trustbase-seller-backend 0.1.5

package/plugins/oauth.js

@@ -0,0 +1,979 @@
+"use strict";
+/**
+ * OAuth 2.0 Plugin - OAuth 授权插件
+ *
+ * 功能：
+ * 1. 授权码流程
+ * 2. 令牌端点
+ * 3. 用户信息端点
+ * 4. 权限验证
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthPlugin = void 0;
+exports.computePkceChallenge = computePkceChallenge;
+const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
+const events_1 = require("events");
+const crypto = __importStar(require("crypto"));
+/**
+ * PKCE code_challenge 计算(RFC 7636)
+ * @param verifier code_verifier(43-128 字符 [A-Z a-z 0-9 - . _ ~])
+ * @param method 'S256' 或 'plain'(默认 S256,SHA256 + base64url)
+ */
+function computePkceChallenge(verifier, method = 'S256') {
+    if (method === 'plain') {
+        return verifier;
+    }
+    return crypto.createHash('sha256').update(verifier).digest('base64url');
+}
+/**
+ * OAuthPlugin - OAuth 2.0 插件
+ */
+class OAuthPlugin extends events_1.EventEmitter {
+    db;
+    config;
+    initialized = false;
+    constructor(config = {}) {
+        super();
+        this.config = {
+            authorizationCodeExpiry: 600, // 10 分钟
+            accessTokenExpiry: 3600, // 1 小时
+            ...config
+        };
+    }
+    /**
+     * 初始化插件
+     */
+    async init(dbPath = './data/oauth.db') {
+        if (this.initialized)
+            return;
+        this.db = new better_sqlite3_1.default(dbPath);
+        this.createTables();
+        this.initialized = true;
+        console.log('[OAuthPlugin] Initialized');
+    }
+    /**
+     * 创建数据库表
+     */
+    createTables() {
+        // OAuth 应用表
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS oauth_apps (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        description TEXT,
+        client_id TEXT UNIQUE NOT NULL,
+        client_secret_hash TEXT NOT NULL,
+        redirect_uris TEXT NOT NULL,
+        scopes TEXT NOT NULL,
+        owner_address TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        is_active BOOLEAN DEFAULT true,
+        require_pkce BOOLEAN DEFAULT false
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_oauth_apps_client_id ON oauth_apps(client_id);
+      CREATE INDEX IF NOT EXISTS idx_oauth_apps_owner ON oauth_apps(owner_address);
+    `);
+        // 迁移(幂等):为已存在的旧 oauth_apps 表添加 require_pkce 列
+        try {
+            this.db.exec('ALTER TABLE oauth_apps ADD COLUMN require_pkce BOOLEAN DEFAULT false');
+        }
+        catch (_) { /* 列已存在,忽略 */ }
+        // 授权码表
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS authorization_codes (
+        id TEXT PRIMARY KEY,
+        code TEXT UNIQUE NOT NULL,
+        client_id TEXT NOT NULL,
+        user_id TEXT NOT NULL,
+        user_address TEXT NOT NULL,
+        redirect_uri TEXT NOT NULL,
+        scopes TEXT NOT NULL,
+        expires_at INTEGER NOT NULL,
+        used BOOLEAN DEFAULT false,
+        created_at INTEGER NOT NULL,
+        code_challenge TEXT,
+        code_challenge_method TEXT
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_authorization_codes_code ON authorization_codes(code);
+      CREATE INDEX IF NOT EXISTS idx_authorization_codes_user ON authorization_codes(user_id);
+    `);
+        // 迁移(幂等):为已存在的旧 authorization_codes 表添加 PKCE 列
+        try {
+            this.db.exec('ALTER TABLE authorization_codes ADD COLUMN code_challenge TEXT');
+        }
+        catch (_) { /* 忽略 */ }
+        try {
+            this.db.exec('ALTER TABLE authorization_codes ADD COLUMN code_challenge_method TEXT');
+        }
+        catch (_) { /* 忽略 */ }
+        // 访问令牌表
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS access_tokens (
+        id TEXT PRIMARY KEY,
+        access_token TEXT UNIQUE NOT NULL,
+        refresh_token TEXT UNIQUE NOT NULL,
+        client_id TEXT NOT NULL,
+        user_id TEXT NOT NULL,
+        user_address TEXT NOT NULL,
+        scopes TEXT NOT NULL,
+        expires_at INTEGER NOT NULL,
+        created_at INTEGER NOT NULL,
+        revoked BOOLEAN DEFAULT false
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_access_tokens_access ON access_tokens(access_token);
+      CREATE INDEX IF NOT EXISTS idx_access_tokens_refresh ON access_tokens(refresh_token);
+      CREATE INDEX IF NOT EXISTS idx_access_tokens_user ON access_tokens(user_id);
+
+      -- R2-3a (kimi 设计稿 2026-08-12): grant 落库 — tv2 refresh 需要 grant_sig 重建新 tv2 (S4 只存 access hash, grant_sig 是公钥签名可落库)
+      CREATE TABLE IF NOT EXISTS oauth_grants (
+        grant_id TEXT PRIMARY KEY,        -- sha256(grant canonical) 前 32 hex
+        sub TEXT NOT NULL,
+        client_id TEXT NOT NULL,
+        iss TEXT NOT NULL,
+        scopes TEXT NOT NULL,             -- JSON array
+        grant_sig TEXT NOT NULL,          -- 用户钱包签名 (公钥公开, 不违 S4)
+        grant_exp INTEGER NOT NULL,       -- ms, 授权总寿命
+        nonce TEXT NOT NULL,              -- grant nonce (issueTokenV2 需要完整 TokenV2Grant)
+        user_pubkey TEXT NOT NULL,        -- base64 33B 压缩公钥 (issueTokenV2 需要)
+        created_at INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_oauth_grants_sub_client ON oauth_grants(sub, client_id);
+    `);
+        // 用户授权记录表
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS oauth_authorizations (
+        id TEXT PRIMARY KEY,
+        app_id TEXT NOT NULL,
+        user_id TEXT NOT NULL,
+        user_address TEXT NOT NULL,
+        client_id TEXT NOT NULL,
+        scopes TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        last_used_at INTEGER,
+        is_active BOOLEAN DEFAULT true
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_oauth_auth_user ON oauth_authorizations(user_address, is_active);
+      CREATE INDEX IF NOT EXISTS idx_oauth_auth_app ON oauth_authorizations(app_id);
+      CREATE INDEX IF NOT EXISTS idx_oauth_auth_client ON oauth_authorizations(client_id, user_address);
