ucpify 1.0.1 → 1.2.0

package/dist/cli.js

@@ -40,10 +40,11 @@ const path = __importStar(require("path"));
 const schema_1 = require("./schema");
 const express_app_1 = require("./express-app");
 const program = new commander_1.Command();
+const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf-8'));
 program
     .name('ucpify')
     .description('Generate and run a UCP-compliant server for merchants')
-    .version('1.0.0');
+    .version(pkg.version);
 program
     .command('init')
     .description('Create a sample merchant configuration file')
@@ -140,6 +141,9 @@ program
         const app = (0, express_app_1.createExpressApp)(config, { useDb });
         const port = config.port;
         const storageType = useDb ? 'SQLite' : 'In-memory';
+        const oauthStatus = config.oauth
+            ? config.oauth.provider === 'built-in' ? 'Built-in' : `External (${config.oauth.issuer})`
+            : 'Disabled';
         app.listen(port, () => {
             console.log(`
 ╔══════════════════════════════════════════════════════════════╗
@@ -149,6 +153,7 @@ program
 ║  Domain:   ${config.domain.padEnd(49)}║
 ║  Port:     ${String(port).padEnd(49)}║
 ║  Storage:  ${storageType.padEnd(49)}║
+║  OAuth:    ${oauthStatus.padEnd(49)}║
 ╠══════════════════════════════════════════════════════════════╣
 ║  Endpoints:                                                  ║
 ║  • GET  /.well-known/ucp              - UCP Profile          ║
@@ -160,7 +165,11 @@ program
 ║  • GET  /ucp/v1/orders                - List Orders          ║
 ║  • GET  /ucp/v1/orders/:id            - Get Order            ║
 ║  • GET  /ucp/v1/items                 - Product Catalog      ║
-║  • GET  /health                       - Health Check         ║
+║  • GET  /health                       - Health Check         ║${config.oauth ? `
+║  • GET  /.well-known/oauth-...        - OAuth Metadata       ║` : ''}${config.oauth?.provider === 'built-in' ? `
+║  • GET  /oauth2/authorize             - Authorization        ║
+║  • POST /oauth2/token                 - Token Exchange       ║
+║  • POST /oauth2/revoke                - Token Revocation     ║` : ''}
 ╚══════════════════════════════════════════════════════════════╝
 
 🔗 UCP Profile: http://localhost:${port}/.well-known/ucp
@@ -168,6 +177,7 @@ program
 🚚 Shipping: ${config.shipping_options.length} options available
 💳 Payment Handlers: ${config.payment_handlers.length} configured
 💾 Storage: ${storageType}${useDb ? ' (./data/ucp.db)' : ''}
+🔐 OAuth: ${oauthStatus}
         `);
         });
     }
@@ -198,10 +208,28 @@ program
         console.log(`   • Products: ${config.items.length}`);
         console.log(`   • Shipping Options: ${config.shipping_options.length}`);
         console.log(`   • Payment Handlers: ${config.payment_handlers.length}`);
+        console.log(`   • OAuth: ${config.oauth ? config.oauth.provider : 'Disabled'}`);
     }
     catch (error) {
         console.error('❌ Validation failed:', error);
         process.exit(1);
     }
 });
+program
+    .command('oauth:add-client')
+    .description('Register a new OAuth client (built-in provider only)')
+    .argument('<name>', 'Client application name')
+    .option('-r, --redirect-uri <uri>', 'Redirect URI', 'http://localhost:3000/callback')
+    .action((name, options) => {
+    const { OAuthManager } = require('./oauth');
+    const oauthManager = new OAuthManager();
+    const client = oauthManager.createClient(name, [options.redirectUri]);
+    console.log(`\n✅ OAuth client created!\n`);
+    console.log(`   Client ID:     ${client.client_id}`);
+    console.log(`   Client Secret: ${client.client_secret}`);
+    console.log(`   Redirect URI:  ${options.redirectUri}`);
+    console.log(`\n⚠️  Save the client secret. It cannot be retrieved later.`);
+    console.log(`\n📝 Add to your merchant-config.json:`);
+    console.log(JSON.stringify({ oauth: { provider: 'built-in' } }, null, 2));
+});
 program.parse();

package/dist/db.js

@@ -108,9 +108,44 @@ CREATE TABLE IF NOT EXISTS inventory (
   updated_at TEXT NOT NULL
 );
 
