dineway 0.1.9 → 0.1.11

package/dist/normalize-C49G_o1k.mjs

@@ -0,0 +1,126 @@
+//#region src/media/normalize.ts
+const INTERNAL_MEDIA_PREFIX = "/_dineway/api/media/file/";
+const URL_PATTERN = /^https?:\/\//;
+/**
+* Normalize a media field value into a consistent MediaValue shape.
+*
+* - `null`/`undefined` → `null`
+* - Bare URL string → `{ provider: "external", id: "", src: url }`
+* - Bare internal media URL → resolved via local provider's `get()`
+* - Object with `provider` + `id` → enriched with missing fields from provider
+*/
+async function normalizeMediaValue(value, getProvider) {
+	if (value == null) return null;
+	if (typeof value === "string") return normalizeStringUrl(value, getProvider);
+	if (!isRecord(value)) return null;
+	if (!("id" in value) && !("src" in value)) return null;
+	const provider = (typeof value.provider === "string" ? value.provider : void 0) || "local";
+	const id = typeof value.id === "string" ? value.id : "";
+	if (provider === "external") return recordToMediaValue(value);
+	const result = {
+		...recordToMediaValue(value),
+		provider
+	};
+	if (provider === "local") delete result.src;
+	const needsDimensions = result.width == null || result.height == null;
+	const needsStorageKey = provider === "local" && !result.meta?.storageKey;
+	const needsFileInfo = !result.mimeType || !result.filename;
+	if (!(needsDimensions || needsStorageKey || needsFileInfo) || !id) return result;
+	const mediaProvider = getProvider(provider);
+	if (!mediaProvider?.get) return result;
+	let providerItem;
+	try {
+		providerItem = await mediaProvider.get(id);
+	} catch {
+		return result;
+	}
+	if (!providerItem) return result;
+	return mergeProviderData(result, providerItem);
+}
+function normalizeStringUrl(url, getProvider) {
+	if (url.startsWith(INTERNAL_MEDIA_PREFIX)) return resolveInternalUrl(url, getProvider);
+	if (URL_PATTERN.test(url)) return Promise.resolve({
+		provider: "external",
+		id: "",
+		src: url
+	});
+	return Promise.resolve({
+		provider: "external",
+		id: "",
+		src: url
+	});
+}
+async function resolveInternalUrl(url, getProvider) {
+	const storageKey = url.slice(25);
+	const localProvider = getProvider("local");
+	if (!localProvider?.get) return {
+		provider: "external",
+		id: "",
+		src: url
+	};
+	let item;
+	try {
+		item = await localProvider.get(storageKey);
+	} catch {
+		return {
+			provider: "external",
+			id: "",
+			src: url
+		};
+	}
+	if (!item) return {
+		provider: "external",
+		id: "",
+		src: url
+	};
+	return {
+		provider: "local",
+		id: item.id,
+		filename: item.filename,
+		mimeType: item.mimeType,
+		width: item.width,
+		height: item.height,
+		alt: item.alt,
+		meta: item.meta
+	};
+}
+/**
+* Merge provider data into an existing MediaValue, preserving caller-supplied fields.
+* Caller `alt` takes priority over provider `alt` (per-usage, not per-image).
+*/
+function mergeProviderData(existing, item) {
+	const result = { ...existing };
+	if (result.width == null && item.width != null) result.width = item.width;
+	if (result.height == null && item.height != null) result.height = item.height;
+	if (!result.filename && item.filename) result.filename = item.filename;
+	if (!result.mimeType && item.mimeType) result.mimeType = item.mimeType;
+	if (!result.alt && item.alt) result.alt = item.alt;
+	if (item.meta) result.meta = {
+		...item.meta,
+		...result.meta
+	};
+	return result;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Extract known MediaValue fields from a runtime-checked record.
+* Avoids unsafe `as MediaValue` cast by reading each property explicitly.
