emdash 1.3.1 → 1.4.0

package/dist/dev-typegen-ZeWYV8Jp.mjs

@@ -1,29 +0,0 @@
-//#region src/astro/dev-typegen.ts
-/**
-* Dev-only signal for regenerating `emdash-env.d.ts` when the schema changes.
-*
-* Schema mutations send an event over the Vite module runner's hot channel;
-* the Astro integration listens for it in Node and does the filesystem work.
-* The hot channel crosses realms (workerd under the Cloudflare adapter), and
-* runtime modules stay free of Node-only I/O. When HMR is disabled there is
-* no hot channel, so the integration also registers a same-realm global.
-*/
-const DEV_TYPEGEN_REFRESH_EVENT = "emdash:typegen-refresh";
-const DEV_TYPEGEN_REFRESH_GLOBAL = "__emdashDevTypegenRefresh";
-function refreshDevTypes() {
-	if (typeof import.meta.env === "undefined" || !import.meta.env.DEV) return;
-	try {
-		if (import.meta.hot) {
-			import.meta.hot.send(DEV_TYPEGEN_REFRESH_EVENT);
-			return;
-		}
-		const fn = Reflect.get(globalThis, DEV_TYPEGEN_REFRESH_GLOBAL);
-		if (typeof fn === "function") fn();
-	} catch (error) {
-		console.error("[emdash] dev typegen refresh failed:", error);
-	}
-}
-
-//#endregion
-export { DEV_TYPEGEN_REFRESH_GLOBAL as n, refreshDevTypes as r, DEV_TYPEGEN_REFRESH_EVENT as t };
-//# sourceMappingURL=dev-typegen-ZeWYV8Jp.mjs.map

package/dist/dev-typegen-ZeWYV8Jp.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"dev-typegen-ZeWYV8Jp.mjs","names":[],"sources":["../src/astro/dev-typegen.ts"],"sourcesContent":["/**\n * Dev-only signal for regenerating `emdash-env.d.ts` when the schema changes.\n *\n * Schema mutations send an event over the Vite module runner's hot channel;\n * the Astro integration listens for it in Node and does the filesystem work.\n * The hot channel crosses realms (workerd under the Cloudflare adapter), and\n * runtime modules stay free of Node-only I/O. When HMR is disabled there is\n * no hot channel, so the integration also registers a same-realm global.\n */\n\nexport const DEV_TYPEGEN_REFRESH_EVENT = \"emdash:typegen-refresh\";\n\nexport const DEV_TYPEGEN_REFRESH_GLOBAL = \"__emdashDevTypegenRefresh\";\n\nexport function refreshDevTypes(): void {\n\tif (typeof import.meta.env === \"undefined\" || !import.meta.env.DEV) return;\n\n\ttry {\n\t\tif (import.meta.hot) {\n\t\t\timport.meta.hot.send(DEV_TYPEGEN_REFRESH_EVENT);\n\t\t\treturn;\n\t\t}\n\t\tconst fn = Reflect.get(globalThis, DEV_TYPEGEN_REFRESH_GLOBAL);\n\t\tif (typeof fn === \"function\") fn();\n\t} catch (error) {\n\t\tconsole.error(\"[emdash] dev typegen refresh failed:\", error);\n\t}\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAa,4BAA4B;AAEzC,MAAa,6BAA6B;AAE1C,SAAgB,kBAAwB;AACvC,KAAI,OAAO,OAAO,KAAK,QAAQ,eAAe,CAAC,OAAO,KAAK,IAAI,IAAK;AAEpE,KAAI;AACH,MAAI,OAAO,KAAK,KAAK;AACpB,UAAO,KAAK,IAAI,KAAK,0BAA0B;AAC/C;;EAED,MAAM,KAAK,QAAQ,IAAI,YAAY,2BAA2B;AAC9D,MAAI,OAAO,OAAO,WAAY,KAAI;UAC1B,OAAO;AACf,UAAQ,MAAM,wCAAwC,MAAM"}

package/dist/device-flow-BbYNZ9Xi.mjs

@@ -1,521 +0,0 @@
-import { t as withTransaction } from "./transaction-CkoQ5wqQ.mjs";
-import { i as generatePrefixedToken, o as hashApiToken, s as isValidScope, t as TOKEN_PREFIXES } from "./api-tokens-C7l0GUAF.mjs";
-import { o as lookupOAuthClient } from "./oauth-clients-C_osi0PU.mjs";
-import { t as lookupUserRoleAndStatus } from "./oauth-user-lookup-z77Ee0Hm.mjs";
-import { clampScopes } from "@emdash-cms/auth";
-import { generateCodeVerifier } from "arctic";
-
-//#region src/api/handlers/device-flow.ts
-/**
-* OAuth Device Flow handlers (RFC 8628).
-*
-* EmDash acts as an OAuth 2.0 authorization server. The CLI requests
-* a device code, displays a URL + user code, and polls for a token.
-* The user opens a browser, logs in, enters the code, and the CLI gets
-* an access + refresh token pair.
-*
-* Uses arctic for code generation and @emdash-cms/auth for token utilities.
-*/
-/** Device codes expire after 15 minutes */
-const DEVICE_CODE_TTL_SECONDS = 900;
-/** Default polling interval in seconds */
-const DEFAULT_INTERVAL = 5;
-/** RFC 8628 §3.5: interval increase on slow_down */
-const SLOW_DOWN_INCREMENT = 5;
-/** Maximum slow_down interval cap (seconds) */
-const MAX_SLOW_DOWN_INTERVAL = 60;
-/** Access token TTL: 1 hour */
-const ACCESS_TOKEN_TTL_SECONDS = 3600;
-/** Refresh token TTL: 90 days */
-const REFRESH_TOKEN_TTL_SECONDS = 2160 * 60 * 60;
-/** Default scopes for CLI login */
-const DEFAULT_SCOPES = [
-	"content:read",
-	"content:write",
-	"media:read",
-	"media:write",
-	"schema:read"
-];
-/** Pattern to normalize user codes (strip hyphens) */
-const HYPHEN_PATTERN = /-/g;
-/** Characters for user codes (uppercase, no ambiguous chars like 0/O, 1/I) */
-const USER_CODE_CHARS = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
-/** Generate a short human-readable user code (XXXX-XXXX) */
-function generateUserCode() {
-	const bytes = new Uint8Array(8);
-	crypto.getRandomValues(bytes);
-	const chars = Array.from(bytes, (b) => USER_CODE_CHARS[b % 32]).join("");
-	return `${chars.slice(0, 4)}-${chars.slice(4, 8)}`;
-}
-/** Get an ISO datetime string offset from now */
-function expiresAt(seconds) {
-	return new Date(Date.now() + seconds * 1e3).toISOString();
-}
-/** Validate and normalize scopes. Returns validated scope list. */
-function normalizeScopes(requested) {
-	if (!requested || requested.length === 0) return [...DEFAULT_SCOPES];
-	return [...new Set(requested.filter(isValidScope))];
-}
-/**
-* Scopes an approval by a user with `role` would grant:
-* requested_scopes ∩ scopesForRole(role). Approval and the approval-page
-* lookup must agree, so both go through here.