+    `);
+        // Phase 2 迁移:app_type + 授权有效期 + 访问日志(幂等 ALTER TABLE)
+        try {
+            this.db.exec('ALTER TABLE oauth_apps ADD COLUMN app_type TEXT DEFAULT \'human\'');
+        }
+        catch { /* exists */ }
+        try {
+            this.db.exec('ALTER TABLE oauth_authorizations ADD COLUMN expires_at INTEGER');
+        }
+        catch { /* exists */ }
+        try {
+            this.db.exec('ALTER TABLE authorization_codes ADD COLUMN auth_expires_at INTEGER');
+        }
+        catch { /* exists */ }
+        // Issue #1 (Stage 3.2): revoked_scopes 审计列 (JSON array of {scope, revoked_at})
+        try {
+            this.db.exec('ALTER TABLE oauth_authorizations ADD COLUMN revoked_scopes TEXT DEFAULT \'[]\'');
+        }
+        catch { /* exists */ }
+        // 访问日志表(PRD §27.9)
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS oauth_access_logs (
+        id TEXT PRIMARY KEY,
+        app_name TEXT,
+        client_id TEXT,
+        user_id TEXT NOT NULL,
+        user_address TEXT NOT NULL,
+        endpoint TEXT NOT NULL,
+        method TEXT NOT NULL,
+        scope_used TEXT,
+        response_status INTEGER,
+        created_at INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_oauth_logs_user ON oauth_access_logs(user_address, created_at DESC);
+      CREATE INDEX IF NOT EXISTS idx_oauth_logs_created ON oauth_access_logs(created_at);
+    `);
+        // 清理 90 天以上旧日志
+        this.db.prepare('DELETE FROM oauth_access_logs WHERE created_at < ?').run(Date.now() - 90 * 24 * 3600 * 1000);
+    }
+    /**
+     * 创建 OAuth 应用
+     */
+    async createApp(name, description, redirectUris, scopes, ownerAddress, appType = 'human', requirePkce = false) {
+        const id = crypto.randomUUID();
+        const clientId = crypto.randomBytes(16).toString('hex');
+        // PKCE 公开客户端:不生成 client_secret(留空串),仍存一个占位 hash 满足 NOT NULL 约束
+        const clientSecret = requirePkce ? '' : crypto.randomBytes(32).toString('hex');
+        const clientSecretHash = requirePkce ? '' : crypto.createHash('sha256').update(clientSecret).digest('hex');
+        const now = Date.now();
+        const stmt = this.db.prepare(`
+      INSERT INTO oauth_apps (
+        id, name, description, client_id, client_secret_hash,
+        redirect_uris, scopes, owner_address, app_type, created_at, updated_at, is_active, require_pkce
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, true, ?)
+    `);
+        stmt.run(id, name, description, clientId, clientSecretHash, JSON.stringify(redirectUris), JSON.stringify(scopes), ownerAddress, appType, now, now, requirePkce ? 1 : 0);
+        const app = {
+            id,
+            name,
+            description,
+            clientId,
+            clientSecretHash: clientSecretHash || '',
+            redirectUris,
+            scopes,
+            ownerAddress,
+            appType,
+            createdAt: now,
+            updatedAt: now,
+            isActive: true
+        };
+        this.emit('app:created', app);
+        // P3-6 修复:返回类型用 CreatedOAuthApp(明文 clientSecret 单独字段),不再用 `as any` 把 secret 塞进 clientSecretHash
+        const createdApp = { ...app, clientSecret };
+        return createdApp;
+    }
+    /**
+     * 验证客户端
+     */
+    async validateClient(clientId, clientSecret) {
+        const stmt = this.db.prepare(`
+      SELECT * FROM oauth_apps WHERE client_id = ? AND is_active = true
+    `);
+        const row = stmt.get(clientId);
+        if (!row) {
+            return null;
+        }
+        const clientSecretHash = crypto.createHash('sha256').update(clientSecret).digest('hex');
+        if (clientSecretHash !== row.client_secret_hash) {
+            return null;
+        }
+        return {
+            id: row.id,
+            name: row.name,
+            description: row.description,
+            clientId: row.client_id,
+            clientSecretHash: row.client_secret_hash,
+            redirectUris: JSON.parse(row.redirect_uris),
+            scopes: JSON.parse(row.scopes),
+            ownerAddress: row.owner_address,
+            appType: row.app_type || 'human',
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+            isActive: row.is_active
+        };
+    }
+    /**
+     * 创建授权码
+     */
+    async createAuthorizationCode(clientId, userId, userAddress, redirectUri, scopes, authExpiresAt, codeChallenge, codeChallengeMethod) {
+        // 验证 redirect_uri
+        const app = await this.getApp(clientId);
+        if (!app) {
+            throw new Error('Invalid client_id');
+        }
+        if (!app.redirectUris.includes(redirectUri)) {
+            throw new Error('Invalid redirect_uri');
+        }
+        // 验证 scopes
+        const invalidScopes = scopes.filter(s => !app.scopes.includes(s));
+        if (invalidScopes.length > 0) {
+            throw new Error(`Invalid scopes: ${invalidScopes.join(', ')}`);
+        }
+        // PKCE 校验:PKCE App 必须传 code_challenge(S256),method 必须是 S256 或 plain
+        if (app.requirePkce && !codeChallenge) {
+            throw new Error('PKCE required: missing code_challenge');
+        }
+        if (codeChallenge && codeChallengeMethod && !['S256', 'plain'].includes(codeChallengeMethod)) {
+            throw new Error('Invalid code_challenge_method (only S256 or plain)');
+        }
+        const code = crypto.randomBytes(32).toString('hex');
+        const now = Date.now();
+        const expiresAt = now + (this.config.authorizationCodeExpiry * 1000);
+        const stmt = this.db.prepare(`
+      INSERT INTO authorization_codes (
+        id, code, client_id, user_id, user_address, redirect_uri, scopes, expires_at, used, created_at, auth_expires_at, code_challenge, code_challenge_method
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, false, ?, ?, ?, ?)