+CREATE TABLE IF NOT EXISTS oauth_clients (
+  client_id TEXT PRIMARY KEY,
+  client_secret_hash TEXT NOT NULL,
+  name TEXT NOT NULL,
+  redirect_uris_json TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS oauth_codes (
+  code TEXT PRIMARY KEY,
+  client_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  scope TEXT NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  code_challenge TEXT,
+  code_challenge_method TEXT,
+  expires_at INTEGER NOT NULL,
+  used INTEGER NOT NULL DEFAULT 0,
+  FOREIGN KEY (client_id) REFERENCES oauth_clients(client_id)
+);
+
+CREATE TABLE IF NOT EXISTS oauth_tokens (
+  token TEXT PRIMARY KEY,
+  token_type TEXT NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  scope TEXT NOT NULL,
+  parent_token TEXT,
+  expires_at INTEGER NOT NULL,
+  revoked INTEGER NOT NULL DEFAULT 0,
+  FOREIGN KEY (client_id) REFERENCES oauth_clients(client_id)
+);
+
 CREATE INDEX IF NOT EXISTS idx_line_items_checkout ON line_items(checkout_id);
 CREATE INDEX IF NOT EXISTS idx_orders_checkout ON orders(checkout_id);
 CREATE INDEX IF NOT EXISTS idx_checkouts_status ON checkouts(status);
+CREATE INDEX IF NOT EXISTS idx_oauth_tokens_client ON oauth_tokens(client_id);
+CREATE INDEX IF NOT EXISTS idx_oauth_codes_client ON oauth_codes(client_id);
 `;
 exports.db.exec(schema);
 logger_1.logger.info({ path: config_1.config.databasePath }, 'Database initialized');