-*/
-function grantableScopes(requested, role) {
-	return clampScopes(requested, role);
-}
-/** Find a pending device code by user code, ignoring hyphens and case. Does not check expiry. */
-async function findPendingDeviceCode(db, userCode) {
-	const chars = userCode.replace(HYPHEN_PATTERN, "").toUpperCase();
-	if (chars.length !== 8) return void 0;
-	return db.selectFrom("_emdash_device_codes").selectAll().where("user_code", "=", `${chars.slice(0, 4)}-${chars.slice(4)}`).where("status", "=", "pending").executeTakeFirst();
-}
-/**
-* POST /oauth/device/code
-*
-* Issue a device code + user code. The CLI displays the user code
-* and tells the user to open the verification URI.
-*/
-async function handleDeviceCodeRequest(db, input, verificationUri) {
-	try {
-		const scopes = normalizeScopes(input.scope ? input.scope.split(" ").filter(Boolean) : []);
-		if (scopes.length === 0) return {
-			success: false,
-			error: {
-				code: "INVALID_SCOPE",
-				message: "No valid scopes requested"
-			}
-		};
-		const deviceCode = generateCodeVerifier();
-		const userCode = generateUserCode();
-		const expires = expiresAt(DEVICE_CODE_TTL_SECONDS);
-		await db.insertInto("_emdash_device_codes").values({
-			device_code: deviceCode,
-			user_code: userCode,
-			scopes: JSON.stringify(scopes),
-			status: "pending",
-			expires_at: expires,
-			interval: DEFAULT_INTERVAL
-		}).execute();
-		return {
-			success: true,
-			data: {
-				device_code: deviceCode,
-				user_code: userCode,
-				verification_uri: verificationUri,
-				expires_in: DEVICE_CODE_TTL_SECONDS,
-				interval: DEFAULT_INTERVAL
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "DEVICE_CODE_ERROR",
-				message: "Failed to create device code"
-			}
-		};
-	}
-}
-/**
-* POST /oauth/device/token
-*
-* CLI polls this endpoint with the device_code. Returns:
-* - 200 with tokens if authorized
-* - 400 with error "authorization_pending" while waiting
-* - 400 with error "slow_down" if polling too fast
-* - 400 with error "expired_token" if the code expired
-* - 400 with error "access_denied" if the user denied
-*/
-async function handleDeviceTokenExchange(db, input) {
-	try {
-		if (input.grant_type !== "urn:ietf:params:oauth:grant-type:device_code") return {
-			success: false,
-			error: {
-				code: "UNSUPPORTED_GRANT_TYPE",
-				message: "Invalid grant_type"
-			}
-		};
-		const row = await db.selectFrom("_emdash_device_codes").selectAll().where("device_code", "=", input.device_code).executeTakeFirst();
-		if (!row) return {
-			success: false,
-			error: {
-				code: "INVALID_GRANT",
-				message: "Invalid device code"
-			}
-		};
-		const now = /* @__PURE__ */ new Date();
-		if (new Date(row.expires_at) < now) {
-			await db.deleteFrom("_emdash_device_codes").where("device_code", "=", input.device_code).execute();
-			return {
-				success: false,
-				deviceFlowError: "expired_token",
-				error: {
-					code: "expired_token",
-					message: "The device code has expired"
-				}
-			};
-		}
-		if (row.status === "denied") {
-			await db.deleteFrom("_emdash_device_codes").where("device_code", "=", input.device_code).execute();
-			return {
-				success: false,
-				deviceFlowError: "access_denied",
-				error: {
-					code: "access_denied",
-					message: "The user denied the request"
-				}
-			};
-		}
-		if (row.status === "pending") {
-			if (row.last_polled_at) {
-				const lastPolled = new Date(row.last_polled_at);
-				if ((now.getTime() - lastPolled.getTime()) / 1e3 < row.interval) {
-					const newInterval = Math.min(row.interval + SLOW_DOWN_INCREMENT, MAX_SLOW_DOWN_INTERVAL);
-					await db.updateTable("_emdash_device_codes").set({
-						interval: newInterval,
-						last_polled_at: now.toISOString()
-					}).where("device_code", "=", input.device_code).execute();
-					return {
-						success: false,
-						deviceFlowError: "slow_down",
-						deviceFlowInterval: newInterval,
-						error: {
-							code: "slow_down",
-							message: "Polling too fast"
-						}
-					};
-				}
-			}
-			await db.updateTable("_emdash_device_codes").set({ last_polled_at: now.toISOString() }).where("device_code", "=", input.device_code).execute();
-			return {
-				success: false,
-				deviceFlowError: "authorization_pending",
-				error: {
-					code: "authorization_pending",
-					message: "Authorization pending"
-				}
-			};
-		}
-		if (row.status !== "authorized" || !row.user_id) return {
-			success: false,
-			error: {
-				code: "INVALID_GRANT",
-				message: "Invalid device code state"
-			}
-		};
-		const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
-		const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
-		const refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);
-		const refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);
-		const result = await withTransaction(db, async (trx) => {
-			const consumed = await trx.deleteFrom("_emdash_device_codes").where("device_code", "=", input.device_code).where("status", "=", "authorized").returningAll().executeTakeFirst();
-			if (!consumed) return null;
-			if (!consumed.user_id) return null;
-			const scopes = JSON.parse(consumed.scopes);
-			await trx.insertInto("_emdash_oauth_tokens").values({
-				token_hash: accessToken.hash,
-				token_type: "access",
-				user_id: consumed.user_id,
-				scopes: JSON.stringify(scopes),
-				client_type: "cli",
-				expires_at: accessExpires,
-				refresh_token_hash: refreshToken.hash
-			}).execute();
-			await trx.insertInto("_emdash_oauth_tokens").values({
-				token_hash: refreshToken.hash,
-				token_type: "refresh",
-				user_id: consumed.user_id,
-				scopes: JSON.stringify(scopes),
-				client_type: "cli",
-				expires_at: refreshExpires,
-				refresh_token_hash: null
-			}).execute();
-			return { scopes };
-		});
-		if (!result) return {
-			success: false,
-			error: {
-				code: "INVALID_GRANT",
-				message: "Device code already consumed"
-			}
-		};
-		return {
-			success: true,
-			data: {
-				access_token: accessToken.raw,
-				refresh_token: refreshToken.raw,
-				token_type: "Bearer",
-				expires_in: ACCESS_TOKEN_TTL_SECONDS,
-				scope: result.scopes.join(" ")
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "TOKEN_EXCHANGE_ERROR",
-				message: "Failed to exchange device code"
-			}
-		};
-	}
-}
-/**
-* GET /oauth/device/authorize
-*
-* Returns the scopes a pending device code requested, and the subset an
-* approval by this user would grant, so the approval page can show them
-* before the user approves. Reveals nothing else about the device code.
