@ultimat3/auth 29.4.0 → 30.1.0

package/src/authorization-server-postgres.ts

@@ -0,0 +1,222 @@
+// The shared authorization-server store: five tables over a structural `PgExecutor` (the pool is
+// the host's). A fleet needs it — a code minted on one replica is redeemed on another — and every
+// single-use rule is one conditional statement in `authorization-server-postgres-sql.ts`.
+
+import type { PgExecutor } from '@ultimat3/core';
+import * as SQL from './authorization-server-postgres-sql';
+import type { AuthServerStore } from './authorization-server-store';
+import type {
+  AuthCodeRecord,
+  AuthGrantRecord,
+  AuthServerClient,
+  AuthServerGrant,
+  AuthTokenRecord,
+  ClientAuthMethod,
+  DeviceCodeRecord,
+  DeviceStatus,
+} from './authorization-server-types';
+
+type Row = Readonly<Record<string, unknown>>;
+
+const list = (value: unknown): readonly string[] =>
+  typeof value === 'string' && value !== '' ? value.split(' ') : [];
+const join = (values: readonly string[]): string => values.join(' ');
+const text = (value: unknown): string => (typeof value === 'string' ? value : String(value));
+const textOrNull = (value: unknown): string | null => (value === null ? null : text(value));
+/** Every Postgres client answers `timestamptz` as a `Date` or an ISO string; both read the same. */
+const date = (value: unknown): Date => (value instanceof Date ? value : new Date(text(value)));
+const dateOrNull = (value: unknown): Date | null => (value === null ? null : date(value));
+
+const toClient = (row: Row): AuthServerClient => ({
+  clientId: text(row['client_id']),
+  name: text(row['name']),
+  secretHash: textOrNull(row['secret_hash']),
+  authMethod: text(row['auth_method']) as ClientAuthMethod,
+  redirectUris: list(row['redirect_uris']),
+  grantTypes: list(row['grant_types']) as readonly AuthServerGrant[],
+  scopes: list(row['scopes']),
+  resources: list(row['resources']),
+  createdAt: date(row['created_at']),
+});
+
+const toCode = (row: Row): AuthCodeRecord => ({
+  codeHash: text(row['code_hash']),
+  grantId: text(row['grant_id']),
+  clientId: text(row['client_id']),
+  subject: text(row['subject']),
+  scopes: list(row['scopes']),
+  resource: textOrNull(row['resource']),
+  redirectUri: text(row['redirect_uri']),
+  codeChallenge: text(row['code_challenge']),
+  expiresAt: date(row['expires_at']),
+  usedAt: dateOrNull(row['used_at']),
+});
+
+const toGrant = (row: Row): AuthGrantRecord => ({
+  id: text(row['id']),
+  clientId: text(row['client_id']),
+  subject: text(row['subject']),
+  scopes: list(row['scopes']),
+  resource: textOrNull(row['resource']),
+  createdAt: date(row['created_at']),
+  refreshedAt: date(row['refreshed_at']),
+  revokedAt: dateOrNull(row['revoked_at']),
+});
+
+const toToken = (row: Row): AuthTokenRecord => ({
+  tokenHash: text(row['token_hash']),
+  kind: text(row['kind']) === 'refresh' ? 'refresh' : 'access',
+  grantId: text(row['grant_id']),
+  createdAt: date(row['created_at']),
+  expiresAt: date(row['expires_at']),
+  retiredAt: dateOrNull(row['retired_at']),
+});
+
+const STATUSES: ReadonlySet<string> = new Set<DeviceStatus>([
+  'pending',
+  'approved',
+  'denied',
+  'consumed',
+]);
+
+const toDevice = (row: Row): DeviceCodeRecord => ({
+  deviceCodeHash: text(row['device_code_hash']),
+  userCodeHash: text(row['user_code_hash']),
+  clientId: text(row['client_id']),
+  scopes: list(row['scopes']),
+  resource: textOrNull(row['resource']),
+  // A status this file never writes is a hand-edited row: read as `denied`, which mints nothing.
