new URL(options.issuer).origin;
     const signingKeys = new StaticSigningKeyProvider(await generateSigningKey());
     const users = new Map();
+    const userMetadata = new Map();
     const organizations = new Map();
+    const definedRoles = new Map();
+    const invitations = new Map();
     const resourceTypes = new Set();
     const grants = [];
-    const credentialOrganization = new Map();
+    const loginSessions = new Map();
+    const linkedAccounts = new Map();
+    const credentials = new Map();
+    const redirectOrigins = new Set();
     let signedIn = null;
-    const pendingOrganization = new Map();
-    const membershipOf = (organizationId, userId) => organizationId
-        ? organizations.get(organizationId)?.members.get(userId)
-        : undefined;
+    const pendingIssuance = new Map();
+    const issuanceQueue = new Map();
+    const acceptedRoles = (organizationId, userId) => organizationId
+        ? organizations.get(organizationId)?.grants
+            .filter((grant) => grant.userId === userId && grant.acceptedAt)
+            .map((grant) => grant.role) ?? []
+        : [];
+    const isMember = (organizationId, userId) => acceptedRoles(organizationId, userId).length > 0;
+    const holdsAny = (organizationId, userId, roles) => acceptedRoles(organizationId, userId).some((role) => roles.includes(role));
     const permissionsIn = (userId, organizationId) => new Set([
         ...users.get(userId)?.permissions ?? [],
-        ...membershipOf(organizationId, userId)?.permissions ?? [],
+        ...isMember(organizationId, userId)
+            ? organizations.get(organizationId).permissions.get(userId) ?? []
+            : [],
     ]);
     const organizationClaims = (userId, organizationId) => {
-        const membership = membershipOf(organizationId, userId);
-        if (!organizationId || !membership)
+        if (!organizationId || !isMember(organizationId, userId))
             return {};
         return {
             org_id: organizationId,
             org_slug: organizations.get(organizationId).slug,
-            org_roles: membership.roles ?? [],
+            org_roles: acceptedRoles(organizationId, userId),
         };
     };
     const authorizationClaims = (userId, organizationId) => {
@@ -105,7 +258,12 @@ export async function createFakeTenant(options) {
     };
     const userService = new MemoryUserService();
     const clientService = new MemoryClientService(userService);
-    const tokenService = new TenantTokenService({ clientService, userService }, (userId) => pendingOrganization.get(userId), (accessToken, organizationId) => credentialOrganization.set(accessToken, organizationId), (client, user, scope, organizationId) => createJwtAccessTokenGenerator({
+    const tokenService = new TenantTokenService({ clientService, userService }, (userId) => pendingIssuance.get(userId), (accessToken, issuance, client) => credentials.set(accessToken, {
+        ...issuance,
+        boundSessionId: client.type === "third-party"
+            ? undefined
+            : issuance.sessionId,
+    }), (client, user, scope, organizationId) => createJwtAccessTokenGenerator({
         signingKeys,
         issuer,
         audience: client.audience ?? client.id,
@@ -149,21 +307,28 @@ export async function createFakeTenant(options) {
             ...organizationClaims(user.id, signedIn?.userId === user.id ? signedIn.organizationId : undefined),
         }),
         introspectionClaims: (token) => token.user
-            ? authorizationClaims(token.user.id, credentialOrganization.get(token.accessToken))
+            ? authorizationClaims(token.user.id, credentials.get(token.accessToken)?.organizationId)
             : {},
     });
-    const withPendingOrganization = async (userId, organizationId, work) => {
+    const withIssuance = async (userId, issuance, work) => {
         if (!userId)
             return await work();
-        pendingOrganization.set(userId, organizationId);
+        const previous = issuanceQueue.get(userId);
+        const { promise, resolve } = Promise.withResolvers();
+        issuanceQueue.set(userId, promise);
+        await previous;
+        pendingIssuance.set(userId, issuance);
         try {
             return await work();
         }
         finally {
-            pendingOrganization.delete(userId);
+            pendingIssuance.delete(userId);
+            if (issuanceQueue.get(userId) === promise)
+                issuanceQueue.delete(userId);
+            resolve();
         }
     };
-    const authenticated = async (request) => {
+    const authenticated = async (request, machineRefusal = {}) => {
         let token;
         try {
             ({ token } = await server.authenticate(request));
@@ -172,14 +337,16 @@ export async function createFakeTenant(options) {
             return server.handleAuthError(error);
         }
         if (!token.user) {
-            return problem(403, "A machine credential has no self to answer for.");
+            return problem(403, "A machine credential has no self to answer for.", machineRefusal);
         }
-        const organizationId = credentialOrganization.get(token.accessToken);
+        const user = users.get(token.user.id) ?? token.user;
+        const organizationId = credentials.get(token.accessToken)?.organizationId;
         return {
-            user: token.user,
-            organizationId: membershipOf(organizationId, token.user.id)
+            user,
+            organizationId: isMember(organizationId, user.id)
                 ? organizationId
                 : undefined,
+            accessToken: token.accessToken,
         };
     };
     const resourcePermissions = (userId, type, id) => {
@@ -189,7 +356,7 @@ export async function createFakeTenant(options) {
                 continue;
             const admits = grant.subject.type === "user"
                 ? grant.subject.id === userId
-                : Boolean(membershipOf(grant.subject.id, userId));
+                : isMember(grant.subject.id, userId);
             if (admits)
                 grant.permissions.forEach((p) => held.add(p));
         }
@@ -219,7 +386,7 @@ export async function createFakeTenant(options) {
         }
         if (resource.type === "organization") {
             if (!organizations.has(resource.id)) {
-                return problem(404, "Organization not found");
+                return problem(404, ORGANIZATION_NOT_FOUND);
             }
             return Response.json({
                 subject: caller.user.id,
@@ -266,13 +433,13 @@ export async function createFakeTenant(options) {
     const signInOfCode = new Map();
     const signInOfRefreshToken = new Map();
     const soleOrganizationOf = (userId) => {
-        const joined = [...organizations.values()].filter((organization) => organization.members.has(userId));
+        const joined = [...organizations.values()].filter((organization) => isMember(organization.id, userId));
         return joined.length === 1 ? joined[0].id : undefined;
     };
     const requestedOrganization = (requested, userId) => {
         const organization = organizations.get(requested) ??