-*/
-async function handleDeviceCodeLookup(db, userRole, input) {
-	try {
-		const match = await findPendingDeviceCode(db, input.user_code);
-		if (!match) return {
-			success: false,
-			error: {
-				code: "INVALID_CODE",
-				message: "Invalid or expired code"
-			}
-		};
-		if (new Date(match.expires_at) < /* @__PURE__ */ new Date()) return {
-			success: false,
-			error: {
-				code: "EXPIRED_CODE",
-				message: "This code has expired"
-			}
-		};
-		const requestedScopes = JSON.parse(match.scopes);
-		return {
-			success: true,
-			data: {
-				requestedScopes,
-				grantedScopes: grantableScopes(requestedScopes, userRole)
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "DEVICE_CODE_LOOKUP_ERROR",
-				message: "Failed to look up device code"
-			}
-		};
-	}
-}
-/**
-* POST /oauth/device/authorize
-*
-* The user submits the user_code after logging in via the browser.
-* This authorizes the device code, allowing the CLI to exchange it for tokens.
-*
-* Scopes are clamped to the user's role at this point. The stored scopes
-* are replaced with the intersection of requested scopes and the scopes
-* the user's role permits. This prevents scope escalation.
-*/
-async function handleDeviceAuthorize(db, userId, userRole, input) {
-	try {
-		const match = await findPendingDeviceCode(db, input.user_code);
-		if (!match) return {
-			success: false,
-			error: {
-				code: "INVALID_CODE",
-				message: "Invalid or expired code"
-			}
-		};
-		if (new Date(match.expires_at) < /* @__PURE__ */ new Date()) {
-			await db.deleteFrom("_emdash_device_codes").where("device_code", "=", match.device_code).execute();
-			return {
-				success: false,
-				error: {
-					code: "EXPIRED_CODE",
-					message: "This code has expired"
-				}
-			};
-		}
-		if ((input.action ?? "approve") === "deny") {
-			await db.updateTable("_emdash_device_codes").set({ status: "denied" }).where("device_code", "=", match.device_code).execute();
-			return {
-				success: true,
-				data: { authorized: false }
-			};
-		}
-		const effectiveScopes = grantableScopes(JSON.parse(match.scopes), userRole);
-		if (effectiveScopes.length === 0) return {
-			success: false,
-			error: {
-				code: "INSUFFICIENT_ROLE",
-				message: "Your role does not permit any of the requested scopes"
-			}
-		};
-		await db.updateTable("_emdash_device_codes").set({
-			status: "authorized",
-			user_id: userId,
-			scopes: JSON.stringify(effectiveScopes)
-		}).where("device_code", "=", match.device_code).execute();
-		return {
-			success: true,
-			data: { authorized: true }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "AUTHORIZE_ERROR",
-				message: "Failed to authorize device"
-			}
-		};
-	}
-}
-/**
-* POST /oauth/token/refresh
-*
-* Exchange a refresh token for a new access token.
-* The refresh token itself is not rotated (per spec: optional rotation).
-*/
-async function handleTokenRefresh(db, input) {
-	try {
-		if (input.grant_type !== "refresh_token") return {
-			success: false,
-			error: {
-				code: "UNSUPPORTED_GRANT_TYPE",
-				message: "Invalid grant_type"
-			}
-		};
-		if (!input.refresh_token.startsWith(TOKEN_PREFIXES.OAUTH_REFRESH)) return {
-			success: false,
-			error: {
-				code: "INVALID_GRANT",
-				message: "Invalid refresh token format"
-			}
-		};
-		const refreshHash = hashApiToken(input.refresh_token);
-		const row = await db.selectFrom("_emdash_oauth_tokens").selectAll().where("token_hash", "=", refreshHash).where("token_type", "=", "refresh").executeTakeFirst();
-		if (!row) return {
-			success: false,
-			error: {
-				code: "INVALID_GRANT",
-				message: "Invalid refresh token"
-			}
-		};
-		if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) {
-			await db.deleteFrom("_emdash_oauth_tokens").where("token_hash", "=", refreshHash).execute();
-			await db.deleteFrom("_emdash_oauth_tokens").where("refresh_token_hash", "=", refreshHash).execute();
-			return {
-				success: false,
-				error: {
-					code: "INVALID_GRANT",
-					message: "Refresh token expired"
-				}
-			};
-		}
-		const userInfo = await lookupUserRoleAndStatus(db, row.user_id);
-		if (!userInfo) {
-			await db.deleteFrom("_emdash_oauth_tokens").where("user_id", "=", row.user_id).execute();
-			return {
-				success: false,
-				error: {
-					code: "INVALID_GRANT",
-					message: "User not found"
-				}
-			};
-		}
-		if (userInfo.disabled) {
-			await db.deleteFrom("_emdash_oauth_tokens").where("user_id", "=", row.user_id).execute();
-			return {
-				success: false,
-				error: {
-					code: "INVALID_GRANT",
-					message: "User account is disabled"
-				}
-			};
-		}
-		let scopes = clampScopes(JSON.parse(row.scopes), userInfo.role);
-		if (row.client_id) {
-			const client = await lookupOAuthClient(db, row.client_id);
-			if (client?.scopes?.length) scopes = scopes.filter((s) => client.scopes.includes(s));
-		}
-		if (scopes.length === 0) {
-			await db.deleteFrom("_emdash_oauth_tokens").where("token_hash", "=", refreshHash).execute();
-			await db.deleteFrom("_emdash_oauth_tokens").where("refresh_token_hash", "=", refreshHash).execute();
-			return {
-				success: false,
-				error: {
-					code: "INVALID_GRANT",
-					message: "User role no longer supports any of the token's scopes"
-				}
-			};
-		}
-		await db.deleteFrom("_emdash_oauth_tokens").where("refresh_token_hash", "=", refreshHash).where("token_type", "=", "access").execute();
-		const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
-		const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
-		await db.insertInto("_emdash_oauth_tokens").values({
-			token_hash: accessToken.hash,
-			token_type: "access",
-			user_id: row.user_id,
-			scopes: JSON.stringify(scopes),
-			client_type: row.client_type,
-			expires_at: accessExpires,
-			refresh_token_hash: refreshHash
-		}).execute();
-		return {
-			success: true,
-			data: {
-				access_token: accessToken.raw,
-				refresh_token: input.refresh_token,
-				token_type: "Bearer",
-				expires_in: ACCESS_TOKEN_TTL_SECONDS,
-				scope: scopes.join(" ")
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "TOKEN_REFRESH_ERROR",
-				message: "Failed to refresh token"
-			}
-		};
-	}
-}
-/**
-* POST /oauth/token/revoke
-*
-* Revoke an access or refresh token. If a refresh token is revoked,
-* also revoke all associated access tokens.
-*
-* Per RFC 7009, this endpoint always returns 200 (even for invalid tokens).