+*/
+function recordToMediaValue(obj) {
+	const result = { id: typeof obj.id === "string" ? obj.id : "" };
+	if (typeof obj.provider === "string") result.provider = obj.provider;
+	if (typeof obj.src === "string") result.src = obj.src;
+	if (typeof obj.previewUrl === "string") result.previewUrl = obj.previewUrl;
+	if (typeof obj.filename === "string") result.filename = obj.filename;
+	if (typeof obj.mimeType === "string") result.mimeType = obj.mimeType;
+	if (typeof obj.width === "number") result.width = obj.width;
+	if (typeof obj.height === "number") result.height = obj.height;
+	if (typeof obj.alt === "string") result.alt = obj.alt;
+	if (isRecord(obj.meta)) result.meta = obj.meta;
+	return result;
+}
+
+//#endregion
+export { normalizeMediaValue as t };

package/dist/oauth-authorization-C1qiw4hd.mjs

@@ -0,0 +1,283 @@
+import { t as withTransaction } from "./transaction-x2tJQ-A1.mjs";
+import { a as filterExperimentalSiteContextWorkflowScopes, i as experimentalSiteContextWorkflowsEnabled, o as getExperimentalSiteContextWorkflowScopesDisabledMessage, r as disabledExperimentalSiteContextWorkflowScopes } from "./experimental-workflows-DldxJlqV.mjs";
+import { a as hashApiToken, n as TOKEN_PREFIXES, r as generatePrefixedToken, t as ALL_VALID_SCOPES } from "./api-tokens-DzloJxuh.mjs";
+import { c as validateRedirectUri, o as lookupOAuthClient, s as validateClientRedirectUri } from "./oauth-clients-CvWatf5p.mjs";
+import { t as lookupUserRoleAndStatus } from "./oauth-user-lookup-B4OcmsLV.mjs";
+import { clampScopes, computeS256Challenge, secureCompare } from "@dineway-ai/auth";
+import { generateCodeVerifier } from "arctic";
+
+//#region src/api/handlers/oauth-authorization.ts
+/**
+* OAuth 2.1 Authorization Code + PKCE handlers.
+*
+* Implements the server side of the authorization code grant for MCP clients
+* (Claude Desktop, VS Code, etc.) per the MCP authorization spec (draft).
+*
+* Uses arctic for PKCE challenge generation and @dineway-ai/auth for token
+* utilities. Token infrastructure is shared with the device flow.
+*/
+/** Authorization codes expire after 10 minutes (RFC 6749 §4.1.2 recommends short-lived) */
+const AUTH_CODE_TTL_SECONDS = 600;
+/** Access token TTL: 1 hour */
+const ACCESS_TOKEN_TTL_SECONDS = 3600;
+/** Refresh token TTL: 90 days */
+const REFRESH_TOKEN_TTL_SECONDS = 2160 * 60 * 60;
+function expiresAt(seconds) {
+	return new Date(Date.now() + seconds * 1e3).toISOString();
+}
+/**
+* Validate and normalize scopes. Returns validated scope list.
+*/
+function normalizeScopes(requested) {
+	if (!requested || requested.length === 0) return [];
+	const validSet = new Set(filterExperimentalSiteContextWorkflowScopes(ALL_VALID_SCOPES));
+	return requested.filter((scope) => validSet.has(scope));
+}
+/**
+* Process an authorization request after the user approves consent.
+*
+* Generates an authorization code, stores it with the PKCE challenge,
+* and returns the redirect URL with the code appended.
+*
+* Scopes are clamped to the user's role to prevent scope escalation.