package/dist/express-app.js

@@ -13,6 +13,7 @@ const db_1 = require("./db");
 const logger_1 = require("./logger");
 const stripe_1 = require("./stripe");
 const paypal_1 = require("./paypal");
+const oauth_1 = require("./oauth");
 // Rate limiters
 const apiLimiter = (0, express_rate_limit_1.default)({
     windowMs: 60 * 1000, // 1 minute
@@ -34,6 +35,11 @@ function createExpressApp(config, options) {
         ? new ucp_server_db_1.UCPServerDB(config)
         : new ucp_server_1.UCPServer(config);
     const useDb = options?.useDb ?? false;
+    // OAuth setup (built-in or external)
+    const oauthEnabled = !!config.oauth;
+    const oauthManager = oauthEnabled && config.oauth?.provider === 'built-in'
+        ? new oauth_1.OAuthManager()
+        : null;
     // Apply rate limiting to API routes
     app.use('/ucp/v1/', apiLimiter);
     // Stripe webhook needs raw body - must come before json parser
@@ -48,7 +54,7 @@ function createExpressApp(config, options) {
             res.status(400).json({ error: 'Invalid webhook signature' });
             return;
         }
-        logger_1.logger.info({ eventType: event.type, eventId: event.id }, 'Stripe webhook received');
+        logger_1.logger.info({ type: event.type }, 'Stripe webhook received');
         switch (event.type) {
             case 'payment_intent.succeeded': {
                 const paymentIntent = event.data.object;
@@ -144,6 +150,175 @@ function createExpressApp(config, options) {
         res.header('Access-Control-Allow-Headers', 'Content-Type, UCP-Agent, Authorization');
         next();
     });
+    // ─── OAuth 2.0 Identity Linking ─────────────────────────────────────
+    // RFC 8414: OAuth Authorization Server Metadata
+    app.get('/.well-known/oauth-authorization-server', (_req, res) => {
+        if (!oauthEnabled) {
+            res.status(404).json({ error: 'OAuth not configured' });
+            return;
+        }
+        if (config.oauth?.provider === 'external') {
+            // Proxy the merchant's external OAuth metadata
+            res.json({
+                issuer: config.oauth.issuer,
+                authorization_endpoint: config.oauth.authorization_endpoint,
+                token_endpoint: config.oauth.token_endpoint,
+                revocation_endpoint: config.oauth.revocation_endpoint,
+                jwks_uri: config.oauth.jwks_uri,
+                scopes_supported: ['ucp:scopes:checkout_session'],
+                response_types_supported: ['code'],
+                grant_types_supported: ['authorization_code', 'refresh_token'],
+                token_endpoint_auth_methods_supported: ['client_secret_basic'],
+            });
+        }
+        else if (oauthManager) {
+            res.json(oauthManager.getServerMetadata(config.domain));
+        }
+    });
+    // Built-in OAuth endpoints (only when provider is "built-in")
+    if (oauthManager) {
+        // Authorization endpoint - renders consent screen
+        app.get('/oauth2/authorize', (req, res) => {
+            const { client_id, redirect_uri, scope, state, response_type, code_challenge, code_challenge_method } = req.query;
+            if (response_type !== 'code') {
+                res.status(400).json({ error: 'unsupported_response_type' });
+                return;
+            }
+            const client = oauthManager.getClient(client_id);
+            if (!client) {
+                res.status(400).json({ error: 'invalid_client' });
+                return;
+            }
+            if (!client.redirect_uris.includes(redirect_uri)) {
+                res.status(400).json({ error: 'invalid_redirect_uri' });
+                return;
+            }
+            // Render a minimal consent page
+            res.send(`<!DOCTYPE html>
+<html><head><title>Authorize - ${config.name}</title>
+<style>
+body { font-family: system-ui, sans-serif; max-width: 400px; margin: 80px auto; padding: 0 20px; }
+h2 { margin-bottom: 4px; }
+p { color: #666; }
+.scope { background: #f0f0f0; padding: 8px 12px; border-radius: 6px; font-family: monospace; }
+button { padding: 10px 24px; border: none; border-radius: 6px; cursor: pointer; font-size: 14px; margin-right: 8px; }
+.allow { background: #000; color: #fff; }
+.deny { background: #e5e5e5; }
+</style></head>
+<body>
+<h2>${config.name}</h2>
+<p><strong>${client.name}</strong> wants to access your account.</p>
+<div class="scope">${scope || 'ucp:scopes:checkout_session'}</div>
+<p>This will allow the app to manage checkout sessions on your behalf.</p>
+<form method="POST" action="/oauth2/authorize">
+  <input type="hidden" name="client_id" value="${client_id}">
+  <input type="hidden" name="redirect_uri" value="${redirect_uri}">
+  <input type="hidden" name="scope" value="${scope || 'ucp:scopes:checkout_session'}">
+  <input type="hidden" name="state" value="${state || ''}">
+  <input type="hidden" name="code_challenge" value="${code_challenge || ''}">
+  <input type="hidden" name="code_challenge_method" value="${code_challenge_method || ''}">
+  <input type="hidden" name="user_id" value="user_1">
+  <button type="submit" name="action" value="allow" class="allow">Allow</button>
+  <button type="submit" name="action" value="deny" class="deny">Deny</button>
+</form>
+</body></html>`);
+        });
+        // Handle consent form submission
+        app.post('/oauth2/authorize', express_1.default.urlencoded({ extended: false }), (req, res) => {
+            const { client_id, redirect_uri, scope, state, action, user_id, code_challenge, code_challenge_method } = req.body;
+            if (action === 'deny') {
+                const url = new URL(redirect_uri);
+                url.searchParams.set('error', 'access_denied');
+                if (state)
+                    url.searchParams.set('state', state);
+                res.redirect(url.toString());
+                return;
+            }
+            const code = oauthManager.createAuthorizationCode(client_id, user_id, scope, redirect_uri, code_challenge || undefined, code_challenge_method || undefined);
+            const url = new URL(redirect_uri);
+            url.searchParams.set('code', code);
+            if (state)
+                url.searchParams.set('state', state);
+            res.redirect(url.toString());
+        });