+  status: STATUSES.has(text(row['status'])) ? (text(row['status']) as DeviceStatus) : 'denied',
+  subject: textOrNull(row['subject']),
+  grantedScopes: row['granted_scopes'] === null ? null : list(row['granted_scopes']),
+  intervalSeconds: Number(row['interval_seconds']),
+  lastPolledAt: dateOrNull(row['last_polled_at']),
+  createdAt: date(row['created_at']),
+  expiresAt: date(row['expires_at']),
+});
+
+export interface PostgresAuthServerStoreOptions {
+  /** Read on every call, so a declaration evaluated before the boot opened the pool still works. */
+  readonly executor: PgExecutor;
+}
+
+export function postgresAuthServerStore(options: PostgresAuthServerStoreOptions): AuthServerStore {
+  const exec = options.executor;
+  const rows = (sql: string, params: readonly unknown[]) => exec.query<Row>(sql, params);
+  const first = async <T>(sql: string, params: readonly unknown[], map: (row: Row) => T) => {
+    const row = (await rows(sql, params))[0];
+    return row === undefined ? null : map(row);
+  };
+  const count = async (sql: string, params: readonly unknown[]): Promise<number> =>
+    Number((await rows(sql, params))[0]?.['n'] ?? 0);
+  return {
+    async putClient(c) {
+      await rows(SQL.SQL_OAUTH_CLIENT_PUT, [
+        c.clientId,
+        c.name,
+        c.secretHash,
+        c.authMethod,
+        join(c.redirectUris),
+        join(c.grantTypes),
+        join(c.scopes),
+        join(c.resources),
+        c.createdAt,
+      ]);
+    },
+    getClient: (id) => first(SQL.SQL_OAUTH_CLIENT_GET, [id], toClient),
+    async putCode(c) {
+      await rows(SQL.SQL_OAUTH_CODE_PUT, [
+        c.codeHash,
+        c.grantId,
+        c.clientId,
+        c.subject,
+        join(c.scopes),
+        c.resource,
+        c.redirectUri,
+        c.codeChallenge,
+        c.expiresAt,
+      ]);
+    },
+    async takeCode(hash, at) {
+      const taken = await first(SQL.SQL_OAUTH_CODE_TAKE, [hash, at], toCode);
+      if (taken !== null) return { code: { ...taken, usedAt: null }, fresh: true };
+      const spent = await first(SQL.SQL_OAUTH_CODE_GET, [hash], toCode);
+      return spent === null ? null : { code: spent, fresh: false };
+    },
+    async putGrant(g) {
+      await rows(SQL.SQL_OAUTH_GRANT_PUT, [
+        g.id,
+        g.clientId,
+        g.subject,
+        join(g.scopes),
+        g.resource,
+        g.createdAt,
+        g.refreshedAt,
+      ]);
+    },
+    getGrant: (id) => first(SQL.SQL_OAUTH_GRANT_GET, [id], toGrant),
+    async touchGrant(id, at) {
+      await rows(SQL.SQL_OAUTH_GRANT_TOUCH, [id, at]);
+    },
+    async revokeGrant(id, at) {
+      await rows(SQL.SQL_OAUTH_GRANT_REVOKE, [id, at]);
+    },
+    revokeGrants: (filter, at) =>
+      count(SQL.SQL_OAUTH_GRANTS_REVOKE, [filter.subject, filter.clientId ?? null, at]),
+    async putToken(t) {
+      await rows(SQL.SQL_OAUTH_TOKEN_PUT, [
+        t.tokenHash,
+        t.kind,
+        t.grantId,
+        t.createdAt,
+        t.expiresAt,
+      ]);
+    },
+    getToken: (hash) => first(SQL.SQL_OAUTH_TOKEN_GET, [hash], toToken),
+    async rotateRefresh(hash, next, at) {
+      const rotated = await rows(SQL.SQL_OAUTH_REFRESH_ROTATE, [