+*/
+async function handleAuthorizationApproval(db, userId, userRole, params) {
+	try {
+		if (params.response_type !== "code") return {
+			success: false,
+			error: {
+				code: "UNSUPPORTED_RESPONSE_TYPE",
+				message: "Only response_type=code is supported"
+			}
+		};
+		const uriError = validateRedirectUri(params.redirect_uri);
+		if (uriError) return {
+			success: false,
+			error: {
+				code: "INVALID_REDIRECT_URI",
+				message: uriError
+			}
+		};
+		const client = await lookupOAuthClient(db, params.client_id);
+		if (!client) return {
+			success: false,
+			error: {
+				code: "INVALID_CLIENT",
+				message: "Unknown client_id"
+			}
+		};
+		const clientUriError = validateClientRedirectUri(params.redirect_uri, client.redirectUris);
+		if (clientUriError) return {
+			success: false,
+			error: {
+				code: "INVALID_REDIRECT_URI",
+				message: clientUriError
+			}
+		};
+		if (params.code_challenge_method !== "S256") return {
+			success: false,
+			error: {
+				code: "INVALID_REQUEST",
+				message: "Only S256 code_challenge_method is supported"
+			}
+		};
+		if (!params.code_challenge) return {
+			success: false,
+			error: {
+				code: "INVALID_REQUEST",
+				message: "code_challenge is required"
+			}
+		};
+		const requestedScopes = params.scope?.split(" ").filter(Boolean) ?? [];
+		if (disabledExperimentalSiteContextWorkflowScopes(requestedScopes).length > 0) return {
+			success: false,
+			error: {
+				code: "INVALID_SCOPE",
+				message: getExperimentalSiteContextWorkflowScopesDisabledMessage()
+			}
+		};
+		const userScopes = clampScopes(normalizeScopes(requestedScopes), userRole, { includeExperimental: experimentalSiteContextWorkflowsEnabled() });
+		const clientScopes = client.scopes;
+		const scopes = clientScopes?.length ? userScopes.filter((s) => clientScopes.includes(s)) : userScopes;
+		if (scopes.length === 0) return {
+			success: false,
+			error: {
+				code: "INVALID_SCOPE",
+				message: "No valid scopes requested"
+			}
+		};
+		const code = generateCodeVerifier();
+		const codeHash = hashApiToken(code);
+		await db.insertInto("_dineway_authorization_codes").values({
+			code_hash: codeHash,
+			client_id: params.client_id,
+			redirect_uri: params.redirect_uri,
+			user_id: userId,
+			scopes: JSON.stringify(scopes),
+			code_challenge: params.code_challenge,
+			code_challenge_method: params.code_challenge_method,
+			resource: params.resource ?? null,
+			expires_at: expiresAt(AUTH_CODE_TTL_SECONDS)
+		}).execute();
+		const redirectUrl = new URL(params.redirect_uri);
+		redirectUrl.searchParams.set("code", code);
+		if (params.state) redirectUrl.searchParams.set("state", params.state);
+		return {
+			success: true,
+			data: { redirect_url: redirectUrl.toString() }
+		};
+	} catch (error) {
+		console.error("Authorization error:", error);
+		return {
+			success: false,
+			error: {
+				code: "AUTHORIZATION_ERROR",
+				message: "Failed to process authorization"
+			}
+		};
+	}
+}
+/**
+* Exchange an authorization code for access + refresh tokens.
+*
+* Validates the code, verifies PKCE, and issues tokens using the same
+* infrastructure as the device flow (ec_oat_*, ec_ort_*).