             [...organizations.values()].find((o) => o.slug === requested);
-        if (!organization?.members.has(userId)) {
+        if (!organization || !isMember(organization.id, userId)) {
             throw new InvalidRequestError("organization is not available");
         }
         return organization.id;
@@ -283,29 +450,52 @@ export async function createFakeTenant(options) {
             return caller;
         return Response.json({
             memberships: [...organizations.values()]
-                .filter((organization) => organization.members.has(caller.user.id))
+                .filter((organization) => isMember(organization.id, caller.user.id))
                 .map((organization) => ({
                 org_id: organization.id,
                 org_slug: organization.slug,
-                name: organization.name ?? organization.slug,
-                roles: organization.members.get(caller.user.id).roles ?? [],
+                name: organization.name,
+                roles: acceptedRoles(organization.id, caller.user.id),
             })),
             cursor: null,
         });
     };
+    const liveSessionOf = (chosen) => {
+        const now = new Date();
+        const existing = chosen.sessionId
+            ? loginSessions.get(chosen.sessionId)
+            : undefined;
+        if (existing) {
+            existing.lastActiveAt = now;
+            return existing.id;
+        }
+        const session = {
+            id: crypto.randomUUID(),
+            userId: chosen.userId,
+            createdAt: now,
+            lastActiveAt: now,
+            ipAddress: chosen.ipAddress ?? null,
+            userAgent: chosen.userAgent ?? null,
+        };
+        loginSessions.set(session.id, session);
+        chosen.sessionId = session.id;
+        return session.id;
+    };
     const authorize = async (request) => {
         const chosen = signedIn;
         const requested = new URL(request.url).searchParams.get("organization");
         let issued;
         const response = await server.handleAuthorizeRequest(request, () => {
             const user = chosen ? users.get(chosen.userId) : undefined;
-            if (!user)
+            if (!chosen || !user)
                 return Promise.resolve(null);
+            const organizationId = requested
+                ? requestedOrganization(requested, user.id)
+                : chosen.organizationId ?? soleOrganizationOf(user.id);
             issued = {
                 userId: user.id,
-                organizationId: requested
-                    ? requestedOrganization(requested, user.id)
-                    : chosen?.organizationId ?? soleOrganizationOf(user.id),
+                organizationId,
+                sessionId: liveSessionOf(chosen),
             };
             return Promise.resolve({ user });
         });
@@ -315,6 +505,39 @@ export async function createFakeTenant(options) {
             signInOfCode.set(code, issued);
         return response;
     };
+    const isLive = async (accessToken) => await tokenService.getToken(accessToken) !== undefined;
+    const liveCredentials = async (matches) => {
+        const live = [];
+        for (const [accessToken, credential] of credentials) {
+            if (matches(credential, accessToken) && await isLive(accessToken)) {
+                live.push([accessToken, credential]);
+            }
+        }
+        return live;
+    };
+    const revokeBoundTo = async (sessionId, keep) => {
+        for (const [accessToken, credential] of credentials) {
+            if (credential.boundSessionId !== sessionId || accessToken === keep) {
+                continue;
+            }
+            await tokenService.revoke(accessToken);
+            credentials.delete(accessToken);
+        }
+    };
+    const endSession = async (sessionId) => {
+        loginSessions.delete(sessionId);
+        await revokeBoundTo(sessionId);
+    };
+    const endSessionsOfRevoked = async (wereLive) => {
+        for (const [accessToken, credential] of wereLive) {
+            if (await isLive(accessToken))
+                continue;
+            credentials.delete(accessToken);
+            if (credential.boundSessionId) {
+                await endSession(credential.boundSessionId);
+            }
+        }
+    };
     const token = async (request) => {
         const form = await request.clone().formData().catch(() => null);
         const code = form?.get("code");
@@ -324,21 +547,574 @@ export async function createFakeTenant(options) {
             : typeof refreshToken === "string"
                 ? signInOfRefreshToken.get(refreshToken)
                 : undefined;
-        const response = await withPendingOrganization(signIn?.userId, signIn?.organizationId, () => server.handleTokenRequest(request));
-        if (response.ok && signIn) {
-            const issued = await response.clone().json();
-            if (issued.refresh_token) {
-                signInOfRefreshToken.set(issued.refresh_token, signIn);
+        return await withIssuance(signIn?.userId, { organizationId: signIn?.organizationId, sessionId: signIn?.sessionId }, async () => {
+            const family = typeof refreshToken === "string" && signIn
+                ? await liveCredentials((credential) => credential.signIn === signIn)