+        hash,
+        at,
+        next.tokenHash,
+        next.createdAt,
+        next.expiresAt,
+      ]);
+      const grantId = rotated[0]?.['grant_id'];
+      if (grantId !== undefined) return { outcome: 'rotated', grantId: text(grantId) };
+      const held = await first(SQL.SQL_OAUTH_TOKEN_GET, [hash], toToken);
+      if (held === null || held.kind !== 'refresh') return { outcome: 'unknown' };
+      return { outcome: 'replayed', grantId: held.grantId };
+    },
+    async putDevice(d) {
+      await rows(SQL.SQL_OAUTH_DEVICE_PUT, [
+        d.deviceCodeHash,
+        d.userCodeHash,
+        d.clientId,
+        join(d.scopes),
+        d.resource,
+        d.intervalSeconds,
+        d.createdAt,
+        d.expiresAt,
+      ]);
+    },
+    deviceByUserCode: (hash) => first(SQL.SQL_OAUTH_DEVICE_BY_USER_CODE, [hash], toDevice),
+    decideDevice: (hash, decision, at) =>
+      first(
+        SQL.SQL_OAUTH_DEVICE_DECIDE,
+        decision.status === 'approved'
+          ? [hash, 'approved', decision.subject, join(decision.scopes), at]
+          : [hash, 'denied', null, null, at],
+        toDevice,
+      ),
+    async pollDevice(hash, at) {
+      // Two polls racing may both read the old stamp: harmless, `consumeDevice` is the single use.
+      const device = await first(SQL.SQL_OAUTH_DEVICE_GET, [hash], toDevice);
+      if (device !== null) await rows(SQL.SQL_OAUTH_DEVICE_POLLED, [hash, at]);
+      return device;
+    },
+    async consumeDevice(hash) {
+      return (await rows(SQL.SQL_OAUTH_DEVICE_CONSUME, [hash])).length === 1;
+    },
+    purge: (before, idleBefore) => count(SQL.SQL_OAUTH_PURGE, [before, idleBefore]),
+  };
+}

package/src/authorization-server-register.ts

@@ -0,0 +1,98 @@
+// Single responsibility: RFC 7591 dynamic client registration, for the MCP clients that still use
+// it — on only under `registration: 'dynamic'`, counted per address. Never a machine client: an
+// open endpoint handing out `client_credentials` would let anyone mint itself a scope.
+
+import { isRedirectUri, storeClient } from './authorization-server-clients';
+import type { ResolvedAuthServerConfig } from './authorization-server-config';
+import type { AuthServerGrant, ClientAuthMethod } from './authorization-server-types';
+import { DEVICE_GRANT } from './authorization-server-types';
+import type { AuthServerHttpContext, AuthServerHttpRequest } from './authorization-server-wire';
+import { jsonAnswer, throttledAnswer } from './authorization-server-wire';
+import { isRecord } from './json';
+
+const SELF_SERVICE_GRANTS: ReadonlySet<string> = new Set<AuthServerGrant>([
+  'authorization_code',
+  'refresh_token',
+  DEVICE_GRANT,
+]);
+const METHODS: ReadonlySet<string> = new Set<ClientAuthMethod>([
+  'none',
+  'client_secret_basic',
+  'client_secret_post',
+]);
+
+const metadataError = (error: string, description: string): Response =>
+  jsonAnswer(400, { error, error_description: description });
+
+const stringList = (value: unknown): readonly string[] | null =>
+  Array.isArray(value) && value.every((item) => typeof item === 'string') ? value : null;
+
+export async function registerHandler(