+    `);
+        stmt.run(crypto.randomUUID(), code, clientId, userId, userAddress, redirectUri, JSON.stringify(scopes), expiresAt, now, authExpiresAt ?? null, codeChallenge ?? null, codeChallengeMethod ?? null);
+        this.emit('code:created', { code, clientId, userId });
+        return code;
+    }
+    /**
+     * 使用授权码换取访问令牌
+     */
+    async exchangeCodeForToken(code, clientId, clientSecret, redirectUri, codeVerifier, tokenV2Grant // R2-1: 用户 grant 签名（授权时钱包签）
+    ) {
+        // 查询授权码(必须在客户端校验前,因为 PKCE App 没有 client_secret)
+        const codeStmt = this.db.prepare(`
+      SELECT * FROM authorization_codes
+      WHERE code = ? AND client_id = ? AND redirect_uri = ? AND used = false AND expires_at > ?
+    `);
+        const row = codeStmt.get(code, clientId, redirectUri, Date.now());
+        if (!row) {
+            throw new Error('Invalid or expired authorization code');
+        }
+        // 查询 App(必须在客户端校验前,因为 PKCE App client_secret 为空)
+        const app = this.db.prepare('SELECT * FROM oauth_apps WHERE client_id = ? AND is_active = true').get(clientId);
+        if (!app) {
+            throw new Error('Invalid client_id');
+        }
+        // 客户端校验:PKCE App(client_secret_hash 为空)只校验 code_verifier;
+        //               非 PKCE App 校验 client_secret。
+        if (app.require_pkce) {
+            if (!codeVerifier) {
+                throw new Error('PKCE required: missing code_verifier');
+            }
+            if (!row.code_challenge) {
+                throw new Error('PKCE mismatch: code_challenge not registered for this code');
+            }
+            const method = row.code_challenge_method || 'plain';
+            const challenge = computePkceChallenge(codeVerifier, method);
+            if (challenge !== row.code_challenge) {
+                throw new Error('PKCE verification failed: code_verifier mismatch');
+            }
+        }
+        else {
+            // 非 PKCE App:要求传 client_secret
+            const clientSecretHash = crypto.createHash('sha256').update(clientSecret).digest('hex');
+            if (!app.client_secret_hash || clientSecretHash !== app.client_secret_hash) {
+                throw new Error('Invalid client credentials');
+            }
+        }
+        // 标记授权码已使用
+        this.db.prepare(`
+      UPDATE authorization_codes SET used = true WHERE id = ?
+    `).run(row.id);
+        // 生成访问令牌
+        const refreshToken = crypto.randomBytes(32).toString('hex');
+        const now = Date.now();
+        const scopes = JSON.parse(row.scopes);
+        // 有效期:用户选的 auth_expires_at(7d/30d/permanent),否则默认 1h
+        let tokenExpiresAt;
+        if (row.auth_expires_at !== null && row.auth_expires_at !== undefined) {
+            tokenExpiresAt = row.auth_expires_at; // 用户选的有效期(绝对时间戳)
+        }
+        else {
+            tokenExpiresAt = now + (this.config.accessTokenExpiry * 1000); // 默认 1h
+        }
+        // R2-1: 配置了 tokenV2 且客户端带来用户 grant 签名 → 发 tv2 结构化令牌
+        let accessToken;
+        if (this.config.tokenV2 && tokenV2Grant) {
+            const { issueTokenV2, verifyGrantSig, tokenV2Hash } = await Promise.resolve().then(() => __importStar(require('../oauth/token-v2')));
+            const g = tokenV2Grant.grant;
+            // grant 与授权码记录的一致性断言（防张冠李戴）
+            const userAddress = row.user_address || row.user_id;
+            if (g.sub !== userAddress)
+                throw new Error('grant.sub 与授权用户不一致');
+            if (g.client_id !== clientId)
+                throw new Error('grant.client_id 与请求不一致');
+            if (g.iss !== this.config.tokenV2.issuerNodeId)
+                throw new Error('grant.iss 不是本节点');
+            if (JSON.stringify([...g.scopes].sort()) !== JSON.stringify([...scopes].sort())) {
+                throw new Error('grant.scopes 与授权范围不一致');
+            }
+            if (!(await verifyGrantSig(g, tokenV2Grant.grant_sig))) {
+                throw new Error('grant_sig 验签失败');
+            }
+            const issued = await issueTokenV2(g, tokenV2Grant.grant_sig, this.config.tokenV2.issuerPrivkey, {
+                requestedExp: tokenExpiresAt,
+            });
+            accessToken = issued.token;
+            tokenExpiresAt = issued.payload.exp; // 可能被 24h 上限钳短
+            // S4: v2 token 库里只存哈希（'tv2h:' 前缀），明文不落盘
+            this.db.prepare(`
+        INSERT INTO access_tokens (
+          id, access_token, refresh_token, client_id, user_id, user_address, scopes, expires_at, created_at, revoked
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, false)
+      `).run(crypto.randomUUID(), 'tv2h:' + tokenV2Hash(accessToken), this.refreshTokenHash(refreshToken), // R2-3 阻断1: 落库存 sha256, 明文不落盘