+*/
+async function handleAuthorizationCodeExchange(db, params) {
+	try {
+		if (params.grant_type !== "authorization_code") return {
+			success: false,
+			error: {
+				code: "unsupported_grant_type",
+				message: "Invalid grant_type"
+			}
+		};
+		const codeHash = hashApiToken(params.code);
+		const row = await db.deleteFrom("_dineway_authorization_codes").where("code_hash", "=", codeHash).returningAll().executeTakeFirst();
+		if (!row) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "Invalid authorization code"
+			}
+		};
+		if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "Authorization code expired"
+			}
+		};
+		if (row.redirect_uri !== params.redirect_uri) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "redirect_uri mismatch"
+			}
+		};
+		if (row.client_id !== params.client_id) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "client_id mismatch"
+			}
+		};
+		if (!secureCompare(computeS256Challenge(params.code_verifier), row.code_challenge)) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "PKCE verification failed"
+			}
+		};
+		if (row.resource && params.resource && row.resource !== params.resource) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "resource mismatch"
+			}
+		};
+		const userInfo = await lookupUserRoleAndStatus(db, row.user_id);
+		if (!userInfo) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "User not found"
+			}
+		};
+		if (userInfo.disabled) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "User account is disabled"
+			}
+		};
+		let scopes = clampScopes(filterExperimentalSiteContextWorkflowScopes(JSON.parse(row.scopes)), userInfo.role, { includeExperimental: experimentalSiteContextWorkflowsEnabled() });
+		const client = await lookupOAuthClient(db, row.client_id);
+		if (client?.scopes?.length) scopes = scopes.filter((scope) => client.scopes.includes(scope));
+		if (scopes.length === 0) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "User role no longer supports any of the requested scopes"
+			}
+		};
+		const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
+		const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
+		const refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);
+		const refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);
+		await withTransaction(db, async (trx) => {
+			await trx.insertInto("_dineway_oauth_tokens").values({
+				token_hash: accessToken.hash,
+				token_type: "access",
+				user_id: row.user_id,
+				scopes: JSON.stringify(scopes),
+				client_type: "mcp",
+				expires_at: accessExpires,
+				refresh_token_hash: refreshToken.hash,
+				client_id: row.client_id
+			}).execute();
+			await trx.insertInto("_dineway_oauth_tokens").values({
+				token_hash: refreshToken.hash,
+				token_type: "refresh",
+				user_id: row.user_id,
+				scopes: JSON.stringify(scopes),
+				client_type: "mcp",
+				expires_at: refreshExpires,
+				refresh_token_hash: null,
+				client_id: row.client_id
+			}).execute();
+		});
+		return {
+			success: true,
+			data: {
+				access_token: accessToken.raw,
+				refresh_token: refreshToken.raw,
+				token_type: "Bearer",
+				expires_in: ACCESS_TOKEN_TTL_SECONDS,
+				scope: scopes.join(" ")
+			}
+		};
+	} catch (error) {
+		console.error("Token exchange error:", error);
+		return {
+			success: false,
+			error: {
+				code: "TOKEN_EXCHANGE_ERROR",
+				message: "Failed to exchange authorization code"
+			}
+		};
+	}
+}
+/**
+* Build the authorization denied redirect URL.
+*/
+function buildDeniedRedirect(redirectUri, state) {
+	const url = new URL(redirectUri);
+	url.searchParams.set("error", "access_denied");
+	url.searchParams.set("error_description", "The user denied the authorization request");
+	if (state) url.searchParams.set("state", state);
+	return url.toString();
+}
+
+//#endregion
+export { handleAuthorizationApproval as n, handleAuthorizationCodeExchange as r, buildDeniedRedirect as t };

package/dist/oauth-clients-CvWatf5p.mjs

@@ -0,0 +1,298 @@
+import { o as getExperimentalSiteContextWorkflowScopesDisabledMessage, r as disabledExperimentalSiteContextWorkflowScopes } from "./experimental-workflows-DldxJlqV.mjs";
+import { o as validateScopes } from "./api-tokens-DzloJxuh.mjs";
+
+//#region src/api/oauth/redirect-uri.ts
+/**
+* Validate a redirect URI per OAuth 2.1 security requirements.
+*
+* Allows localhost / loopback redirect URIs over HTTP for native clients,
+* and any HTTPS URL for web-based flows.