-*/
-async function handleTokenRevoke(db, input) {
-	try {
-		const hash = hashApiToken(input.token);
-		const row = await db.selectFrom("_emdash_oauth_tokens").select([
-			"token_hash",
-			"token_type",
-			"refresh_token_hash"
-		]).where("token_hash", "=", hash).executeTakeFirst();
-		if (!row) return {
-			success: true,
-			data: { revoked: true }
-		};
-		if (row.token_type === "refresh") {
-			await db.deleteFrom("_emdash_oauth_tokens").where("refresh_token_hash", "=", hash).execute();
-			await db.deleteFrom("_emdash_oauth_tokens").where("token_hash", "=", hash).execute();
-		} else await db.deleteFrom("_emdash_oauth_tokens").where("token_hash", "=", hash).execute();
-		return {
-			success: true,
-			data: { revoked: true }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "TOKEN_REVOKE_ERROR",
-				message: "Failed to revoke token"
-			}
-		};
-	}
-}
-
-//#endregion
-export { handleTokenRefresh as a, handleDeviceTokenExchange as i, handleDeviceCodeLookup as n, handleTokenRevoke as o, handleDeviceCodeRequest as r, handleDeviceAuthorize as t };
-//# sourceMappingURL=device-flow-BbYNZ9Xi.mjs.map

package/dist/device-flow-BbYNZ9Xi.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"device-flow-BbYNZ9Xi.mjs","names":[],"sources":["../src/api/handlers/device-flow.ts"],"sourcesContent":["/**\n * OAuth Device Flow handlers (RFC 8628).\n *\n * EmDash acts as an OAuth 2.0 authorization server. The CLI requests\n * a device code, displays a URL + user code, and polls for a token.\n * The user opens a browser, logs in, enters the code, and the CLI gets\n * an access + refresh token pair.\n *\n * Uses arctic for code generation and @emdash-cms/auth for token utilities.\n */\n\nimport { clampScopes } from \"@emdash-cms/auth\";\nimport type { RoleLevel } from \"@emdash-cms/auth\";\nimport { generateCodeVerifier } from \"arctic\";\nimport type { Kysely, Selectable } from \"kysely\";\n\nimport {\n\tgeneratePrefixedToken,\n\thashApiToken,\n\tisValidScope,\n\tTOKEN_PREFIXES,\n} from \"../../auth/api-tokens.js\";\nimport { withTransaction } from \"../../database/transaction.js\";\nimport type { Database, DeviceCodeTable } from \"../../database/types.js\";\nimport type { ApiResult } from \"../types.js\";\nimport { lookupOAuthClient } from \"./oauth-clients.js\";\nimport { lookupUserRoleAndStatus } from \"./oauth-user-lookup.js\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Device codes expire after 15 minutes */\nconst DEVICE_CODE_TTL_SECONDS = 15 * 60;\n\n/** Default polling interval in seconds */\nconst DEFAULT_INTERVAL = 5;\n\n/** RFC 8628 §3.5: interval increase on slow_down */\nconst SLOW_DOWN_INCREMENT = 5;\n\n/** Maximum slow_down interval cap (seconds) */\nconst MAX_SLOW_DOWN_INTERVAL = 60;\n\n/** Access token TTL: 1 hour */\nconst ACCESS_TOKEN_TTL_SECONDS = 60 * 60;\n\n/** Refresh token TTL: 90 days */\nconst REFRESH_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;\n\n/** Default scopes for CLI login */\nconst DEFAULT_SCOPES = [\n\t\"content:read\",\n\t\"content:write\",\n\t\"media:read\",\n\t\"media:write\",\n\t\"schema:read\",\n] as const;\n\n/** Pattern to normalize user codes (strip hyphens) */\nconst HYPHEN_PATTERN = /-/g;\n\n/** Characters for user codes (uppercase, no ambiguous chars like 0/O, 1/I) */\nconst USER_CODE_CHARS = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface DeviceCodeResponse {\n\tdevice_code: string;\n\tuser_code: string;\n\tverification_uri: string;\n\texpires_in: number;\n\tinterval: number;\n}\n\nexport interface TokenResponse {\n\taccess_token: string;\n\trefresh_token: string;\n\ttoken_type: \"Bearer\";\n\texpires_in: number;\n\tscope: string;\n}\n\n// RFC 8628 error codes\nexport type DeviceFlowError =\n\t| \"authorization_pending\"\n\t| \"slow_down\"\n\t| \"expired_token\"\n\t| \"access_denied\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/** Generate a short human-readable user code (XXXX-XXXX) */\nfunction generateUserCode(): string {\n\tconst bytes = new Uint8Array(8);\n\tcrypto.getRandomValues(bytes);\n\tconst chars = Array.from(bytes, (b) => USER_CODE_CHARS[b % USER_CODE_CHARS.length]).join(\"\");\n\treturn `${chars.slice(0, 4)}-${chars.slice(4, 8)}`;\n}\n\n/** Get an ISO datetime string offset from now */\nfunction expiresAt(seconds: number): string {\n\treturn new Date(Date.now() + seconds * 1000).toISOString();\n}\n\n/** Validate and normalize scopes. Returns validated scope list. */\nfunction normalizeScopes(requested?: string[]): string[] {\n\tif (!requested || requested.length === 0) {\n\t\treturn [...DEFAULT_SCOPES];\n\t}\n\treturn [...new Set(requested.filter(isValidScope))];\n}\n\n/**\n * Scopes an approval by a user with `role` would grant:\n * requested_scopes ∩ scopesForRole(role). Approval and the approval-page\n * lookup must agree, so both go through here.\n */\nfunction grantableScopes(requested: string[], role: RoleLevel): string[] {\n\treturn clampScopes(requested, role);\n}\n\n/** Find a pending device code by user code, ignoring hyphens and case. Does not check expiry. */\nasync function findPendingDeviceCode(\n\tdb: Kysely<Database>,\n\tuserCode: string,\n): Promise<Selectable<DeviceCodeTable> | undefined> {\n\tconst chars = userCode.replace(HYPHEN_PATTERN, \"\").toUpperCase();\n\tif (chars.length !== 8) return undefined;\n\n\t// Stored codes always have the generateUserCode() shape.\n\treturn db\n\t\t.selectFrom(\"_emdash_device_codes\")\n\t\t.selectAll()\n\t\t.where(\"user_code\", \"=\", `${chars.slice(0, 4)}-${chars.slice(4)}`)\n\t\t.where(\"status\", \"=\", \"pending\")\n\t\t.executeTakeFirst();\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * POST /oauth/device/code\n *\n * Issue a device code + user code. The CLI displays the user code\n * and tells the user to open the verification URI.\n */\nexport async function handleDeviceCodeRequest(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\tclient_id?: string;\n\t\tscope?: string;\n\t},\n\tverificationUri: string,\n): Promise<ApiResult<DeviceCodeResponse>> {\n\ttry {\n\t\t// Note: client_id is accepted but not validated against _emdash_oauth_clients\n\t\t// because the CLI uses a well-known built-in client ID (\"emdash-cli\") that\n\t\t// isn't stored in the DB. Full client_id validation + scope clamping for the\n\t\t// device flow is tracked as a follow-up.