+            clientId, row.user_id, userAddress, JSON.stringify(scopes), tokenExpiresAt, now);
+            // R2-3a: grant 落库 (tv2 refresh 需要 grant_sig 重建新 tv2). grant_id = sha256(canonical grant) 前 32 hex
+            try {
+                const { canonicalize } = await Promise.resolve().then(() => __importStar(require('../p2p/signing')));
+                const grantJson = canonicalize(g);
+                const grantId = crypto.createHash('sha256').update(grantJson).digest('hex').slice(0, 32);
+                this.db.prepare(`
+          INSERT OR REPLACE INTO oauth_grants (
+            grant_id, sub, client_id, iss, scopes, grant_sig, grant_exp, nonce, user_pubkey, created_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(grantId, g.sub, g.client_id, g.iss, JSON.stringify(g.scopes), tokenV2Grant.grant_sig, g.grant_exp || (tokenExpiresAt + 7 * 86400_000), g.nonce, g.user_pubkey, now);
+            }
+            catch (e) {
+                console.warn('[OAuthPlugin] grant 落库失败 (refresh 将受限):', e?.message ?? e);
+            }
+        }
+        else {
+            accessToken = crypto.randomBytes(32).toString('hex');
+            this.db.prepare(`
+      INSERT INTO access_tokens (
+        id, access_token, refresh_token, client_id, user_id, user_address, scopes, expires_at, created_at, revoked
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, false)
+    `).run(crypto.randomUUID(), accessToken, this.refreshTokenHash(refreshToken), // R2-3 阻断1: 落库存 sha256, 明文不落盘
+            clientId, row.user_id, row.user_address || row.user_id, // fallback
+            JSON.stringify(scopes), tokenExpiresAt, now);
+        }
+        // 创建或更新授权记录
+        try {
+            const appRow = this.db.prepare('SELECT id FROM oauth_apps WHERE client_id = ?').get(clientId);
+            if (appRow) {
+                await this.upsertAuthorization(appRow.id, row.user_id, row.user_address || row.user_id, clientId, scopes, row.auth_expires_at ?? null);
+            }
+        }
+        catch (e) {
+            console.error('[OAuthPlugin] Failed to create authorization record:', e);
+        }
+        this.emit('token:created', { accessToken, clientId, userId: row.user_id });
+        return {
+            accessToken,
+            refreshToken,
+            expiresIn: Math.max(0, Math.floor((tokenExpiresAt - now) / 1000)),
+            scopes
+        };
+    }
+    /**
+     * 验证访问令牌
+     */
+    async validateAccessToken(accessToken) {
+        const stmt = this.db.prepare(`
+      SELECT * FROM access_tokens 
+      WHERE access_token = ? AND revoked = false AND expires_at > ?
+    `);
+        const row = stmt.get(accessToken, Date.now());
+        if (!row) {
+            return null;
+        }
+        return {
+            userId: row.user_id,
+            clientId: row.client_id,
+            scopes: JSON.parse(row.scopes)
+        };
+    }
+    /**
+     * S4 同款 (tv2h 前缀镜像): refresh_token 库存 sha256 哈希, 明文不落盘 (R2-3 阻断1 修复)。
+     * 返回 'rth:' 前缀哈希 — 自我描述且与 'tv2h:' access hash 区分, 避免明文/哈希歧义。
+     */
+    refreshTokenHash(rt) {
+        return 'rth:' + crypto.createHash('sha256').update(rt, 'utf8').digest('hex');
+    }
+    /**
+     * 刷新访问令牌
+     */
+    async refreshAccessToken(refreshToken) {
+        // R2-3 阻断1: rt 库存 sha256 ('rth:' 前缀), 查询同步哈希. 兼容 S4 改造前的明文遗留行 (迁移期).
+        let row = this.db.prepare('SELECT * FROM access_tokens WHERE refresh_token = ?')
+            .get(this.refreshTokenHash(refreshToken));
+        if (!row) {
+            const legacy = this.db.prepare('SELECT * FROM access_tokens WHERE refresh_token = ?')
+                .get(refreshToken);
+            if (legacy) {
+                console.warn('[OAuthPlugin] 命中明文 refresh_token 遗留行 (S4 迁移, 建议重签):', legacy.id);
+                row = legacy;
+            }
+        }
+        if (!row) {
+            throw new Error('Invalid refresh token'); // 非签发方 → /token 端点转 refresh-via-issuer
+        }
+        // R2-3 阻断2: rt 重放 (row 已 revoked = 已被一次性轮换用掉/撤销) = 泄漏信号
+        // → revoke-all(sub, client_id) + 广播 (宁可误杀, 不给重放窗口; kimi #15324 修法)。
+        // 注意: 这里不抛 'Invalid refresh token' — 那条会让端点误判为非签发方转 refresh-via-issuer,
+        // 必须用独立错误码, 且撤销动作不能因异常丢失。
+        if (row.revoked) {
+            const sub = row.user_address || row.user_id;
+            try {
+                if (this.config.onRefreshTokenReplayed) {
+                    await this.config.onRefreshTokenReplayed({ sub, client_id: row.client_id });
+                }
+            }
+            catch (e) {
+                console.warn('[OAuthPlugin] refresh 重放 revoke-all 回调失败:', e?.message ?? e);
+            }
+            throw new Error('refresh-token-replayed');
+        }
+        // R2-3a (kimi 设计稿 2026-08-12): tv2 refresh — 一次性轮换 + grant 校验 + 发新 tv2.