+  config: ResolvedAuthServerConfig,
+  request: AuthServerHttpRequest,
+  ctx: AuthServerHttpContext,
+): Promise<Response> {
+  try {
+    await config.limiter.reserve(`oauth-register:${ctx.ip ?? 'unknown'}`);
+  } catch (error) {
+    const answer = throttledAnswer(error, 'too many registrations');
+    if (answer === null) throw error;
+    return answer;
+  }
+  let body: unknown;
+  try {
+    body = JSON.parse(new TextDecoder().decode(await request.bodyBytes()));
+  } catch {
+    return metadataError('invalid_client_metadata', 'the body is not JSON');
+  }
+  if (!isRecord(body)) return metadataError('invalid_client_metadata', 'the body is not an object');
+  const grants = stringList(body['grant_types'] ?? ['authorization_code', 'refresh_token']);
+  if (
+    grants === null ||
+    !grants.every((g) => SELF_SERVICE_GRANTS.has(g) && config.grants.has(g as AuthServerGrant))
+  ) {
+    return metadataError(
+      'invalid_client_metadata',
+      'a grant_type is not one this server registers',
+    );
+  }
+  const redirects = stringList(body['redirect_uris'] ?? []);
+  const needsRedirect = grants.includes('authorization_code');
+  if (
+    redirects === null ||
+    (needsRedirect && redirects.length === 0) ||
+    !redirects.every(isRedirectUri)
+  ) {
+    return metadataError(
+      'invalid_redirect_uri',
+      'redirect_uris must be https, or http on loopback',
+    );
+  }
+  const method = body['token_endpoint_auth_method'] ?? 'none';
+  if (typeof method !== 'string' || !METHODS.has(method)) {
+    return metadataError('invalid_client_metadata', 'token_endpoint_auth_method is not supported');
+  }
+  const scope = body['scope'];
+  const scopes = typeof scope === 'string' ? scope.split(' ').filter((s) => s !== '') : [];
+  if (!scopes.every((s) => config.scopes.has(s))) {
+    return metadataError('invalid_client_metadata', 'a scope is not one this server grants');
+  }
+  const name = body['client_name'];
+  const { client, clientSecret } = await storeClient(config, {
+    name: typeof name === 'string' && name !== '' ? name.slice(0, 200) : 'unnamed client',
+    authMethod: method as ClientAuthMethod,
+    redirectUris: redirects,
+    grantTypes: grants as readonly AuthServerGrant[],
+    scopes,
+  });
+  return jsonAnswer(201, {
+    client_id: client.clientId,
+    ...(clientSecret === null ? {} : { client_secret: clientSecret, client_secret_expires_at: 0 }),
+    client_id_issued_at: Math.floor(client.createdAt.getTime() / 1000),
+    client_name: client.name,
+    redirect_uris: client.redirectUris,
+    grant_types: client.grantTypes,
+    token_endpoint_auth_method: client.authMethod,
+    ...(scopes.length === 0 ? {} : { scope: scopes.join(' ') }),
+  });
+}

package/src/authorization-server-request.ts

@@ -0,0 +1,126 @@
+// Single responsibility: screen an authorization request (RFC 6749 §4.1.1 + PKCE + RFC 8707) into
+// what a consent page may show, or the refusal it must show instead. Pure over the client it is
+// handed. An unknown client or an unregistered redirect is SHOWN and never redirected to
+// (RFC 6749 §4.1.2.1); every later refusal goes back to the registered redirect with `iss`.