\n\n\t\t// Parse and validate scopes\n\t\tconst requestedScopes = input.scope ? input.scope.split(\" \").filter(Boolean) : [];\n\t\tconst scopes = normalizeScopes(requestedScopes);\n\n\t\tif (scopes.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_SCOPE\", message: \"No valid scopes requested\" },\n\t\t\t};\n\t\t}\n\n\t\tconst deviceCode = generateCodeVerifier();\n\t\tconst userCode = generateUserCode();\n\t\tconst expires = expiresAt(DEVICE_CODE_TTL_SECONDS);\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_device_codes\")\n\t\t\t.values({\n\t\t\t\tdevice_code: deviceCode,\n\t\t\t\tuser_code: userCode,\n\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\tstatus: \"pending\",\n\t\t\t\texpires_at: expires,\n\t\t\t\tinterval: DEFAULT_INTERVAL,\n\t\t\t})\n\t\t\t.execute();\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\tdevice_code: deviceCode,\n\t\t\t\tuser_code: userCode,\n\t\t\t\tverification_uri: verificationUri,\n\t\t\t\texpires_in: DEVICE_CODE_TTL_SECONDS,\n\t\t\t\tinterval: DEFAULT_INTERVAL,\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"DEVICE_CODE_ERROR\",\n\t\t\t\tmessage: \"Failed to create device code\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/device/token\n *\n * CLI polls this endpoint with the device_code. Returns:\n * - 200 with tokens if authorized\n * - 400 with error \"authorization_pending\" while waiting\n * - 400 with error \"slow_down\" if polling too fast\n * - 400 with error \"expired_token\" if the code expired\n * - 400 with error \"access_denied\" if the user denied\n */\nexport async function handleDeviceTokenExchange(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\tdevice_code: string;\n\t\tgrant_type: string;\n\t},\n): Promise<\n\tApiResult<TokenResponse> & { deviceFlowError?: DeviceFlowError; deviceFlowInterval?: number }\n> {\n\ttry {\n\t\t// Validate grant_type\n\t\tif (input.grant_type !== \"urn:ietf:params:oauth:grant-type:device_code\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"UNSUPPORTED_GRANT_TYPE\", message: \"Invalid grant_type\" },\n\t\t\t};\n\t\t}\n\n\t\t// Look up the device code\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_device_codes\")\n\t\t\t.selectAll()\n\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid device code\" },\n\t\t\t};\n\t\t}\n\n\t\tconst now = new Date();\n\n\t\t// Check expiry\n\t\tif (new Date(row.expires_at) < now) {\n\t\t\t// Clean up expired code\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\tdeviceFlowError: \"expired_token\",\n\t\t\t\terror: { code: \"expired_token\", message: \"The device code has expired\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check status\n\t\tif (row.status === \"denied\") {\n\t\t\t// Clean up denied code\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\tdeviceFlowError: \"access_denied\",\n\t\t\t\terror: { code: \"access_denied\", message: \"The user denied the request\" },\n\t\t\t};\n\t\t}\n\n\t\tif (row.status === \"pending\") {\n\t\t\t// RFC 8628 §3.5: slow_down enforcement during polling phase.\n\t\t\t// Only applies while waiting for authorization — once authorized,\n\t\t\t// the final exchange proceeds without throttling.\n\t\t\tif (row.last_polled_at) {\n\t\t\t\tconst lastPolled = new Date(row.last_polled_at);\n\t\t\t\tconst elapsedSeconds = (now.getTime() - lastPolled.getTime()) / 1000;\n\n\t\t\t\tif (elapsedSeconds < row.interval) {\n\t\t\t\t\t// Too fast — increase interval by 5s per RFC 8628 §3.5, capped at 60s\n\t\t\t\t\tconst newInterval = Math.min(row.interval + SLOW_DOWN_INCREMENT, MAX_SLOW_DOWN_INTERVAL);\n\t\t\t\t\tawait db\n\t\t\t\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t\t\t\t.set({\n\t\t\t\t\t\t\tinterval: newInterval,\n\t\t\t\t\t\t\tlast_polled_at: now.toISOString(),\n\t\t\t\t\t\t})\n\t\t\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t\t\t.execute();\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\tdeviceFlowError: \"slow_down\",\n\t\t\t\t\t\tdeviceFlowInterval: newInterval,\n\t\t\t\t\t\terror: { code: \"slow_down\", message: \"Polling too fast\" },\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Update last_polled_at for future slow_down checks\n\t\t\tawait db\n\t\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t\t.set({ last_polled_at: now.toISOString() })\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\tdeviceFlowError: \"authorization_pending\",\n\t\t\t\terror: { code: \"authorization_pending\", message: \"Authorization pending\" },\n\t\t\t};\n\t\t}\n\n\t\tif (row.status !== \"authorized\" || !row.user_id) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid device code state\" },\n\t\t\t};\n\t\t}\n\n\t\t// Generate tokens before consuming the device code so that if\n\t\t// generation fails, the code is still available for retry.\n\t\tconst accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);\n\t\tconst accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);\n\t\tconst refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);\n\t\tconst refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);\n\n\t\t// Atomically consume the device code and create tokens in a single\n\t\t// transaction. DELETE...RETURNING prevents TOCTOU: two concurrent\n\t\t// requests race on the DELETE, only one gets a row back. Wrapping\n\t\t// in a transaction ensures the code isn't consumed if token storage fails.