+                : [];
+            const response = await server.handleTokenRequest(request);
+            if (!response.ok) {
+                await endSessionsOfRevoked(family);
+                return response;
             }
-        }
+            if (signIn) {
+                const session = signIn.sessionId
+                    ? loginSessions.get(signIn.sessionId)
+                    : undefined;
+                if (session)
+                    session.lastActiveAt = new Date();
+                const issued = await response.clone().json();
+                const credential = credentials.get(issued.access_token);
+                if (credential) {
+                    credential.signIn = signIn;
+                    credential.refreshToken = issued.refresh_token;
+                }
+                if (issued.refresh_token) {
+                    signInOfRefreshToken.set(issued.refresh_token, signIn);
+                }
+                if (typeof code === "string" && credential?.boundSessionId) {
+                    await revokeBoundTo(credential.boundSessionId, issued.access_token);
+                }
+            }
+            return response;
+        });
+    };
+    const revocation = async (request) => {
+        const form = await request.clone().formData().catch(() => null);
+        const value = form?.get("token");
+        const presented = typeof value === "string"
+            ? await liveCredentials((credential, accessToken) => accessToken === value || credential.refreshToken === value)
+            : [];
+        const response = await server.handleRevocationRequest(request);
+        await endSessionsOfRevoked(presented);
         return response;
     };
+    const organizationJson = (organization) => ({
+        id: organization.id,
+        name: organization.name,
+        slug: organization.slug,
+        metadata: organization.metadata,
+        createdAt: iso(organization.createdAt),
+        updatedAt: iso(organization.updatedAt),
+        deletedAt: null,
+    });
+    const grantJson = (grant) => ({
+        id: grant.id,
+        organizationId: grant.organizationId,
+        role: grant.role,
+        userId: grant.userId,
+        invitedByUserId: grant.invitedByUserId,
+        acceptedAt: iso(grant.acceptedAt),
+        returnTo: grant.returnTo,
+        createdAt: iso(grant.createdAt),
+        updatedAt: iso(grant.updatedAt),
+        deletedAt: null,
+    });
+    const invitationJson = (invitation) => ({
+        id: invitation.id,
+        organizationId: invitation.organizationId,
+        email: invitation.email,
+        role: invitation.role,
+        invitedByUserId: invitation.invitedByUserId,
+        expiresAt: iso(invitation.expiresAt),
+        acceptedAt: iso(invitation.acceptedAt),
+        acceptedByUserId: invitation.acceptedByUserId,
+        returnTo: invitation.returnTo,
+        createdAt: iso(invitation.createdAt),
+        updatedAt: iso(invitation.updatedAt),
+        deletedAt: iso(invitation.deletedAt),
+    });
+    const roleVocabulary = () => [
+        ...BUILT_IN_ROLES,
+        ...[...definedRoles].map(([slug, name]) => ({ slug, name })),
+    ];
+    const roleName = (slug) => roleVocabulary().find((role) => role.slug === slug)?.name ?? slug;
+    const newGrant = (organization, userId, role, fields) => {
+        const now = new Date();
+        const grant = {
+            id: crypto.randomUUID(),
+            organizationId: organization.id,
+            userId,
+            role,
+            ...fields,
+            createdAt: now,
+            updatedAt: now,
+        };
+        organization.grants.push(grant);
+        return grant;
+    };
+    const grantOf = (organization, userId, role) => organization.grants.find((grant) => grant.userId === userId && grant.role === role);
+    const acceptGrant = (grant) => {
+        const now = new Date();
+        grant.acceptedAt = now;
+        grant.updatedAt = now;
+        grant.returnTo = null;
+        return grant;
+    };
+    const grantAccepted = (organization, userId, role, invitedByUserId) => {
+        const existing = grantOf(organization, userId, role);
+        if (existing?.acceptedAt)
+            return existing;
+        if (existing)
+            return acceptGrant(existing);
+        return newGrant(organization, userId, role, {
+            invitedByUserId,
+            acceptedAt: new Date(),
+            returnTo: null,
+        });
+    };
+    const readableOrganization = (caller, organizationId) => {
+        const organization = organizations.get(organizationId);
+        return organization && isMember(organization.id, caller.user.id)
+            ? organization
+            : problem(404, ORGANIZATION_NOT_FOUND);
+    };
+    const managedOrganization = (caller, organizationId) => {
+        const organization = organizations.get(organizationId);
+        return organization &&
+            holdsAny(organization.id, caller.user.id, MANAGER_ROLES)
+            ? organization
+            : problem(404, ORGANIZATION_NOT_FOUND);
+    };
+    const ownerTierRefusal = (organization, caller, role) => role === OWNER && !holdsAny(organization.id, caller.user.id, [OWNER])
+        ? problem(403, "Only an owner of this organization can offer or revoke its owner role.")