+        // 非签发方: access_tokens 无此 rt 行 → 上面 throw Invalid refresh token (由 /token 端点转 refresh-via-issuer).
+        // 签发方: 本表有行 → 从 oauth_grants 重建 grant → 校验 → 轮换 rt → 发新 tv2.
+        if (typeof row.access_token === 'string' && row.access_token.startsWith('tv2h:')) {
+            return await this.refreshTv2Token(row, refreshToken);
+        }
+        // ★ 修复(P1-1):查询 oauth_authorizations 的当前 scopes,避免换发已撤销 scope 的新 token
+        // 用户通过 revokeScope() 撤销某个 scope 后,旧 refresh_token 若直接复制旧 scopes 换新 token,
+        // 会绕过撤销(数据主权核心漏洞)。
+        const auth = this.db.prepare(`
+      SELECT scopes FROM oauth_authorizations
+      WHERE client_id = ? AND user_address = ? AND is_active = 1
+    `).get(row.client_id, row.user_address || row.user_id);
+        let currentScopes;
+        try {
+            currentScopes = auth ? JSON.parse(auth.scopes) : JSON.parse(row.scopes);
+        }
+        catch {
+            currentScopes = JSON.parse(row.scopes);
+        }
+        // 旧 token scopes 与当前 auth scopes 取交集
+        const oldScopes = JSON.parse(row.scopes);
+        const newScopes = oldScopes.filter((s) => currentScopes.includes(s));
+        if (newScopes.length === 0) {
+            // 所有 scope 都被撤销了 → 撤销此 refresh_token 链,拒绝刷新
+            this.db.prepare('UPDATE access_tokens SET revoked = 1 WHERE id = ?').run(row.id);
+            throw new Error('All scopes have been revoked');
+        }
+        // 撤销旧令牌
+        this.db.prepare(`
+      UPDATE access_tokens SET revoked = true WHERE id = ?
+    `).run(row.id);
+        // 生成新令牌(用交集 scopes)
+        const accessToken = crypto.randomBytes(32).toString('hex');
+        const newRefreshToken = crypto.randomBytes(32).toString('hex');
+        const now = Date.now();
+        const expiresAt = now + (this.config.accessTokenExpiry * 1000);
+        this.db.prepare(`
+      INSERT INTO access_tokens (
+        id, access_token, refresh_token, client_id, user_id, user_address, scopes, expires_at, created_at, revoked
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0)
+    `).run(crypto.randomUUID(), accessToken, this.refreshTokenHash(newRefreshToken), // R2-3 阻断1: 落库存 sha256, 明文不落盘
+        row.client_id, row.user_id, row.user_address || row.user_id, JSON.stringify(newScopes), expiresAt, now);
+        return {
+            accessToken,
+            refreshToken: newRefreshToken,
+            expiresIn: this.config.accessTokenExpiry,
+            scopes: newScopes
+        };
+    }
+    /**
+     * R2-3a tv2 refresh (签发方): 一次性轮换 + grant 校验 + 发新 tv2.
+     * 非签发方走 /token 端点转 refresh-via-issuer (本表无 rt 行 → Invalid refresh token → 端点转).
+     */
+    async refreshTv2Token(row, oldRefreshToken) {
+        // 1. 查 grant (oauth_grants) — R2-3 附带: ORDER BY created_at DESC 取最新授权 (无排序可能拿旧 grant)
+        const grantRow = this.db.prepare('SELECT * FROM oauth_grants WHERE sub = ? AND client_id = ? ORDER BY created_at DESC LIMIT 1').get(row.user_address || row.user_id, row.client_id);
+        if (!grantRow) {
+            throw new Error('tv2-refresh-grant-missing: grant 未落库, 请重新授权');
+        }
+        // 2. 校验 grant_exp 未过期
+        if (grantRow.grant_exp && Date.now() > grantRow.grant_exp) {
+            throw new Error('grant_expired');
+        }
+        // 3. R2-3 阻断3: revoke-all 边界 — 用户"退出所有设备"后旧授权禁止续期 (R2-3b 核心场景, kimi #15324)。
+        //    beforeIat 非空且 grant 创建早于边界 → 拒; grant 晚于边界 = 撤销后重新授权, 放行。
+        //    (未注入 revocations 时跳过 — v1-only 模式无 tv2 撤销语义)
+        if (this.config.revocations) {
+            const beforeIat = this.config.revocations.getRevokeAllBeforeIat(grantRow.sub, grantRow.client_id);
+            if (beforeIat !== null && grantRow.created_at < beforeIat) {
+                throw new Error('revoked-all');
+            }
+        }
+        // 4. 一次性轮换: 作废旧 rt (重放旧 rt → refreshAccessToken 顶部 revoked 判定 → revoke-all)
+        this.db.prepare('UPDATE access_tokens SET revoked = 1 WHERE id = ?').run(row.id);
+        // 5. 生成新 tv2 access + 新 rt (rt 存 sha256, S4 同款)
+        const { issueTokenV2, tokenV2Hash } = await Promise.resolve().then(() => __importStar(require('../oauth/token-v2')));
+        const grant = {
+            sub: grantRow.sub,
+            client_id: grantRow.client_id,
+            scopes: JSON.parse(grantRow.scopes),
+            iss: grantRow.iss,
+            grant_exp: grantRow.grant_exp,
+            nonce: grantRow.nonce,
+            user_pubkey: grantRow.user_pubkey,
+        };
+        const issued = await issueTokenV2(grant, grantRow.grant_sig, this.config.tokenV2.issuerPrivkey, {});
+        const newRt = crypto.randomBytes(32).toString('hex');
+        const now = Date.now();
+        const expiresAt = issued.payload.exp;
+        this.db.prepare(`
+      INSERT INTO access_tokens (
+        id, access_token, refresh_token, client_id, user_id, user_address, scopes, expires_at, created_at, revoked