+
+import type { ResolvedAuthServerConfig } from './authorization-server-config';
+import type { AuthorizationRequest, AuthServerClient } from './authorization-server-types';
+
+export type ReadRequestResult =
+  | { readonly ok: true; readonly request: AuthorizationRequest }
+  | {
+      readonly ok: false;
+      readonly error: string;
+      readonly description: string;
+      /** Where the browser goes with the error; `null` = render it, redirect nowhere. */
+      readonly redirectTo: string | null;
+    };
+
+/** RFC 7636 §4.2: 43–128 characters of the unreserved set, base64url of a SHA-256 in practice. */
+const CODE_CHALLENGE = /^[A-Za-z0-9\-._~]{43,128}$/;
+
+/** `redirectUri` plus the params, an existing query kept (RFC 6749 §3.1.2). */
+export function redirectWith(
+  redirectUri: string,
+  params: Readonly<Record<string, string>>,
+): string {
+  const url = new URL(redirectUri);
+  for (const [key, value] of Object.entries(params)) url.searchParams.set(key, value);
+  return url.toString();
+}
+
+/** One value per parameter, or the refusal: RFC 6749 §3.1 forbids a repeated one. */
+export function singleParams(params: URLSearchParams): Map<string, string> | string {
+  const single = new Map<string, string>();
+  for (const [key, value] of params) {
+    if (single.has(key)) return key;
+    single.set(key, value);
+  }
+  return single;
+}
+
+/** The requested scopes narrowed to what the server and the client allow, or `null` = refused. */
+export function screenScopes(
+  config: ResolvedAuthServerConfig,
+  client: AuthServerClient,
+  requested: string | undefined,
+): readonly string[] | null {
+  const allowed = (scope: string): boolean =>
+    config.scopes.has(scope) && (client.scopes.length === 0 || client.scopes.includes(scope));
+  if (requested === undefined || requested.trim() === '') {
+    const fallback = client.scopes.length > 0 ? client.scopes : [...config.scopes];
+    return fallback.filter(allowed);
+  }
+  const asked = [...new Set(requested.split(' ').filter((scope) => scope !== ''))];
+  return asked.every(allowed) ? asked : null;
+}
+
+/** RFC 8707: none (the default resource, else an unbound grant), or one this server declared. */
+export function screenResource(
+  config: ResolvedAuthServerConfig,
+  resource: string | undefined,
+): string | null | false {
+  if (resource === undefined) return config.defaultResource;
+  return config.resources.has(resource) ? resource : false;
+}
+
+export function screenAuthorization(
+  config: ResolvedAuthServerConfig,
+  client: AuthServerClient | null,
+  params: URLSearchParams,
+): ReadRequestResult {
+  const single = singleParams(params);
+  const shown = (error: string, description: string): ReadRequestResult => ({
+    ok: false,
+    error,
+    description,
+    redirectTo: null,
+  });
+  if (typeof single === 'string') {
+    return shown('invalid_request', `the ${single} parameter is repeated`);
+  }
+  if (client === null) return shown('invalid_client', 'the client is not known to this server');
+  const redirectUri = single.get('redirect_uri');
+  // Byte for byte: no normalisation, no prefix, no trailing-slash leniency. Not a secret, so `===`.
+  if (redirectUri === undefined || !client.redirectUris.includes(redirectUri)) {
+    return shown('invalid_request', 'the redirect_uri is not one this client registered');
+  }
+  const state = single.get('state') ?? null;
+  const back = (error: string, description: string): ReadRequestResult => ({
+    ok: false,
+    error,
+    description,
+    redirectTo: redirectWith(redirectUri, {
+      error,
+      error_description: description,
+      iss: config.issuer,
+      ...(state === null ? {} : { state }),
+    }),
+  });
+  if (single.get('response_type') !== 'code') {
+    return back('unsupported_response_type', 'only response_type=code is supported');
+  }
+  if (!client.grantTypes.includes('authorization_code')) {
+    return back('unauthorized_client', 'this client may not use the authorization code grant');
+  }
+  const challenge = single.get('code_challenge');
+  if (challenge === undefined || !CODE_CHALLENGE.test(challenge)) {
+    return back('invalid_request', 'a PKCE code_challenge is required');
+  }
+  // S256 only, and an absent method is `plain` per RFC 7636 §4.3 — refused, not defaulted.
+  if (single.get('code_challenge_method') !== 'S256') {
+    return back('invalid_request', 'code_challenge_method must be S256');
+  }
+  const scopes = screenScopes(config, client, single.get('scope'));
+  if (scopes === null || scopes.length === 0) {
+    return back('invalid_scope', 'a requested scope is not one this client may be granted');
+  }
+  const resource = screenResource(config, single.get('resource'));
+  if (resource === false) {
+    return back('invalid_target', 'the resource is not one this server issues tokens for');
+  }
+  return {
+    ok: true,
+    request: { client, redirectUri, scopes, resource, state, codeChallenge: challenge },
+  };
+}

package/src/authorization-server-routes.ts

@@ -0,0 +1,181 @@
+// Single responsibility: the server's wire, as plain routes an app spreads into `runtime.routes` —
+// the RFC 8414 metadata document, `POST /oauth/token` (every enabled grant), `/oauth/revoke`,
+// `/oauth/introspect`, and, when enabled, `/oauth/register` and `/oauth/device`. Each answers
+// RFC 6749 `{ error, error_description }`; the `X_` code a refusal is logged under stays off it.