+        // Token endpoint
+        app.post('/oauth2/token', (req, res) => {
+            // Client auth via HTTP Basic (RFC 7617)
+            const authHeader = req.headers.authorization;
+            let clientId = req.body.client_id;
+            let clientSecret = req.body.client_secret;
+            if (authHeader && authHeader.startsWith('Basic ')) {
+                const decoded = Buffer.from(authHeader.slice(6), 'base64').toString();
+                const [id, secret] = decoded.split(':');
+                clientId = id;
+                clientSecret = secret;
+            }
+            if (!oauthManager.authenticateClient(clientId, clientSecret)) {
+                res.status(401).json({ error: 'invalid_client' });
+                return;
+            }
+            const grantType = req.body.grant_type;
+            if (grantType === 'authorization_code') {
+                const result = oauthManager.exchangeCode(req.body.code, clientId, req.body.redirect_uri, req.body.code_verifier);
+                if ('error' in result) {
+                    res.status(400).json(result);
+                    return;
+                }
+                res.json({ ...result, token_type: 'Bearer' });
+            }
+            else if (grantType === 'refresh_token') {
+                const result = oauthManager.refreshAccessToken(req.body.refresh_token, clientId);
+                if ('error' in result) {
+                    res.status(400).json(result);
+                    return;
+                }
+                res.json({ ...result, token_type: 'Bearer' });
+            }
+            else {
+                res.status(400).json({ error: 'unsupported_grant_type' });
+            }
+        });
+        // Token revocation (RFC 7009)
+        app.post('/oauth2/revoke', (req, res) => {
+            const authHeader = req.headers.authorization;
+            let clientId = req.body.client_id;
+            let clientSecret = req.body.client_secret;
+            if (authHeader && authHeader.startsWith('Basic ')) {
+                const decoded = Buffer.from(authHeader.slice(6), 'base64').toString();
+                const [id, secret] = decoded.split(':');
+                clientId = id;
+                clientSecret = secret;
+            }
+            if (!oauthManager.authenticateClient(clientId, clientSecret)) {
+                res.status(401).json({ error: 'invalid_client' });
+                return;
+            }
+            oauthManager.revokeToken(req.body.token);
+            // RFC 7009: always respond 200, even if token was invalid
+            res.status(200).json({});
+        });
+    }
+    // Bearer token middleware for UCP routes (when OAuth is enabled)
+    if (oauthEnabled && oauthManager) {
+        app.use('/ucp/v1', (req, res, next) => {
+            const authHeader = req.headers.authorization;
+            if (!authHeader || !authHeader.startsWith('Bearer ')) {
+                res.status(401).json({ error: 'missing_token', message: 'Authorization: Bearer <token> required' });
+                return;
+            }
+            const token = authHeader.slice(7);
+            const validToken = oauthManager.validateAccessToken(token);
+            if (!validToken) {
+                res.status(401).json({ error: 'invalid_token', message: 'Token is expired, revoked, or invalid' });
+                return;
+            }
+            // Attach user info to request
+            req.oauthUserId = validToken.user_id;
+            req.oauthClientId = validToken.client_id;
+            req.oauthScope = validToken.scope;
+            next();
+        });
+    }
     // UCP Discovery endpoint
     app.get('/.well-known/ucp', (_req, res) => {
         res.json(ucpServer.getProfile());
@@ -278,6 +453,16 @@ function createExpressApp(config, options) {
     });
     // Admin dashboard HTML
     app.get('/admin', (_req, res) => {
+        const statsScript = useDb
+            ? `fetch('/admin/stats').then(r=>r.json()).then(d=>{
+  document.getElementById('stats').innerHTML = \`
+    <div class="card"><div class="stat">\${Object.values(d.checkouts).reduce((a,b)=>a+b,0)}</div><div class="label">Total Checkouts</div></div>
+    <div class="card"><div class="stat">\${d.checkouts.completed||0}</div><div class="label">Completed</div></div>
+    <div class="card"><div class="stat">\${d.orders.today||0}</div><div class="label">Orders Today</div></div>
+    <div class="card"><div class="stat">$\${(d.revenue.total_succeeded/100).toFixed(2)}</div><div class="label">Revenue</div></div>
+  \`;
+}).catch(e=>document.getElementById('stats').innerHTML='Error loading stats');`
+            : `document.getElementById('stats').innerHTML = '<div class="card" style="grid-column:1/-1"><div class="label">Running in <strong>in-memory mode</strong>. Stats require <code>--db</code> mode.</div><div style="margin-top:8px;font-size:0.85em;color:#999">Restart with: <code>ucpify serve config.json</code> (DB is on by default)</div></div>';`;
         res.send(`<!DOCTYPE html>
 <html><head><title>UCP Admin</title>
 <style>
@@ -287,20 +472,12 @@ function createExpressApp(config, options) {
   .label { color: #666; font-size: 0.9em; }
   .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 15px; }
   h1 { color: #333; }
+  code { background: #e5e5e5; padding: 2px 6px; border-radius: 3px; font-size: 0.85em; }
 </style>
 </head><body>
 <h1>🛒 UCP Server Admin</h1>
 <div class="grid" id="stats">Loading...</div>
-<script>
-fetch('/admin/stats').then(r=>r.json()).then(d=>{
-  document.getElementById('stats').innerHTML = \`
-    <div class="card"><div class="stat">\${Object.values(d.checkouts).reduce((a,b)=>a+b,0)}</div><div class="label">Total Checkouts</div></div>
-    <div class="card"><div class="stat">\${d.checkouts.completed||0}</div><div class="label">Completed</div></div>
-    <div class="card"><div class="stat">\${d.orders.today||0}</div><div class="label">Orders Today</div></div>
-    <div class="card"><div class="stat">$\${(d.revenue.total_succeeded/100).toFixed(2)}</div><div class="label">Revenue</div></div>
-  \`;
-}).catch(e=>document.getElementById('stats').innerHTML='Error loading stats');
-</script>
+<script>${statsScript}</script>
 </body></html>`);
     });
     // Health check