+*/
+function validateRedirectUri(uri) {
+	try {
+		const url = new URL(uri);
+		if (uri.startsWith("//")) return "Protocol-relative redirect URIs are not allowed";
+		if (url.protocol === "http:") {
+			const host = url.hostname;
+			if (host === "127.0.0.1" || host === "localhost" || host === "[::1]") return null;
+			return "HTTP redirect URIs are only allowed for localhost";
+		}
+		if (url.protocol === "https:") return null;
+		return `Unsupported redirect URI scheme: ${url.protocol}`;
+	} catch {
+		return "Invalid redirect URI";
+	}
+}
+
+//#endregion
+//#region src/api/handlers/oauth-clients.ts
+/** Parse a JSON string column into a typed value. */
+function parseJsonColumn(value) {
+	return JSON.parse(value);
+}
+function validateRegisteredRedirectUris(redirectUris) {
+	for (const redirectUri of redirectUris) {
+		const error = validateRedirectUri(redirectUri);
+		if (error) return `Invalid redirect URI: ${error}`;
+	}
+	return null;
+}
+function validateClientScopes(scopes) {
+	if (scopes === void 0 || scopes === null) return null;
+	const invalidScopes = validateScopes(scopes, { includeExperimental: true });
+	if (invalidScopes.length > 0) return {
+		success: false,
+		error: {
+			code: "VALIDATION_ERROR",
+			message: "OAuth client scopes contain invalid values",
+			details: { scopes: invalidScopes }
+		}
+	};
+	const requestedWorkflowScopes = disabledExperimentalSiteContextWorkflowScopes(scopes);
+	if (requestedWorkflowScopes.length > 0) return {
+		success: false,
+		error: {
+			code: "NOT_IMPLEMENTED",
+			message: getExperimentalSiteContextWorkflowScopesDisabledMessage(),
+			details: {
+				status: "workflow_oauth_client_scopes_disabled",
+				reason: "workflow_oauth_client_scopes_disabled",
+				scopes: requestedWorkflowScopes
+			}
+		}
+	};
+	return null;
+}
+/**
+* Create a new OAuth client.
+*/
+async function handleOAuthClientCreate(db, input) {
+	try {
+		if (input.redirectUris.length === 0) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: "At least one redirect URI is required"
+			}
+		};
+		const redirectUriError = validateRegisteredRedirectUris(input.redirectUris);
+		if (redirectUriError) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: redirectUriError
+			}
+		};
+		const scopeError = validateClientScopes(input.scopes);
+		if (scopeError) return scopeError;
+		if (await db.selectFrom("_dineway_oauth_clients").select("id").where("id", "=", input.id).executeTakeFirst()) return {
+			success: false,
+			error: {
+				code: "CONFLICT",
+				message: "OAuth client with this ID already exists"
+			}
+		};
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		await db.insertInto("_dineway_oauth_clients").values({
+			id: input.id,
+			name: input.name,
+			redirect_uris: JSON.stringify(input.redirectUris),
+			scopes: input.scopes ? JSON.stringify(input.scopes) : null
+		}).execute();
+		return {
+			success: true,
+			data: {
+				id: input.id,
+				name: input.name,
+				redirectUris: input.redirectUris,
+				scopes: input.scopes ?? null,
+				createdAt: now,
+				updatedAt: now
+			}
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_CREATE_ERROR",
+				message: "Failed to create OAuth client"
+			}
+		};
+	}
+}
+/**
+* List all registered OAuth clients.
+*/
+async function handleOAuthClientList(db) {
+	try {
+		return {
+			success: true,
+			data: { items: (await db.selectFrom("_dineway_oauth_clients").selectAll().orderBy("created_at", "desc").execute()).map((row) => ({
+				id: row.id,
+				name: row.name,
+				redirectUris: parseJsonColumn(row.redirect_uris),
+				scopes: row.scopes ? parseJsonColumn(row.scopes) : null,
+				createdAt: row.created_at,
+				updatedAt: row.updated_at
+			})) }
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_LIST_ERROR",
+				message: "Failed to list OAuth clients"
+			}
+		};
+	}
+}
+/**
+* Get a single OAuth client by ID.
+*/
+async function handleOAuthClientGet(db, clientId) {
+	try {
+		const row = await db.selectFrom("_dineway_oauth_clients").selectAll().where("id", "=", clientId).executeTakeFirst();
+		if (!row) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "OAuth client not found"
+			}
+		};
+		return {
+			success: true,
+			data: {
+				id: row.id,
+				name: row.name,
+				redirectUris: parseJsonColumn(row.redirect_uris),
+				scopes: row.scopes ? parseJsonColumn(row.scopes) : null,
+				createdAt: row.created_at,
+				updatedAt: row.updated_at
+			}
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_GET_ERROR",
+				message: "Failed to get OAuth client"
+			}
+		};
+	}
+}
+/**
+* Update an OAuth client.