+
+import { logger } from '@ultimat3/core';
+import { type ClientDirectory, clientAuthenticates } from './authorization-server-clients';
+import type { ResolvedAuthServerConfig } from './authorization-server-config';
+import { grantDisabled } from './authorization-server-errors';
+import { registerHandler } from './authorization-server-register';
+import { refused, type TokenOutcome } from './authorization-server-tokens';
+import type { AuthServerClient, AuthServerGrant } from './authorization-server-types';
+import { DEVICE_GRANT } from './authorization-server-types';
+import {
+  type AuthServerHttpContext,
+  type AuthServerHttpRequest,
+  type AuthServerRoute,
+  jsonAnswer,
+  outcomeAnswer,
+  readClientCredentials,
+  readForm,
+  throttledAnswer,
+} from './authorization-server-wire';
+import { exchangeCode, exchangeRefresh } from './grant-authorization-code';
+import { exchangeClientCredentials } from './grant-client-credentials';
+import { pollDevice, startDevice } from './grant-device';
+import { introspectToken, revokeToken } from './token-endpoints';
+
+type ClientStep = (
+  config: ResolvedAuthServerConfig,
+  form: ReadonlyMap<string, string>,
+  client: AuthServerClient,
+) => Promise<TokenOutcome>;
+
+const GRANT_STEPS = new Map<AuthServerGrant, ClientStep>([
+  ['authorization_code', exchangeCode],
+  ['refresh_token', exchangeRefresh],
+  ['client_credentials', exchangeClientCredentials],
+  [DEVICE_GRANT, pollDevice],
+]);
+
+export const AUTH_SERVER_METADATA_WELL_KNOWN = '/.well-known/oauth-authorization-server';
+
+export function authServerMetadata(config: ResolvedAuthServerConfig): Record<string, unknown> {
+  const at = (path: string): string => `${config.origin}${config.basePath}${path}`;
+  const methods = ['none', 'client_secret_basic', 'client_secret_post'];
+  return {
+    issuer: config.issuer,
+    authorization_endpoint: `${config.origin}${config.consentPath}`,
+    token_endpoint: at('/oauth/token'),
+    revocation_endpoint: at('/oauth/revoke'),
+    introspection_endpoint: at('/oauth/introspect'),
+    ...(config.dynamic ? { registration_endpoint: at('/oauth/register') } : {}),
+    ...(config.grants.has(DEVICE_GRANT)
+      ? { device_authorization_endpoint: at('/oauth/device') }
+      : {}),
+    response_types_supported: ['code'],
+    response_modes_supported: ['query'],
+    grant_types_supported: [...config.grants],
+    code_challenge_methods_supported: ['S256'],
+    token_endpoint_auth_methods_supported: methods,
+    revocation_endpoint_auth_methods_supported: methods,
+    introspection_endpoint_auth_methods_supported: methods.slice(1),
+    scopes_supported: [...config.scopes].sort(),
+    authorization_response_iss_parameter_supported: true,
+    client_id_metadata_document_supported: true,
+  };
+}
+
+/** Form → authenticated client → the step. Every refusal is logged once, the `error` only. */
+function clientRoute(
+  config: ResolvedAuthServerConfig,
+  directory: ClientDirectory,
+  name: string,
+  pick: (form: ReadonlyMap<string, string>) => ClientStep | TokenOutcome,
+  success = 200,
+): AuthServerRoute['handler'] {
+  return async (request: AuthServerHttpRequest, ctx: AuthServerHttpContext) => {
+    const form = await readForm(request);
+    let outcome: TokenOutcome;
+    try {
+      outcome = await (async (): Promise<TokenOutcome> => {
+        if (!(form instanceof Map)) return refused('invalid_request', form.refused);
+        const credentials = readClientCredentials(request, form);
+        if ('refused' in credentials) return refused('invalid_request', credentials.refused);
+        // Before the client is authenticated, so the address is the only key there is.