+        : undefined;
+    const resolveReturnTo = (value) => {
+        if (value.length > RETURN_TO_MAX_LENGTH || CONTROL_CHARACTERS.test(value)) {
+            return null;
+        }
+        if (value.startsWith("/")) {
+            const path = safeReturnTo(value, "");
+            return path === "" ? null : path;
+        }
+        try {
+            const url = new URL(value);
+            return (url.protocol === "https:" || url.protocol === "http:") &&
+                redirectOrigins.has(url.origin)
+                ? url.href
+                : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const userByEmail = (email) => [...users.values()].find((user) => user.email?.toLowerCase() === email);
+    const holdsGrantOnResource = (organizationId) => grants.filter((grant) => grant.subject.type === "organization" &&
+        grant.subject.id === organizationId);
+    const organizationApi = (handler) => async (request, params) => {
+        const caller = await authenticated(request);
+        if (caller instanceof Response)
+            return noStore(caller);
+        return noStore(await handler(caller, request, params));
+    };
+    const listOrganizations = organizationApi((caller, request) => Response.json(page([...organizations.values()]
+        .filter((organization) => isMember(organization.id, caller.user.id))
+        .map(organizationJson), request)));
+    const createOrganization = organizationApi(async (caller, request) => {
+        const body = await jsonBody(request);
+        if (!isRecord(body))
+            return problem(400, "Invalid organization");
+        const nameRefusal = nameProblem(body.name);
+        if (nameRefusal)
+            return invalid("name", nameRefusal);
+        const slugRefusal = slugProblem(body.slug);
+        if (slugRefusal)
+            return invalid("slug", slugRefusal);
+        const metadataRefusal = body.metadata === undefined
+            ? undefined
+            : metadataProblem(body.metadata);
+        if (metadataRefusal)
+            return invalid("metadata", metadataRefusal);
+        const slug = body.slug;
+        if ([...organizations.values()].some((o) => o.slug === slug)) {
+            return problem(409, "An organization with this slug already exists", {
+                constraint: "organizations_tenant_slug_unique",
+            });
+        }
+        const now = new Date();
+        const organization = {
+            id: crypto.randomUUID(),
+            slug,
+            name: body.name,
+            metadata: body.metadata ?? {},
+            createdAt: now,
+            updatedAt: now,
+            grants: [],
+            permissions: new Map(),
+        };
+        organizations.set(organization.id, organization);
+        grantAccepted(organization, caller.user.id, OWNER, null);
+        return Response.json(organizationJson(organization), { status: 201 });
+    });
+    const getOrganization = organizationApi((caller, _request, [id]) => {
+        const organization = readableOrganization(caller, id);
+        if (organization instanceof Response)
+            return organization;
+        return Response.json(organizationJson(organization));
+    });
+    const patchOrganization = organizationApi(async (caller, request, [id]) => {
+        const organization = managedOrganization(caller, id);
+        if (organization instanceof Response)
+            return organization;
+        const body = await jsonBody(request);
+        if (!isRecord(body))
+            return problem(400, "Invalid organization");
+        if (body.name !== undefined) {
+            const refusal = nameProblem(body.name);
+            if (refusal)
+                return invalid("name", refusal);
+        }
+        if (body.slug !== undefined) {
+            const refusal = slugProblem(body.slug);
+            if (refusal)
+                return invalid("slug", refusal);
+            if ([...organizations.values()].some((o) => o.slug === body.slug && o.id !== organization.id)) {
+                return problem(409, "An organization with this slug already exists", {
+                    constraint: "organizations_tenant_slug_unique",
+                });
+            }
+        }
+        if (body.metadata !== undefined) {
+            const refusal = metadataProblem(body.metadata);
+            if (refusal)
+                return invalid("metadata", refusal);
+        }
+        if (body.name !== undefined)
+            organization.name = body.name;
+        if (body.slug !== undefined)
+            organization.slug = body.slug;
+        if (body.metadata !== undefined) {
+            organization.metadata = body.metadata;
+        }
+        organization.updatedAt = new Date();
+        return Response.json(organizationJson(organization));
+    });
+    const deleteOrganization = organizationApi((caller, _request, [id]) => {
+        const organization = managedOrganization(caller, id);
+        if (organization instanceof Response)
+            return organization;
+        if (!holdsAny(organization.id, caller.user.id, [OWNER])) {
+            return problem(403, "Only an owner of this organization can delete it.");
+        }
+        const held = holdsGrantOnResource(organization.id);
+        if (held.length > 0) {
+            const named = held.slice(0, 3).map((grant) => `${grant.resource.type} ${grant.resource.id}`).join(", ");
+            return problem(409, `This organization still holds a role on ${named}. Revoke what it holds before deleting it.`);
+        }
+        organizations.delete(organization.id);
+        return new Response(null, { status: 204 });
+    });
+    const listMembers = organizationApi((caller, request, [id]) => {
+        const organization = readableOrganization(caller, id);
+        if (organization instanceof Response)
+            return organization;
+        return Response.json(page(organization.grants