+*/
+async function handleOAuthClientUpdate(db, clientId, input) {
+	try {
+		if (!await db.selectFrom("_dineway_oauth_clients").selectAll().where("id", "=", clientId).executeTakeFirst()) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "OAuth client not found"
+			}
+		};
+		if (input.redirectUris !== void 0 && input.redirectUris.length === 0) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: "At least one redirect URI is required"
+			}
+		};
+		if (input.redirectUris !== void 0) {
+			const redirectUriError = validateRegisteredRedirectUris(input.redirectUris);
+			if (redirectUriError) return {
+				success: false,
+				error: {
+					code: "VALIDATION_ERROR",
+					message: redirectUriError
+				}
+			};
+		}
+		const scopeError = validateClientScopes(input.scopes);
+		if (scopeError) return scopeError;
+		const updates = { updated_at: (/* @__PURE__ */ new Date()).toISOString() };
+		if (input.name !== void 0) updates.name = input.name;
+		if (input.redirectUris !== void 0) updates.redirect_uris = JSON.stringify(input.redirectUris);
+		if (input.scopes !== void 0) updates.scopes = input.scopes ? JSON.stringify(input.scopes) : null;
+		await db.updateTable("_dineway_oauth_clients").set(updates).where("id", "=", clientId).execute();
+		const updated = await db.selectFrom("_dineway_oauth_clients").selectAll().where("id", "=", clientId).executeTakeFirst();
+		if (!updated) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "OAuth client not found after update"
+			}
+		};
+		return {
+			success: true,
+			data: {
+				id: updated.id,
+				name: updated.name,
+				redirectUris: parseJsonColumn(updated.redirect_uris),
+				scopes: updated.scopes ? parseJsonColumn(updated.scopes) : null,
+				createdAt: updated.created_at,
+				updatedAt: updated.updated_at
+			}
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_UPDATE_ERROR",
+				message: "Failed to update OAuth client"
+			}
+		};
+	}
+}
+/**
+* Delete an OAuth client.
+*/
+async function handleOAuthClientDelete(db, clientId) {
+	try {
+		if ((await db.deleteFrom("_dineway_oauth_clients").where("id", "=", clientId).executeTakeFirst()).numDeletedRows === 0n) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "OAuth client not found"
+			}
+		};
+		return {
+			success: true,
+			data: { deleted: true }
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_DELETE_ERROR",
+				message: "Failed to delete OAuth client"
+			}
+		};
+	}
+}
+/**
+* Look up a registered OAuth client by ID.
+* Returns the client's redirect URIs or null if the client is not registered.
+*/
+async function lookupOAuthClient(db, clientId) {
+	const row = await db.selectFrom("_dineway_oauth_clients").select(["redirect_uris", "scopes"]).where("id", "=", clientId).executeTakeFirst();
+	if (!row) return null;
+	return {
+		redirectUris: parseJsonColumn(row.redirect_uris),
+		scopes: row.scopes ? parseJsonColumn(row.scopes) : null
+	};
+}
+/**
+* Validate that a redirect URI is in the client's registered set.
+*
+* Comparison is exact string match (per RFC 6749 §3.1.2.3).
+* Returns null if valid, or an error message if not.
+*/
+function validateClientRedirectUri(redirectUri, allowedUris) {
+	if (allowedUris.includes(redirectUri)) return null;
+	return "redirect_uri is not registered for this client";
+}
+
+//#endregion
+export { handleOAuthClientUpdate as a, validateRedirectUri as c, handleOAuthClientList as i, handleOAuthClientDelete as n, lookupOAuthClient as o, handleOAuthClientGet as r, validateClientRedirectUri as s, handleOAuthClientCreate as t };