+        const client = await directory.find(credentials.clientId, ctx.ip ?? 'unknown');
+        if (client === null || !clientAuthenticates(client, credentials)) {
+          return refused('invalid_client', 'client authentication failed', 401);
+        }
+        const step = pick(form);
+        return typeof step === 'function' ? step(config, form, client) : step;
+      })();
+    } catch (error) {
+      const answer = throttledAnswer(error, 'too many client metadata fetches');
+      if (answer === null) throw error;
+      logger.info('auth.server.refused', { endpoint: name, error: 'temporarily_unavailable' });
+      config.emit({ kind: 'refused', error: 'temporarily_unavailable', grantType: name });
+      return answer;
+    }
+    if (outcome.ok) {
+      config.emit({ kind: 'issued', grantType: name });
+    } else {
+      logger.info('auth.server.refused', { endpoint: name, error: outcome.error });
+      config.emit({ kind: 'refused', error: outcome.error, grantType: name });
+    }
+    return outcomeAnswer(outcome, success);
+  };
+}
+
+function tokenStep(config: ResolvedAuthServerConfig) {
+  return (form: ReadonlyMap<string, string>): ClientStep | TokenOutcome => {
+    const grantType = form.get('grant_type');
+    if (grantType === undefined) return refused('invalid_request', 'grant_type is required');
+    const step = GRANT_STEPS.get(grantType as AuthServerGrant);
+    if (step === undefined || !config.grants.has(grantType as AuthServerGrant)) {
+      const error = grantDisabled(grantType);
+      logger.warn('auth.server.grant_disabled', { code: error.code, cause: error.cause });
+      config.emit({ kind: 'grant-disabled', grantType });
+      return refused('unsupported_grant_type', 'this server does not enable that grant');
+    }
+    return step;
+  };
+}
+
+export function authServerRoutes(
+  config: ResolvedAuthServerConfig,
+  directory: ClientDirectory,
+): readonly AuthServerRoute[] {
+  const base = config.basePath;
+  const post = (
+    path: string,
+    name: string,
+    handler: AuthServerRoute['handler'],
+  ): AuthServerRoute => ({
+    method: 'POST',
+    path: `${base}${path}`,
+    handler,
+    // Cookie-less and client-authenticated or PKCE-bound: CSRF has nothing to protect here.
+    meta: { name: `oauth:${name}`, auth: 'public', csrf: 'cookieless', authenticate: () => null },
+  });
+  const document = authServerMetadata(config);
+  const routes: AuthServerRoute[] = [
+    {
+      method: 'GET',
+      path: `${AUTH_SERVER_METADATA_WELL_KNOWN}${base}`,
+      handler: async () =>
+        jsonAnswer(200, document, {
+          'access-control-allow-origin': '*',
+          'cache-control': 'max-age=300',
+        }),
+      meta: { name: 'oauth:metadata', auth: 'public' },
+    },
+    post('/oauth/token', 'token', clientRoute(config, directory, 'token', tokenStep(config))),
+    post(
+      '/oauth/revoke',
+      'revoke',
+      clientRoute(config, directory, 'revoke', () => revokeToken),
+    ),
+    post(
+      '/oauth/introspect',
+      'introspect',
+      clientRoute(config, directory, 'introspect', () => introspectToken),
+    ),
+  ];
+  if (config.dynamic) {
+    routes.push(
+      post('/oauth/register', 'register', (request, ctx) => registerHandler(config, request, ctx)),
+    );
+  }
+  if (config.grants.has(DEVICE_GRANT)) {
+    routes.push(
+      post(
+        '/oauth/device',
+        'device',
+        clientRoute(config, directory, 'device', () => startDevice),
+      ),
+    );
+  }
+  return routes;
+}