package/dist/oauth.d.ts

@@ -0,0 +1,60 @@
+export interface OAuthClient {
+    client_id: string;
+    client_secret: string;
+    client_secret_hash: string;
+    name: string;
+    redirect_uris: string[];
+    created_at: string;
+}
+export interface AuthorizationCode {
+    code: string;
+    client_id: string;
+    user_id: string;
+    scope: string;
+    redirect_uri: string;
+    code_challenge?: string;
+    code_challenge_method?: string;
+    expires_at: number;
+    used: boolean;
+}
+export interface OAuthToken {
+    token: string;
+    token_type: 'access' | 'refresh';
+    client_id: string;
+    user_id: string;
+    scope: string;
+    parent_token?: string;
+    expires_at: number;
+    revoked: boolean;
+}
+export declare const UCP_SCOPES: readonly ["ucp:scopes:checkout_session"];
+export declare class OAuthManager {
+    private clients;
+    private codes;
+    private accessTokens;
+    private refreshTokens;
+    createClient(name: string, redirectUris: string[]): OAuthClient;
+    getClient(clientId: string): OAuthClient | undefined;
+    authenticateClient(clientId: string, clientSecret: string): boolean;
+    createAuthorizationCode(clientId: string, userId: string, scope: string, redirectUri: string, codeChallenge?: string, codeChallengeMethod?: string): string;
+    exchangeCode(code: string, clientId: string, redirectUri: string, codeVerifier?: string): {
+        access_token: string;
+        refresh_token: string;
+        expires_in: number;
+        scope: string;
+    } | {
+        error: string;
+    };
+    private createAccessToken;
+    private createRefreshToken;
+    refreshAccessToken(refreshToken: string, clientId: string): {
+        access_token: string;
+        expires_in: number;
+        scope: string;
+    } | {
+        error: string;
+    };
+    validateAccessToken(token: string): OAuthToken | null;
+    revokeToken(token: string): boolean;
+    getServerMetadata(issuer: string): Record<string, unknown>;
+}