\n\t\tconst result = await withTransaction(db, async (trx) => {\n\t\t\tconst consumed = await trx\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.where(\"status\", \"=\", \"authorized\")\n\t\t\t\t.returningAll()\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!consumed) return null;\n\n\t\t\tif (!consumed.user_id) return null;\n\n\t\t\tconst scopes = JSON.parse(consumed.scopes) as string[];\n\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t\t.values({\n\t\t\t\t\ttoken_hash: accessToken.hash,\n\t\t\t\t\ttoken_type: \"access\",\n\t\t\t\t\tuser_id: consumed.user_id,\n\t\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\t\tclient_type: \"cli\",\n\t\t\t\t\texpires_at: accessExpires,\n\t\t\t\t\trefresh_token_hash: refreshToken.hash,\n\t\t\t\t})\n\t\t\t\t.execute();\n\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t\t.values({\n\t\t\t\t\ttoken_hash: refreshToken.hash,\n\t\t\t\t\ttoken_type: \"refresh\",\n\t\t\t\t\tuser_id: consumed.user_id,\n\t\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\t\tclient_type: \"cli\",\n\t\t\t\t\texpires_at: refreshExpires,\n\t\t\t\t\trefresh_token_hash: null,\n\t\t\t\t})\n\t\t\t\t.execute();\n\n\t\t\treturn { scopes };\n\t\t});\n\n\t\tif (!result) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Device code already consumed\" },\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\taccess_token: accessToken.raw,\n\t\t\t\trefresh_token: refreshToken.raw,\n\t\t\t\ttoken_type: \"Bearer\",\n\t\t\t\texpires_in: ACCESS_TOKEN_TTL_SECONDS,\n\t\t\t\tscope: result.scopes.join(\" \"),\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_EXCHANGE_ERROR\",\n\t\t\t\tmessage: \"Failed to exchange device code\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * GET /oauth/device/authorize\n *\n * Returns the scopes a pending device code requested, and the subset an\n * approval by this user would grant, so the approval page can show them\n * before the user approves. Reveals nothing else about the device code.\n */\nexport async function handleDeviceCodeLookup(\n\tdb: Kysely<Database>,\n\tuserRole: RoleLevel,\n\tinput: { user_code: string },\n): Promise<ApiResult<{ requestedScopes: string[]; grantedScopes: string[] }>> {\n\ttry {\n\t\tconst match = await findPendingDeviceCode(db, input.user_code);\n\n\t\tif (!match) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CODE\", message: \"Invalid or expired code\" },\n\t\t\t};\n\t\t}\n\n\t\tif (new Date(match.expires_at) < new Date()) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"EXPIRED_CODE\", message: \"This code has expired\" },\n\t\t\t};\n\t\t}\n\n\t\tconst requestedScopes = JSON.parse(match.scopes) as string[];\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { requestedScopes, grantedScopes: grantableScopes(requestedScopes, userRole) },\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"DEVICE_CODE_LOOKUP_ERROR\", message: \"Failed to look up device code\" },\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/device/authorize\n *\n * The user submits the user_code after logging in via the browser.\n * This authorizes the device code, allowing the CLI to exchange it for tokens.\n *\n * Scopes are clamped to the user's role at this point. The stored scopes\n * are replaced with the intersection of requested scopes and the scopes\n * the user's role permits. This prevents scope escalation.\n */\nexport async function handleDeviceAuthorize(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tuserRole: RoleLevel,\n\tinput: {\n\t\tuser_code: string;\n\t\taction?: \"approve\" | \"deny\";\n\t},\n): Promise<ApiResult<{ authorized: boolean }>> {\n\ttry {\n\t\tconst match = await findPendingDeviceCode(db, input.user_code);\n\n\t\tif (!match) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CODE\", message: \"Invalid or expired code\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check expiry\n\t\tif (new Date(match.expires_at) < new Date()) {\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", match.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"EXPIRED_CODE\", message: \"This code has expired\" },\n\t\t\t};\n\t\t}\n\n\t\tconst action = input.action ?? \"approve\";\n\n\t\tif (action === \"deny\") {\n\t\t\tawait db\n\t\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t\t.set({ status: \"denied\" })\n\t\t\t\t.where(\"device_code\", \"=\", match.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn { success: true, data: { authorized: false } };\n\t\t}\n\n\t\tconst effectiveScopes = grantableScopes(JSON.parse(match.scopes) as string[], userRole);\n\n\t\tif (effectiveScopes.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INSUFFICIENT_ROLE\",\n\t\t\t\t\tmessage: \"Your role does not permit any of the requested scopes\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Approve: set user_id, status, and clamped scopes\n\t\tawait db\n\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t.set({\n\t\t\t\tstatus: \"authorized\",\n\t\t\t\tuser_id: userId,\n\t\t\t\tscopes: JSON.stringify(effectiveScopes),\n\t\t\t})\n\t\t\t.where(\"device_code\", \"=\", match.device_code)\n\t\t\t.execute();\n\n\t\treturn { success: true, data: { authorized: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"AUTHORIZE_ERROR\",\n\t\t\t\tmessage: \"Failed to authorize device\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/token/refresh\n *\n * Exchange a refresh token for a new access token.\n * The refresh token itself is not rotated (per spec: optional rotation).\n */\nexport async function handleTokenRefresh(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\trefresh_token: string;\n\t\tgrant_type: string;\n\t},\n): Promise<ApiResult<TokenResponse>> {\n\ttry {\n\t\tif (input.grant_type !== \"refresh_token\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"UNSUPPORTED_GRANT_TYPE\", message: \"Invalid grant_type\" },\n\t\t\t};\n\t\t}\n\n\t\tif (!input.refresh_token.startsWith(TOKEN_PREFIXES.OAUTH_REFRESH)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid refresh token format\" },\n\t\t\t};\n\t\t}\n\n\t\tconst refreshHash = hashApiToken(input.refresh_token);\n\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t\t.selectAll()\n\t\t\t.where(\"token_hash\", \"=\", refreshHash)\n\t\t\t.where(\"token_type\", \"=\", \"refresh\")\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid refresh token\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check expiry\n\t\tif (new Date(row.expires_at) < new Date()) {\n\t\t\t// Clean up expired refresh token and its access tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", refreshHash).execute();\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_oauth_tokens\")\n\t\t\t\t.where(\"refresh_token_hash\", \"=\", refreshHash)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Refresh token expired\" },\n\t\t\t};\n\t\t}\n\n\t\t// SEC-42: Revalidate user role before issuing new access token.\n\t\t// SEC-43: Reject refresh if user is disabled or deleted.