+            .filter((grant) => grant.acceptedAt)
+            .map((grant) => {
+            const { returnTo: _offerOnly, ...row } = grantJson(grant);
+            const holder = users.get(grant.userId);
+            return {
+                ...row,
+                name: holder?.name ?? holder?.username ?? "Unknown user",
+                email: holder?.email ?? null,
+            };
+        }), request));
+    });
+    const listMemberRoles = organizationApi((caller, _request, [id]) => {
+        const organization = managedOrganization(caller, id);
+        if (organization instanceof Response)
+            return organization;
+        return Response.json(roleVocabulary());
+    });
+    const revokeMembership = organizationApi((caller, _request, [id, userId, role]) => {
+        const organization = managedOrganization(caller, id);
+        if (organization instanceof Response)
+            return organization;
+        const refusal = ownerTierRefusal(organization, caller, role);
+        if (refusal)
+            return refusal;
+        const grant = grantOf(organization, userId, role);
+        if (role === OWNER && grant?.acceptedAt &&
+            organization.grants.filter((g) => g.role === OWNER && g.acceptedAt)
+                .length <= 1) {
+            return problem(409, "This is the organization's last owner — make someone else an owner before revoking this membership.");
+        }
+        if (!grant)
+            return problem(404, "Organization membership not found");
+        organization.grants.splice(organization.grants.indexOf(grant), 1);
+        return new Response(null, { status: 204 });
+    });
+    const invite = organizationApi(async (caller, request, [id]) => {
+        const organization = managedOrganization(caller, id);
+        if (organization instanceof Response)
+            return organization;
+        const body = await jsonBody(request);
+        if (!isRecord(body))
+            return problem(400, "Invalid invitation");
+        if (typeof body.email !== "string" || !EMAIL.test(body.email)) {
+            return invalid("email", "Enter a valid email address");
+        }
+        const slugRefusal = slugProblem(body.role);
+        if (slugRefusal)
+            return invalid("role", slugRefusal);
+        if (body.return_to !== undefined &&
+            (typeof body.return_to !== "string" || body.return_to.length === 0)) {
+            return invalid("return_to", "return_to must be a non-empty string");
+        }
+        const email = body.email.toLowerCase();
+        const role = body.role;
+        const refusal = ownerTierRefusal(organization, caller, role);
+        if (refusal)
+            return refusal;
+        const returnTo = typeof body.return_to === "string"
+            ? resolveReturnTo(body.return_to)
+            : null;
+        if (typeof body.return_to === "string" && !returnTo) {
+            return invalid("return_to", "return_to must be a path on this tenant's host or an absolute URL on the origin of a redirect URI registered on one of its live applications");
+        }
+        const offered = [...invitations.values()].find((invitation) => invitation.organizationId === organization.id &&
+            invitation.email === email && invitation.role === role &&
+            !invitation.acceptedAt && !invitation.deletedAt);
+        if (offered) {
+            return problem(409, `${email} was already invited to the ${role} role. Withdraw that invitation before sending another.`);
+        }
+        const undefinedRole = roleVocabulary().some((entry) => entry.slug === role)
+            ? undefined
+            : invalid("role", `The role "${role}" is not defined`);
+        const subject = userByEmail(email);
+        if (subject) {
+            if (grantOf(organization, subject.id, role)) {
+                return problem(409, `That person already holds the ${role} role.`, {
+                    constraint: "organization_memberships_unique",
+                });
+            }
+            if (undefinedRole)
+                return undefinedRole;
+            const membership = newGrant(organization, subject.id, role, {
+                invitedByUserId: caller.user.id,
+                acceptedAt: null,
+                returnTo,
+            });
+            return Response.json({ status: "membership", membership: grantJson(membership) }, { status: 201 });
+        }
+        if (undefinedRole)
+            return undefinedRole;
+        const now = new Date();
+        const invitation = {
+            id: crypto.randomUUID(),
+            organizationId: organization.id,
+            email,
+            role,
+            invitedByUserId: caller.user.id,
+            expiresAt: new Date(now.getTime() + INVITATION_LIFETIME_MS),
+            acceptedAt: null,
+            acceptedByUserId: null,
+            returnTo,
+            createdAt: now,
+            updatedAt: now,
+            deletedAt: null,
+        };
+        invitations.set(invitation.id, invitation);
+        return Response.json({ status: "invitation", invitation: invitationJson(invitation) }, { status: 201 });
+    });
+    const listInvitations = organizationApi((caller, request, [id]) => {
+        const organization = managedOrganization(caller, id);
+        if (organization instanceof Response)
+            return organization;
+        const status = new URL(request.url).searchParams.get("status") ?? "";
+        if (!["", "outstanding", "unaccepted"].includes(status)) {
+            return invalid("status", "status must be outstanding or unaccepted");
+        }
+        const now = Date.now();
+        return Response.json(page([...invitations.values()]
+            .filter((invitation) => invitation.organizationId === organization.id &&
+            !invitation.deletedAt &&
+            (status === "" || !invitation.acceptedAt) &&