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0)
+    `).run(crypto.randomUUID(), 'tv2h:' + tokenV2Hash(issued.token), this.refreshTokenHash(newRt), // R2-3 阻断1: 落库存 sha256 (注释不再是空话, S4 同款)
+        row.client_id, row.user_id, row.user_address || row.user_id, JSON.stringify(grant.scopes), expiresAt, now);
+        return {
+            accessToken: issued.token,
+            refreshToken: newRt,
+            expiresIn: Math.floor((expiresAt - now) / 1000),
+            scopes: grant.scopes,
+        };
+    }
+    /**
+     * 撤销令牌 — RFC 7009:支持 access_token / refresh_token,可选校验 clientId 归属
+     */
+    async revokeToken(token, clientId) {
+        // 先按 access_token 找（v1 明文）
+        let row = this.db.prepare('SELECT id, client_id FROM access_tokens WHERE access_token = ? AND revoked = 0').get(token);
+        if (!row && token.startsWith('tv2.')) {
+            // kimi 复核 P2: tv2 库存的是哈希, 撤销 tv2 要走 'tv2h:'+sha256(token) 匹配
+            const { tokenV2Hash } = await Promise.resolve().then(() => __importStar(require('../oauth/token-v2')));
+            row = this.db.prepare('SELECT id, client_id FROM access_tokens WHERE access_token = ? AND revoked = 0').get('tv2h:' + tokenV2Hash(token));
+        }
+        if (!row) {
+            // 再按 refresh_token 找 (R2-3 阻断1: 库存 sha256 'rth:' 哈希匹配; 兼容明文遗留行)
+            row = this.db.prepare('SELECT id, client_id FROM access_tokens WHERE refresh_token = ? AND revoked = 0').get(this.refreshTokenHash(token));
+            if (!row) {
+                row = this.db.prepare('SELECT id, client_id FROM access_tokens WHERE refresh_token = ? AND revoked = 0').get(token);
+            }
+        }
+        if (!row)
+            return; // token 不存在(或已撤销),静默忽略(RFC 7009:不暴露)
+        if (clientId && row.client_id !== clientId)
+            return; // 不属于该 client,静默忽略
+        this.db.prepare('UPDATE access_tokens SET revoked = 1 WHERE id = ?').run(row.id);
+        // tv2 实际生效: jti 进撤销缓存(离线验证不查 access_tokens 表, 只改 revoked 标志没用)
+        if (token.startsWith('tv2.') && this.config.onTokenV2Revoked) {
+            try {
+                const { parseTokenV2 } = await Promise.resolve().then(() => __importStar(require('../oauth/token-v2')));
+                const parsed = parseTokenV2(token);
+                if (parsed) {
+                    const p = parsed.payload;
+                    this.config.onTokenV2Revoked({ jti: p.jti, iss: p.iss, exp: p.exp, sub: p.sub, client_id: p.client_id, iat: p.iat });
+                }
+            }
+            catch (e) {
+                console.error('[OAuthPlugin] onTokenV2Revoked hook error:', e?.message ?? e);
+            }
+        }
+    }
+    /**
+     * 获取应用信息
+     */
+    async getApp(clientId) {
+        const stmt = this.db.prepare(`
+      SELECT * FROM oauth_apps WHERE client_id = ? AND is_active = true
+    `);
+        const row = stmt.get(clientId);
+        if (!row) {
+            return null;
+        }
+        return {
+            id: row.id,
+            name: row.name,
+            description: row.description,
+            clientId: row.client_id,
+            clientSecretHash: row.client_secret_hash,
+            redirectUris: JSON.parse(row.redirect_uris),
+            scopes: JSON.parse(row.scopes),
+            ownerAddress: row.owner_address,
+            appType: row.app_type || 'human',
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+            isActive: row.is_active
+        };
+    }
+    /**
+     * 获取用户授权的应用列表
+     */
+    async getUserApps(userId) {
+        const stmt = this.db.prepare(`
+      SELECT DISTINCT a.*, t.scopes, t.created_at as authorized_at
+      FROM oauth_apps a
+      JOIN access_tokens t ON a.client_id = t.client_id
+      WHERE t.user_id = ? AND t.revoked = false
+      ORDER BY t.created_at DESC
+    `);
+        const rows = stmt.all(userId);
+        return rows.map(row => ({
+            id: row.id,
+            name: row.name,
+            description: row.description,
+            clientId: row.client_id,
+            scopes: JSON.parse(row.scopes),
+            authorizedAt: row.authorized_at
+        }));
+    }
+    /**
+     * 撤销用户对应用的授权
+     */
+    async revokeUserApp(userId, clientId) {
+        this.db.prepare(`
+      UPDATE access_tokens SET revoked = true WHERE user_id = ? AND client_id = ?
+    `).run(userId, clientId);
+    }
+    /**
+     * 创建或更新用户授权记录（授权码流程中调用）
+     */
+    async upsertAuthorization(appId, userId, userAddress, clientId, scopes, expiresAt) {
+        const now = Date.now();
+        // 检查是否已有授权
+        const existing = this.db.prepare('SELECT * FROM oauth_authorizations WHERE app_id = ? AND user_address = ? AND is_active = true').get(appId, userAddress);
+        if (existing) {
+            // 更新 scopes + 有效期 + 时间
+            this.db.prepare(`
+        UPDATE oauth_authorizations SET scopes = ?, expires_at = ?, updated_at = ?, last_used_at = ?
+        WHERE id = ?