\n\t\tconst userInfo = await lookupUserRoleAndStatus(db, row.user_id);\n\t\tif (!userInfo) {\n\t\t\t// User no longer exists — revoke all their tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"user_id\", \"=\", row.user_id).execute();\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"User not found\" },\n\t\t\t};\n\t\t}\n\n\t\tif (userInfo.disabled) {\n\t\t\t// User is disabled — revoke all their tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"user_id\", \"=\", row.user_id).execute();\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"User account is disabled\" },\n\t\t\t};\n\t\t}\n\n\t\t// Revalidate stored scopes against the user's current role.\n\t\t// A demoted user's refresh token may carry stale elevated scopes.\n\t\tconst storedScopes = JSON.parse(row.scopes) as string[];\n\t\tlet scopes = clampScopes(storedScopes, userInfo.role);\n\n\t\t// SEC-41: Intersect with the client's registered scopes (if any).\n\t\t// Same check as the approval path — a client registered with limited\n\t\t// scopes should never receive elevated scopes on refresh, even if the\n\t\t// user's role would allow them.\n\t\tif (row.client_id) {\n\t\t\tconst client = await lookupOAuthClient(db, row.client_id);\n\t\t\tif (client?.scopes?.length) {\n\t\t\t\tscopes = scopes.filter((s: string) => client.scopes!.includes(s));\n\t\t\t}\n\t\t}\n\n\t\tif (scopes.length === 0) {\n\t\t\t// User's role no longer supports any of the token's scopes — revoke\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", refreshHash).execute();\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_oauth_tokens\")\n\t\t\t\t.where(\"refresh_token_hash\", \"=\", refreshHash)\n\t\t\t\t.execute();\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INVALID_GRANT\",\n\t\t\t\t\tmessage: \"User role no longer supports any of the token's scopes\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Delete old access tokens for this refresh token\n\t\tawait db\n\t\t\t.deleteFrom(\"_emdash_oauth_tokens\")\n\t\t\t.where(\"refresh_token_hash\", \"=\", refreshHash)\n\t\t\t.where(\"token_type\", \"=\", \"access\")\n\t\t\t.execute();\n\n\t\t// Generate new access token\n\t\tconst accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);\n\t\tconst accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t.values({\n\t\t\t\ttoken_hash: accessToken.hash,\n\t\t\t\ttoken_type: \"access\",\n\t\t\t\tuser_id: row.user_id,\n\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\tclient_type: row.client_type,\n\t\t\t\texpires_at: accessExpires,\n\t\t\t\trefresh_token_hash: refreshHash,\n\t\t\t})\n\t\t\t.execute();\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\taccess_token: accessToken.raw,\n\t\t\t\trefresh_token: input.refresh_token, // Return same refresh token\n\t\t\t\ttoken_type: \"Bearer\",\n\t\t\t\texpires_in: ACCESS_TOKEN_TTL_SECONDS,\n\t\t\t\tscope: scopes.join(\" \"),\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REFRESH_ERROR\",\n\t\t\t\tmessage: \"Failed to refresh token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/token/revoke\n *\n * Revoke an access or refresh token. If a refresh token is revoked,\n * also revoke all associated access tokens.\n *\n * Per RFC 7009, this endpoint always returns 200 (even for invalid tokens).\n */\nexport async function handleTokenRevoke(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\ttoken: string;\n\t},\n): Promise<ApiResult<{ revoked: boolean }>> {\n\ttry {\n\t\tconst hash = hashApiToken(input.token);\n\n\t\t// Look up the token\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t\t.select([\"token_hash\", \"token_type\", \"refresh_token_hash\"])\n\t\t\t.where(\"token_hash\", \"=\", hash)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\t// Per RFC 7009: always 200, even for invalid tokens\n\t\t\treturn { success: true, data: { revoked: true } };\n\t\t}\n\n\t\tif (row.token_type === \"refresh\") {\n\t\t\t// Revoke refresh token and all its access tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"refresh_token_hash\", \"=\", hash).execute();\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", hash).execute();\n\t\t} else {\n\t\t\t// Revoke just the access token\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", hash).execute();\n\t\t}\n\n\t\treturn { success: true, data: { revoked: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REVOKE_ERROR\",\n\t\t\t\tmessage: \"Failed to revoke token\",\n\t\t\t},\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAiCA,MAAM,0BAA0B;;AAGhC,MAAM,mBAAmB;;AAGzB,MAAM,sBAAsB;;AAG5B,MAAM,yBAAyB;;AAG/B,MAAM,2BAA2B;;AAGjC,MAAM,4BAA4B,OAAU,KAAK;;AAGjD,MAAM,iBAAiB;CACtB;CACA;CACA;CACA;CACA;CACA;;AAGD,MAAM,iBAAiB;;AAGvB,MAAM,kBAAkB;;AAkCxB,SAAS,mBAA2B;CACnC,MAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,QAAO,gBAAgB,MAAM;CAC7B,MAAM,QAAQ,MAAM,KAAK,QAAQ,MAAM,gBAAgB,IAAI,IAAwB,CAAC,KAAK,GAAG;AAC5F,QAAO,GAAG,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,MAAM,GAAG,EAAE;;;AAIjD,SAAS,UAAU,SAAyB;AAC3C,QAAO,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,IAAK,CAAC,aAAa;;;AAI3D,SAAS,gBAAgB,WAAgC;AACxD,KAAI,CAAC,aAAa,UAAU,WAAW,EACtC,QAAO,CAAC,GAAG,eAAe;AAE3B,QAAO,CAAC,GAAG,IAAI,IAAI,UAAU,OAAO,aAAa,CAAC,CAAC;;;;;;;AAQpD,SAAS,gBAAgB,WAAqB,MAA2B;AACxE,QAAO,YAAY,WAAW,KAAK;;;AAIpC,eAAe,sBACd,IACA,UACmD;CACnD,MAAM,QAAQ,SAAS,QAAQ,gBAAgB,GAAG,CAAC,aAAa;AAChE,KAAI,MAAM,WAAW,EAAG,QAAO;AAG/B,QAAO,GACL,WAAW,uBAAuB,CAClC,WAAW,CACX,MAAM,aAAa,KAAK,GAAG,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,MAAM,EAAE,GAAG,CACjE,MAAM,UAAU,KAAK,UAAU,CAC/B,kBAAkB;;;;;;;;AAarB,eAAsB,wBACrB,IACA,OAIA,iBACyC;AACzC,KAAI;EAQH,MAAM,SAAS,gBADS,MAAM,QAAQ,MAAM,MAAM,MAAM,IAAI,CAAC,OAAO,QAAQ,GAAG,EAAE,CAClC;AAE/C,MAAI,OAAO,WAAW,EACrB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA6B;GACtE;EAGF,MAAM,aAAa,sBAAsB;EACzC,MAAM,WAAW,kBAAkB;EACnC,MAAM,UAAU,UAAU,wBAAwB;AAElD,QAAM,GACJ,WAAW,uBAAuB,CAClC,OAAO;GACP,aAAa;GACb,WAAW;GACX,QAAQ,KAAK,UAAU,OAAO;GAC9B,QAAQ;GACR,YAAY;GACZ,UAAU;GACV,CAAC,CACD,SAAS;AAEX,SAAO;GACN,SAAS;GACT,MAAM;IACL,aAAa;IACb,WAAW;IACX,kBAAkB;IAClB,YAAY;IACZ,UAAU;IACV;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;;;AAcH,eAAsB,0BACrB,IACA,OAMC;AACD,KAAI;AAEH,MAAI,MAAM,eAAe,+CACxB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA0B,SAAS;IAAsB;GACxE;EAIF,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,WAAW,CACX,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,kBAAkB;AAEpB,MAAI,CAAC,IACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAuB;GAChE;EAGF,MAAM,sBAAM,IAAI,MAAM;AAGtB,MAAI,IAAI,KAAK,IAAI,WAAW,GAAG,KAAK;AAEnC,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