+            (status !== "outstanding" || invitation.expiresAt.getTime() > now))
+            .map(invitationJson), request));
+    });
+    const withdrawInvitation = organizationApi((caller, _request, [id, invitationId]) => {
+        const organization = managedOrganization(caller, id);
+        if (organization instanceof Response)
+            return organization;
+        const invitation = invitations.get(invitationId);
+        if (!invitation || invitation.organizationId !== organization.id ||
+            invitation.acceptedAt || invitation.deletedAt) {
+            return problem(404, "Organization invitation not found");
+        }
+        invitation.deletedAt = new Date();
+        invitation.updatedAt = invitation.deletedAt;
+        return new Response(null, { status: 204 });
+    });
+    const pendingGrantsOf = (userId) => [...organizations.values()].flatMap((organization) => organization.grants.filter((grant) => grant.userId === userId && !grant.acceptedAt));
+    const listOffers = organizationApi((caller) => {
+        const { email, emailVerified = true } = caller.user;
+        const unverifiedEmail = email && !emailVerified ? email : null;
+        const address = email?.toLowerCase();
+        const now = Date.now();
+        const invited = address && !unverifiedEmail
+            ? [...invitations.values()].filter((invitation) => invitation.email === address && !invitation.acceptedAt &&
+                !invitation.deletedAt && invitation.expiresAt.getTime() > now)
+            : [];
+        return Response.json({
+            offers: [...pendingGrantsOf(caller.user.id), ...invited].flatMap((offer) => {
+                const organization = organizations.get(offer.organizationId);
+                return organization
+                    ? [{
+                            id: offer.id,
+                            organizationName: organization.name,
+                            roleName: roleName(offer.role),
+                        }]
+                    : [];
+            }),
+            unverifiedEmail,
+        });
+    });
+    const acceptOffer = organizationApi((caller, _request, [offerId]) => {
+        const invitation = invitations.get(offerId);
+        if (invitation && !invitation.acceptedAt && !invitation.deletedAt) {
+            const email = caller.user.email?.toLowerCase();
+            if (!email || caller.user.emailVerified === false ||
+                email !== invitation.email) {
+                return Response.json({ status: "wrong-account" });
+            }
+            if (invitation.expiresAt.getTime() <= Date.now()) {
+                return Response.json({ status: "expired" });
+            }
+            const organization = organizations.get(invitation.organizationId);
+            if (!organization)
+                return Response.json({ status: "invalid" });
+            invitation.acceptedAt = new Date();
+            invitation.acceptedByUserId = caller.user.id;
+            invitation.updatedAt = invitation.acceptedAt;
+            const membership = grantAccepted(organization, caller.user.id, invitation.role, invitation.invitedByUserId);
+            return Response.json({
+                status: "accepted",
+                membership: grantJson(membership),
+            });
+        }
+        const offered = pendingGrantsOf(caller.user.id).find((grant) => grant.id === offerId);
+        if (!offered)
+            return Response.json({ status: "invalid" });
+        return Response.json({
+            status: "accepted",
+            membership: grantJson(acceptGrant(offered)),
+        });
+    });
+    const accountApi = (handler) => async (request, params) => {
+        const caller = await authenticated(request, { reason: "machine_token" });
+        if (caller instanceof Response)
+            return noStore(caller);
+        return noStore(await handler(caller, request, params));
+    };
+    const readAccount = accountApi((caller) => Response.json({
+        userMetadata: userMetadata.get(caller.user.id) ?? {},
+    }));
+    const patchAccount = accountApi(async (caller, request) => {
+        const body = await jsonBody(request);
+        if (!isRecord(body) || Object.keys(body).length !== 1 ||
+            !("userMetadata" in body)) {
+            return problem(400, "Only userMetadata may be written here");
+        }
+        const incoming = metadataProblem(body.userMetadata);
+        if (incoming)
+            return invalid("userMetadata", incoming);
+        const merged = { ...userMetadata.get(caller.user.id) ?? {} };
+        for (const [key, value] of Object.entries(body.userMetadata)) {
+            if (value === null)
+                delete merged[key];
+            else
+                merged[key] = value;
+        }
+        const result = metadataProblem(merged);
+        if (result)
+            return invalid("userMetadata", result);
+        userMetadata.set(caller.user.id, merged);
+        return Response.json({ userMetadata: merged });
+    });
+    const currentSessionOf = (caller) => {
+        const sessionId = credentials.get(caller.accessToken)?.sessionId;
+        return sessionId && loginSessions.has(sessionId) ? sessionId : null;
+    };
+    const listSessions = accountApi((caller) => {
+        const current = currentSessionOf(caller);
+        return Response.json({
+            sessions: [...loginSessions.values()]
+                .filter((session) => session.userId === caller.user.id)
+                .sort((a, b) => Number(b.id === current) - Number(a.id === current) ||
+                b.lastActiveAt.getTime() - a.lastActiveAt.getTime())
+                .map((session) => ({
+                id: session.id,
+                createdAt: iso(session.createdAt),
+                lastActiveAt: iso(session.lastActiveAt),
+                ipAddress: session.ipAddress,
+                userAgent: session.userAgent,