+      `).run(JSON.stringify(scopes), expiresAt ?? null, now, now, existing.id);
+            return { ...existing, scopes, expires_at: expiresAt ?? null, updated_at: now, last_used_at: now };
+        }
+        // 创建新授权记录
+        const id = crypto.randomUUID();
+        this.db.prepare(`
+      INSERT INTO oauth_authorizations (id, app_id, user_id, user_address, client_id, scopes, expires_at, created_at, updated_at, last_used_at, is_active)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, true)
+    `).run(id, appId, userId, userAddress, clientId, JSON.stringify(scopes), expiresAt ?? null, now, now, now);
+        return { id, app_id: appId, user_id: userId, user_address: userAddress, client_id: clientId, scopes, created_at: now, updated_at: now, last_used_at: now, is_active: true };
+    }
+    /**
+     * 获取用户的所有授权列表
+     */
+    async getUserAuthorizations(userAddress) {
+        const stmt = this.db.prepare(`
+      SELECT auth.*, app.name as app_name, app.description as app_description
+      FROM oauth_authorizations auth
+      LEFT JOIN oauth_apps app ON auth.app_id = app.id
+      WHERE auth.user_address = ? AND auth.is_active = true
+      ORDER BY auth.updated_at DESC
+    `);
+        const rows = stmt.all(userAddress);
+        return rows.map(row => ({
+            id: row.id,
+            app_id: row.app_id,
+            app_name: row.app_name,
+            app_description: row.app_description,
+            user_address: row.user_address,
+            client_id: row.client_id,
+            scopes: JSON.parse(row.scopes),
+            created_at: row.created_at,
+            updated_at: row.updated_at,
+            last_used_at: row.last_used_at,
+            is_active: row.is_active
+        }));
+    }
+    /**
+     * 获取单个授权记录
+     */
+    async getAuthorization(authId, userAddress) {
+        const stmt = this.db.prepare('SELECT * FROM oauth_authorizations WHERE id = ? AND user_address = ? AND is_active = true');
+        return stmt.get(authId, userAddress);
+    }
+    /**
+     * 撤销单条授权
+     */
+    async revokeAuthorization(authId, userAddress) {
+        const result = this.db.prepare('UPDATE oauth_authorizations SET is_active = false, updated_at = ? WHERE id = ? AND user_address = ? AND is_active = true').run(Date.now(), authId, userAddress);
+        // 同时撤销该应用的所有 access_token
+        const auth = this.db.prepare('SELECT client_id FROM oauth_authorizations WHERE id = ?').get(authId);
+        if (auth) {
+            this.db.prepare('UPDATE access_tokens SET revoked = true WHERE client_id = ? AND user_id = (SELECT user_id FROM oauth_authorizations WHERE id = ?)').run(auth.client_id, authId);
+        }
+        return result.changes > 0;
+    }
+    /**
+     * 逐项撤销:从授权中移除一个 scope(PRD §27.13)
+     * 如果移除后 scopes 为空 → 自动调 revokeAuthorization(整个撤销)
+     * 同时撤销含该 scope 的 access_tokens
+     */
+    async revokeScope(authId, userAddress, scope) {
+        const auth = this.db.prepare('SELECT * FROM oauth_authorizations WHERE id = ? AND user_address = ? AND is_active = true').get(authId, userAddress);
+        if (!auth)
+            return 'not_found';
+        let currentScopes = [];
+        try {
+            currentScopes = JSON.parse(auth.scopes);
+        }
+        catch {
+            return 'not_found';
+        }
+        // Issue #2 (Stage 3.2): wildcard JS 层批量展开.
+        // 'wallet:*' / 'wallet' / '*' -> 匹配 currentScopes 里所有 wallet: 前缀 (或全部).
+        let scopesToRevoke;
+        if (scope === '*') {
+            scopesToRevoke = [...currentScopes];
+        }
+        else if (scope.endsWith(':*')) {
+            const prefix = scope.slice(0, -1); // 'wallet:'
+            scopesToRevoke = currentScopes.filter(s => s.startsWith(prefix));
+        }
+        else if (scope.endsWith('*')) {
+            const prefix = scope.slice(0, -1);
+            scopesToRevoke = currentScopes.filter(s => s.startsWith(prefix));
+        }
+        else {
+            scopesToRevoke = currentScopes.includes(scope) ? [scope] : [];
+        }
+        if (scopesToRevoke.length === 0)
+            return 'no_match';
+        const newScopes = currentScopes.filter(s => !scopesToRevoke.includes(s));
+        // Issue #1 (Stage 3.2): revoked_scopes 审计 - 记录撤销历史 (scope + revoked_at).
+        // 不只是改 scopes 数组, 留审计 trail (谁/何时/撤了什么).