,iBAAiB;IACjB,OAAO;KAAE,MAAM;KAAiB,SAAS;KAA+B;IACxE;;AAIF,MAAI,IAAI,WAAW,UAAU;AAE5B,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,iBAAiB;IACjB,OAAO;KAAE,MAAM;KAAiB,SAAS;KAA+B;IACxE;;AAGF,MAAI,IAAI,WAAW,WAAW;AAI7B,OAAI,IAAI,gBAAgB;IACvB,MAAM,aAAa,IAAI,KAAK,IAAI,eAAe;AAG/C,SAFwB,IAAI,SAAS,GAAG,WAAW,SAAS,IAAI,MAE3C,IAAI,UAAU;KAElC,MAAM,cAAc,KAAK,IAAI,IAAI,WAAW,qBAAqB,uBAAuB;AACxF,WAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI;MACJ,UAAU;MACV,gBAAgB,IAAI,aAAa;MACjC,CAAC,CACD,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,YAAO;MACN,SAAS;MACT,iBAAiB;MACjB,oBAAoB;MACpB,OAAO;OAAE,MAAM;OAAa,SAAS;OAAoB;MACzD;;;AAKH,SAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI,EAAE,gBAAgB,IAAI,aAAa,EAAE,CAAC,CAC1C,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,iBAAiB;IACjB,OAAO;KAAE,MAAM;KAAyB,SAAS;KAAyB;IAC1E;;AAGF,MAAI,IAAI,WAAW,gBAAgB,CAAC,IAAI,QACvC,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA6B;GACtE;EAKF,MAAM,cAAc,sBAAsB,eAAe,aAAa;EACtE,MAAM,gBAAgB,UAAU,yBAAyB;EACzD,MAAM,eAAe,sBAAsB,eAAe,cAAc;EACxE,MAAM,iBAAiB,UAAU,0BAA0B;EAM3D,MAAM,SAAS,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GACvD,MAAM,WAAW,MAAM,IACrB,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,MAAM,UAAU,KAAK,aAAa,CAClC,cAAc,CACd,kBAAkB;AAEpB,OAAI,CAAC,SAAU,QAAO;AAEtB,OAAI,CAAC,SAAS,QAAS,QAAO;GAE9B,MAAM,SAAS,KAAK,MAAM,SAAS,OAAO;AAE1C,SAAM,IACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,YAAY,YAAY;IACxB,YAAY;IACZ,SAAS,SAAS;IAClB,QAAQ,KAAK,UAAU,OAAO;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB,aAAa;IACjC,CAAC,CACD,SAAS;AAEX,SAAM,IACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,YAAY,aAAa;IACzB,YAAY;IACZ,SAAS,SAAS;IAClB,QAAQ,KAAK,UAAU,OAAO;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB;IACpB,CAAC,CACD,SAAS;AAEX,UAAO,EAAE,QAAQ;IAChB;AAEF,MAAI,CAAC,OACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAgC;GACzE;AAGF,SAAO;GACN,SAAS;GACT,MAAM;IACL,cAAc,YAAY;IAC1B,eAAe,aAAa;IAC5B,YAAY;IACZ,YAAY;IACZ,OAAO,OAAO,OAAO,KAAK,IAAI;IAC9B;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;AAWH,eAAsB,uBACrB,IACA,UACA,OAC6E;AAC7E,KAAI;EACH,MAAM,QAAQ,MAAM,sBAAsB,IAAI,MAAM,UAAU;AAE9D,MAAI,CAAC,MACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAgB,SAAS;IAA2B;GACnE;AAGF,MAAI,IAAI,KAAK,MAAM,WAAW,mBAAG,IAAI,MAAM,CAC1C,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAgB,SAAS;IAAyB;GACjE;EAGF,MAAM,kBAAkB,KAAK,MAAM,MAAM,OAAO;AAEhD,SAAO;GACN,SAAS;GACT,MAAM;IAAE;IAAiB,eAAe,gBAAgB,iBAAiB,SAAS;IAAE;GACpF;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA4B,SAAS;IAAiC;GACrF;;;;;;;;;;;;;AAcH,eAAsB,sBACrB,IACA,QACA,UACA,OAI8C;AAC9C,KAAI;EACH,MAAM,QAAQ,MAAM,sBAAsB,IAAI,MAAM,UAAU;AAE9D,MAAI,CAAC,MACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAgB,SAAS;IAA2B;GACnE;AAIF,MAAI,IAAI,KAAK,MAAM,WAAW,mBAAG,IAAI,MAAM,EAAE;AAC5C,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAgB,SAAS;KAAyB;IACjE;;AAKF,OAFe,MAAM,UAAU,eAEhB,QAAQ;AACtB,SAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI,EAAE,QAAQ,UAAU,CAAC,CACzB,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IAAE,SAAS;IAAM,MAAM,EAAE,YAAY,OAAO;IAAE;;EAGtD,MAAM,kBAAkB,gBAAgB,KAAK,MAAM,MAAM,OAAO,EAAc,SAAS;AAEvF,MAAI,gBAAgB,WAAW,EAC9B,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAIF,QAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI;GACJ,QAAQ;GACR,SAAS;GACT,QAAQ,KAAK,UAAU,gBAAgB;GACvC,CAAC,CACD,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,YAAY,MAAM;GAAE;SAC7C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,mBACrB,IACA,OAIoC;AACpC,KAAI;AACH,MAAI,MAAM,eAAe,gBACxB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA0B,SAAS;IAAsB;GACxE;AAGF,MAAI,CAAC,MAAM,cAAc,WAAW,eAAe,cAAc,CAChE,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAgC;GACzE;EAGF,MAAM,cAAc,aAAa,MAAM,cAAc;EAErD,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,WAAW,CACX,MAAM,cAAc,KAAK,YAAY,CACrC,MAAM,cAAc,KAAK,UAAU,CACnC,kBAAkB;AAEpB,MAAI,CAAC,IACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAyB;GAClE;AAIF,MAAI,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,EAAE;AAE1C,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,YAAY,CAAC,SAAS;AAC3F,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,sBAAsB,KAAK,YAAY,CAC7C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAiB,SAAS;KAAyB;IAClE;;EAKF,MAAM,WAAW,MAAM,wBAAwB,IAAI,IAAI,QAAQ;AAC/D,MAAI,CAAC,UAAU;AAEd,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,WAAW,KAAK,IAAI,QAAQ,CAAC,SAAS;AACxF,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAiB,SAAS;KAAkB;IAC3D;;AAGF,MAAI,SAAS,UAAU;AAEtB,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,WAAW,KAAK,IAAI,QAAQ,CAAC,SAAS;AACxF,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAiB,SAAS;KAA4B;IACrE;;EAMF,IAAI,SAAS,YADQ,KAAK,MAAM,IAAI,OAAO,EACJ,SAAS,KAAK;AAMrD,MAAI,IAAI,WAAW;GAClB,MAAM,SAAS,MAAM,kBAAkB,IAAI,IAAI,UAAU;AACzD,OAAI,QAAQ,QAAQ,OACnB,UAAS,OAAO,QAAQ,MAAc,OAAO,OAAQ,SAAS,EAAE,CAAC;;AAInE,MAAI,OAAO,WAAW,GAAG;AAExB,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,YAAY,CAAC,SAAS;AAC3F,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,sBAAsB,KAAK,YAAY,CAC7C,SAAS;AACX,UAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;;AAIF,QAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,sBAAsB,KAAK,YAAY,CAC7C,MAAM,cAAc,KAAK,SAAS,CAClC,SAAS;EAGX,MAAM,cAAc,sBAAsB,eAAe,aAAa;EACtE,MAAM,gBAAgB,UAAU,yBAAyB;AAEzD,QAAM,GACJ,WAAW,uBAAuB,CAClC,OAAO;GACP,YAAY,YAAY;GACxB,YAAY;GACZ,SAAS,IAAI;GACb,QAAQ,KAAK,UAAU,OAAO;GAC9B,aAAa,IAAI;GACjB,YAAY;GACZ,oBAAoB;GACpB,CAAC,CACD,SAAS;AAEX,SAAO;GACN,SAAS;GACT,MAAM;IACL,cAAc,YAAY;IAC1B,eAAe,MAAM;IACrB,YAAY;IACZ,YAAY;IACZ,OAAO,OAAO,KAAK,IAAI;IACvB;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;AAYH,eAAsB,kBACrB,IACA,OAG2C;AAC3C,KAAI;EACH,MAAM,OAAO,aAAa,MAAM,MAAM;EAGtC,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,OAAO;GAAC;GAAc;GAAc;GAAqB,CAAC,CAC1D,MAAM,cAAc,KAAK,KAAK,CAC9B,kBAAkB;AAEpB,MAAI,CAAC,IAEJ,QAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;AAGlD,MAAI,IAAI,eAAe,WAAW;AAEjC,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,sBAAsB,KAAK,KAAK,CAAC,SAAS;AAC5F,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,KAAK,CAAC,SAAS;QAGpF,OAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,KAAK,CAAC,SAAS;AAGrF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;SAC1C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD"}