+                current: session.id === current,
+            })),
+        });
+    });
+    const revokeSession = accountApi(async (caller, request, [sessionId]) => {
+        if (!await isEmptyBody(request)) {
+            return problem(400, "The request body must be empty");
+        }
+        if (sessionId === currentSessionOf(caller)) {
+            return problem(409, "This is your current session — use sign out instead.", {
+                reason: "current_session",
+            });
+        }
+        if (loginSessions.get(sessionId)?.userId !== caller.user.id) {
+            return problem(404, "Session not found.");
+        }
+        await endSession(sessionId);
+        return new Response(null, { status: 204 });
+    });
+    const revokeOtherSessions = accountApi(async (caller, request) => {
+        if (!await isEmptyBody(request)) {
+            return problem(400, "The request body must be empty");
+        }
+        const current = currentSessionOf(caller);
+        if (!current) {
+            return problem(409, "Session not found.", {
+                reason: "current_session_required",
+            });
+        }
+        const others = [...loginSessions.values()].filter((session) => session.userId === caller.user.id && session.id !== current);
+        for (const session of others)
+            await endSession(session.id);
+        return Response.json({ revoked: others.length });
+    });
+    const linkedAccountsOf = (userId) => [...linkedAccounts.values()].filter((account) => account.userId === userId);
+    const listLinkedAccounts = accountApi((caller) => Response.json({
+        identities: linkedAccountsOf(caller.user.id).map((account) => ({
+            id: account.id,
+            provider: account.provider,
+            displayName: account.displayName,
+            email: account.email,
+            createdAt: iso(account.createdAt),
+        })),
+        hasPassword: caller.user.hasPassword ?? true,
+        connectable: [],
+    }));
+    const unlinkAccount = accountApi(async (caller, request, [identityId]) => {
+        if (!await isEmptyBody(request)) {
+            return problem(400, "Only an empty request body is accepted");
+        }
+        const account = linkedAccounts.get(identityId);
+        if (account?.userId !== caller.user.id) {
+            return problem(404, "Connected account not found.");
+        }
+        const othersRemain = linkedAccountsOf(caller.user.id).length > 1;
+        if (!othersRemain && !(caller.user.hasPassword ?? true)) {
+            return problem(409, "This is your only way to sign in. Set a password or connect another provider before disconnecting it.", { reason: "last_method" });
+        }
+        linkedAccounts.delete(account.id);
+        return new Response(null, { status: 204 });
+    });
     const routes = {
         "GET /.well-known/oauth-authorization-server": (r) => server.handleMetadataRequest(r),
         "GET /.well-known/openid-configuration": (r) => server.handleOidcMetadataRequest(r),
         [`GET ${PATHS.authorization}`]: authorize,
         [`POST ${PATHS.token}`]: token,
-        [`POST ${PATHS.revocation}`]: (r) => server.handleRevocationRequest(r),
+        [`POST ${PATHS.revocation}`]: revocation,
         [`POST ${PATHS.introspection}`]: (r) => server.handleIntrospectionRequest(r),
         [`GET ${PATHS.userinfo}`]: (r) => server.handleUserInfoRequest(r),
         [`POST ${PATHS.userinfo}`]: (r) => server.handleUserInfoRequest(r),
@@ -347,31 +1123,133 @@ export async function createFakeTenant(options) {
         "POST /api/check": check,
         "POST /api/check/batch": checkBatch,
     };
+    const segment = "([^/]+)";
+    const patterns = [
+        ["GET", /^\/api\/organizations$/, listOrganizations],
+        ["POST", /^\/api\/organizations$/, createOrganization],
+        ["GET", /^\/api\/organizations\/offers$/, listOffers],
+        [
+            "POST",
+            new RegExp(`^/api/organizations/offers/${segment}/accept$`),
+            acceptOffer,
+        ],
+        ["GET", new RegExp(`^/api/organizations/${segment}$`), getOrganization],
+        ["PATCH", new RegExp(`^/api/organizations/${segment}$`), patchOrganization],
+        [
+            "DELETE",
+            new RegExp(`^/api/organizations/${segment}$`),
+            deleteOrganization,
+        ],
+        [
+            "GET",
+            new RegExp(`^/api/organizations/${segment}/members$`),
+            listMembers,
+        ],
+        [
+            "GET",
+            new RegExp(`^/api/organizations/${segment}/member-roles$`),
+            listMemberRoles,
+        ],
+        [
+            "DELETE",
+            new RegExp(`^/api/organizations/${segment}/members/${segment}/${segment}$`),
+            revokeMembership,
+        ],
+        [
+            "POST",
+            new RegExp(`^/api/organizations/${segment}/invitations$`),
+            invite,
+        ],
+        [
+            "GET",
+            new RegExp(`^/api/organizations/${segment}/invitations$`),
+            listInvitations,
+        ],
+        [
+            "DELETE",
+            new RegExp(`^/api/organizations/${segment}/invitations/${segment}$`),
+            withdrawInvitation,
+        ],
+        ["GET", /^\/api\/account$/, readAccount],
+        ["PATCH", /^\/api\/account$/, patchAccount],
+        ["GET", /^\/api\/account\/sessions$/, listSessions],
+        [
+            "POST",
+            /^\/api\/account\/sessions\/revoke-others$/,
+            revokeOtherSessions,
+        ],
+        [
+            "DELETE",
+            new RegExp(`^/api/account/sessions/${segment}$`),
+            revokeSession,
+        ],
+        ["GET", /^\/api\/account\/linked-accounts$/, listLinkedAccounts],
+        [
+            "DELETE",
+            new RegExp(`^/api/account/linked-accounts/${segment}$`),
+            unlinkAccount,
+        ],
+    ];