+        let revokedHistory = [];
+        try {
+            revokedHistory = auth.revoked_scopes ? JSON.parse(auth.revoked_scopes) : [];
+        }
+        catch { /* */ }
+        const now = Date.now();
+        for (const sc of scopesToRevoke) {
+            revokedHistory.push({ scope: sc, revoked_at: now });
+        }
+        if (newScopes.length === 0) {
+            // 全部 scope 撤销 -> 整 authorization 撤销 (但先记 revoked_scopes 审计)
+            this.db.prepare('UPDATE oauth_authorizations SET scopes = ?, revoked_scopes = ?, updated_at = ? WHERE id = ?').run(JSON.stringify(newScopes), JSON.stringify(revokedHistory), now, authId);
+            await this.revokeAuthorization(authId, userAddress);
+            return 'full_revoked';
+        }
+        this.db.prepare('UPDATE oauth_authorizations SET scopes = ?, revoked_scopes = ?, updated_at = ? WHERE id = ?').run(JSON.stringify(newScopes), JSON.stringify(revokedHistory), now, authId);
+        // 撤销含被撤 scope 的 access_tokens (wildcard 批量)
+        const tokens = this.db.prepare('SELECT access_token, scopes FROM access_tokens WHERE client_id = ? AND user_id = ? AND revoked = false').all(auth.client_id, auth.user_id);
+        for (const t of tokens) {
+            try {
+                const tokenScopes = JSON.parse(t.scopes);
+                if (tokenScopes.some(s => scopesToRevoke.includes(s))) {
+                    this.db.prepare('UPDATE access_tokens SET revoked = true WHERE access_token = ?').run(t.access_token);
+                }
+            }
+            catch { /* */ }
+        }
+        return 'revoked';
+    }
+    /**
+     * 撤销用户所有授权
+     */
+    async revokeAllAuthorizations(userAddress) {
+        // 获取所有活跃授权的 client_id
+        const auths = this.db.prepare('SELECT client_id FROM oauth_authorizations WHERE user_address = ? AND is_active = true').all(userAddress);
+        // 撤销所有 access_token
+        for (const auth of auths) {
+            this.db.prepare('UPDATE access_tokens SET revoked = true WHERE client_id = ?').run(auth.client_id);
+        }
+        // 标记所有授权为不活跃
+        const result = this.db.prepare('UPDATE oauth_authorizations SET is_active = false, updated_at = ? WHERE user_address = ? AND is_active = true').run(Date.now(), userAddress);
+        return result.changes;
+    }
+    /**
+     * 获取应用信息（通过数据库 id）
+     */
+    async getAppById(appId) {
+        const stmt = this.db.prepare('SELECT * FROM oauth_apps WHERE id = ?');
+        return stmt.get(appId);
+    }
+    /**
+     * 更新应用信息
+     */
+    async updateApp(appId, ownerAddress, data) {
+        // 验证所有权
+        const app = this.db.prepare('SELECT * FROM oauth_apps WHERE id = ? AND owner_address = ?').get(appId, ownerAddress);
+        if (!app)
+            return null;
+        const now = Date.now();
+        const updates = ['updated_at = ?'];
+        const values = [now];
+        if (data.name !== undefined) {
+            updates.push('name = ?');
+            values.push(data.name);
+        }
+        if (data.description !== undefined) {
+            updates.push('description = ?');
+            values.push(data.description);
+        }
+        if (data.redirect_uris !== undefined) {
+            updates.push('redirect_uris = ?');
+            values.push(JSON.stringify(data.redirect_uris));
+        }
+        if (data.scopes !== undefined) {
+            updates.push('scopes = ?');
+            values.push(JSON.stringify(data.scopes));
+        }
+        values.push(appId);
+        this.db.prepare(`UPDATE oauth_apps SET ${updates.join(', ')} WHERE id = ?`).run(...values);
+        return this.db.prepare('SELECT * FROM oauth_apps WHERE id = ?').get(appId);
+    }
+    /**
+     * 删除应用
+     */
+    async deleteApp(appId, ownerAddress) {
+        const result = this.db.prepare('DELETE FROM oauth_apps WHERE id = ? AND owner_address = ?').run(appId, ownerAddress);
+        return result.changes > 0;
+    }
+    /**
+     * 获取用户拥有的应用列表
+     */
+    async getOwnedApps(ownerAddress) {
+        const stmt = this.db.prepare('SELECT * FROM oauth_apps WHERE owner_address = ? ORDER BY created_at DESC');
+        return stmt.all(ownerAddress);
+    }
+    /**
+     * 关闭数据库
+     */
+    async close() {
+        if (this.db) {
+            this.db.close();
+            this.initialized = false;
+        }
+    }
+    // ===== Phase 2: 访问日志 (PRD §27.9) =====
+    async logAccess(params) {
+        // Issue #3 (Stage 3.2): fire-and-forget async - access-log 写入不阻塞请求.
+        // setImmediate 把 INSERT 推到事件循环下一轮, 调用方立即返回.
+        setImmediate(() => {
+            try {
+                // ★ P2-4 修复:用 clientId JOIN oauth_apps 查真实 app_name(之前永远空字符串)
+                let appName = params.appName || '';
+                if (!appName && params.clientId) {
+                    try {
+                        const app = this.db.prepare('SELECT name FROM oauth_apps WHERE client_id = ?').get(params.clientId);
+                        if (app?.name)
+                            appName = app.name;
+                    }
+                    catch { /* JOIN 失败回退到空串 */ }
+                }
+                this.db.prepare(`
+          INSERT INTO oauth_access_logs (id, app_name, client_id, user_id, user_address, endpoint, method, scope_used, response_status, created_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(crypto.randomUUID(), appName, params.clientId || '', params.userId, params.userAddress, params.endpoint, params.method, params.scopeUsed || '', params.responseStatus || 0, Date.now());
+            }
+            catch { /* 日志失败不影响请求 */ }
+        });
+    }
+    async getUserAccessLogs(userAddress, limit = 50, offset = 0) {
+        const rows = this.db.prepare(`
+      SELECT * FROM oauth_access_logs WHERE user_address = ? AND created_at > ?
+      ORDER BY created_at DESC LIMIT ? OFFSET ?
+    `).all(userAddress, Date.now() - 90 * 24 * 3600 * 1000, limit, offset);
+        const total = this.db.prepare('SELECT COUNT(*) as n FROM oauth_access_logs WHERE user_address = ? AND created_at > ?')
+            .get(userAddress, Date.now() - 90 * 24 * 3600 * 1000)?.n || 0;
+        return {
+            logs: rows.map(r => ({
+                id: r.id, appName: r.app_name, clientId: r.client_id,
+                endpoint: r.endpoint, method: r.method, scopeUsed: r.scope_used,
+                responseStatus: r.response_status, createdAt: r.created_at,
+            })),
+            total,
+        };
+    }
+}
+exports.OAuthPlugin = OAuthPlugin;
+//# sourceMappingURL=oauth.js.map