+    const decoded = (segments) => {
+        try {
+            return segments.map(decodeURIComponent);
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const route = (request) => {
+        const { pathname } = new URL(request.url);
+        const exact = routes[`${request.method} ${pathname}`];
+        if (exact)
+            return exact(request);
+        for (const [method, pattern, handler] of patterns) {
+            if (method !== request.method)
+                continue;
+            const match = pattern.exec(pathname);
+            if (!match)
+                continue;
+            const params = decoded(match.slice(1));
+            return params ? handler(request, params) : undefined;
+        }
+        return undefined;
+    };
     return {
         issuer,
-        fetch: (request) => {
-            const route = routes[`${request.method} ${new URL(request.url).pathname}`];
-            return route
-                ? route(request)
-                : Promise.resolve(problem(404, "Not found"));
-        },
+        fetch: (request) => route(request) ?? Promise.resolve(problem(404, "Not found")),
         addClient: async ({ secret, ...client }) => {
             await clientService.add({
                 grants: ["authorization_code", "refresh_token"],
                 ...client,
             }, secret);
+            for (const uri of client.redirectUris ?? []) {
+                try {
+                    redirectOrigins.add(new URL(uri).origin);
+                }
+                catch {
+                    continue;
+                }
+            }
         },
         addUser: async (user) => {
             await userService.add(user, crypto.randomUUID());
             users.set(user.id, user);
+            userMetadata.set(user.id, { ...user.userMetadata ?? {} });
         },
         addOrganization: (organization) => {
             if (organizations.has(organization.id)) {
                 throw new Error(`Organization "${organization.id}" already exists`);
             }
+            const now = new Date();
             organizations.set(organization.id, {
-                ...organization,
-                members: new Map(),
+                id: organization.id,
+                slug: organization.slug,
+                name: organization.name ?? organization.slug,
+                metadata: {},
+                createdAt: now,
+                updatedAt: now,
+                grants: [],
+                permissions: new Map(),
             });
         },
         addMember: (organizationId, userId, membership = {}) => {
@@ -379,10 +1257,29 @@ export async function createFakeTenant(options) {
             if (!organization) {
                 throw new Error(`Organization "${organizationId}" does not exist`);
             }
-            organization.members.set(userId, membership);
+            organization.grants = organization.grants.filter((grant) => grant.userId !== userId);
+            const roles = membership.roles?.length ? membership.roles : DEFAULT_ROLES;
+            for (const role of new Set(roles)) {
+                newGrant(organization, userId, role, {
+                    invitedByUserId: null,
+                    acceptedAt: new Date(),
+                    returnTo: null,
+                });
+            }
+            organization.permissions.set(userId, membership.permissions ?? []);
         },
         removeMember: (organizationId, userId) => {
-            organizations.get(organizationId)?.members.delete(userId);
+            const organization = organizations.get(organizationId);
+            if (!organization)
+                return;
+            organization.grants = organization.grants.filter((grant) => grant.userId !== userId);
+            organization.permissions.delete(userId);
+        },
+        defineOrganizationRole: ({ slug, name }) => {
+            if (BUILT_IN_ROLES.some((role) => role.slug === slug)) {
+                throw new Error(`"${slug}" is a built-in organization role`);
+            }
+            definedRoles.set(slug, name ?? slug);
         },
         registerResourceType: (type) => {
             resourceTypes.add(type);
@@ -390,8 +1287,23 @@ export async function createFakeTenant(options) {
         grant: (grant) => {
             grants.push(grant);
         },
+        linkAccount: (userId, account) => {
+            if (!users.has(userId)) {
+                throw new Error(`User "${userId}" does not exist`);
+            }
+            const linked = {
+                id: crypto.randomUUID(),
+                userId,
+                provider: account.provider,
+                displayName: account.displayName ?? account.provider,
+                email: account.email ?? null,
+                createdAt: new Date(),
+            };
+            linkedAccounts.set(linked.id, linked);
+            return linked.id;
+        },
         signInAs: (userId, signIn = {}) => {
-            signedIn = userId ? { userId, ...signIn } : null;
+            signedIn = userId ? { ...signIn, userId } : null;
         },
         issueAccessToken: async (request) => {
             const client = await clientService.get(request.clientId);
@@ -402,7 +1314,9 @@ export async function createFakeTenant(options) {
             if (!user)
                 throw new Error(`User "${request.userId}" does not exist`);
             const scope = new BasicScope(request.scope ?? "openid");
-            return await withPendingOrganization(user.id, request.organizationId ?? soleOrganizationOf(user.id), async () => {
+            return await withIssuance(user.id, {
+                organizationId: request.organizationId ?? soleOrganizationOf(user.id),
+            }, async () => {
                 const accessToken = await tokenService.generateAccessToken(client, user, scope);
                 await tokenService.save({
                     client,