package/dist/oauth.js

@@ -0,0 +1,211 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthManager = exports.UCP_SCOPES = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const logger_1 = require("./logger");
+// ─── Constants ───────────────────────────────────────────────────────
+exports.UCP_SCOPES = ['ucp:scopes:checkout_session'];
+const ACCESS_TOKEN_TTL = 60 * 60; // 1 hour
+const REFRESH_TOKEN_TTL = 60 * 60 * 24 * 30; // 30 days
+const AUTH_CODE_TTL = 60 * 10; // 10 minutes
+// ─── Helpers ─────────────────────────────────────────────────────────
+function generateToken(bytes = 32) {
+    return crypto_1.default.randomBytes(bytes).toString('hex');
+}
+function hashSecret(secret) {
+    return crypto_1.default.createHash('sha256').update(secret).digest('hex');
+}
+function nowEpoch() {
+    return Math.floor(Date.now() / 1000);
+}
+// ─── OAuth Manager ───────────────────────────────────────────────────
+class OAuthManager {
+    clients = new Map();
+    codes = new Map();
+    accessTokens = new Map();
+    refreshTokens = new Map();
+    // ── Client Management ──
+    createClient(name, redirectUris) {
+        const clientId = `ucp_${generateToken(16)}`;
+        const clientSecret = `ucp_secret_${generateToken(24)}`;
+        const client = {
+            client_id: clientId,
+            client_secret: clientSecret,
+            client_secret_hash: hashSecret(clientSecret),
+            name,
+            redirect_uris: redirectUris,
+            created_at: new Date().toISOString(),
+        };
+        this.clients.set(clientId, client);
+        logger_1.logger.info({ clientId, name }, 'OAuth client created');
+        return client;
+    }
+    getClient(clientId) {
+        return this.clients.get(clientId);
+    }
+    authenticateClient(clientId, clientSecret) {
+        const client = this.clients.get(clientId);
+        if (!client)
+            return false;
+        return client.client_secret_hash === hashSecret(clientSecret);
+    }
+    // ── Authorization Code ──
+    createAuthorizationCode(clientId, userId, scope, redirectUri, codeChallenge, codeChallengeMethod) {
+        const code = generateToken(32);
+        const authCode = {
+            code,
+            client_id: clientId,
+            user_id: userId,
+            scope,
+            redirect_uri: redirectUri,
+            code_challenge: codeChallenge,
+            code_challenge_method: codeChallengeMethod,
+            expires_at: nowEpoch() + AUTH_CODE_TTL,
+            used: false,
+        };
+        this.codes.set(code, authCode);
+        logger_1.logger.info({ clientId, userId, scope }, 'Authorization code created');
+        return code;
+    }
+    exchangeCode(code, clientId, redirectUri, codeVerifier) {
+        const authCode = this.codes.get(code);
+        if (!authCode)
+            return { error: 'invalid_grant' };
+        if (authCode.used)
+            return { error: 'invalid_grant' };
+        if (authCode.client_id !== clientId)
+            return { error: 'invalid_grant' };
+        if (authCode.redirect_uri !== redirectUri)
+            return { error: 'invalid_grant' };
+        if (authCode.expires_at < nowEpoch())
+            return { error: 'invalid_grant' };
+        // PKCE verification
+        if (authCode.code_challenge) {
+            if (!codeVerifier)
+                return { error: 'invalid_grant' };
+            const method = authCode.code_challenge_method || 'S256';
+            let computed;
+            if (method === 'S256') {
+                computed = crypto_1.default.createHash('sha256').update(codeVerifier).digest('base64url');
+            }
+            else {
+                computed = codeVerifier;
+            }
+            if (computed !== authCode.code_challenge)
+                return { error: 'invalid_grant' };
+        }
+        // Mark code as used
+        authCode.used = true;
+        this.codes.set(code, authCode);
+        // Generate tokens
+        const accessToken = this.createAccessToken(clientId, authCode.user_id, authCode.scope);
+        const refreshToken = this.createRefreshToken(clientId, authCode.user_id, authCode.scope);
+        logger_1.logger.info({ clientId, userId: authCode.user_id }, 'Authorization code exchanged for tokens');
+        return {
+            access_token: accessToken,
+            refresh_token: refreshToken,
+            expires_in: ACCESS_TOKEN_TTL,
+            scope: authCode.scope,
+        };
+    }
+    // ── Token Management ──
+    createAccessToken(clientId, userId, scope) {
+        const token = generateToken(32);
+        this.accessTokens.set(token, {
+            token,
+            token_type: 'access',
+            client_id: clientId,
+            user_id: userId,
+            scope,
+            expires_at: nowEpoch() + ACCESS_TOKEN_TTL,
+            revoked: false,
+        });
+        return token;
+    }
+    createRefreshToken(clientId, userId, scope) {
+        const token = generateToken(32);
+        this.refreshTokens.set(token, {
+            token,
+            token_type: 'refresh',
+            client_id: clientId,
+            user_id: userId,
+            scope,
+            expires_at: nowEpoch() + REFRESH_TOKEN_TTL,
+            revoked: false,
+        });
+        return token;
+    }
+    refreshAccessToken(refreshToken, clientId) {
+        const rt = this.refreshTokens.get(refreshToken);
+        if (!rt)
+            return { error: 'invalid_grant' };
+        if (rt.revoked)
+            return { error: 'invalid_grant' };
+        if (rt.client_id !== clientId)
+            return { error: 'invalid_grant' };
+        if (rt.expires_at < nowEpoch())
+            return { error: 'invalid_grant' };
+        const accessToken = this.createAccessToken(clientId, rt.user_id, rt.scope);
+        logger_1.logger.info({ clientId, userId: rt.user_id }, 'Access token refreshed');
+        return {
+            access_token: accessToken,
+            expires_in: ACCESS_TOKEN_TTL,
+            scope: rt.scope,
+        };
+    }
+    validateAccessToken(token) {
+        const t = this.accessTokens.get(token);
+        if (!t)
+            return null;
+        if (t.revoked)
+            return null;
+        if (t.expires_at < nowEpoch())
+            return null;
+        return t;
+    }
+    revokeToken(token) {
+        // Check access tokens
+        const at = this.accessTokens.get(token);
+        if (at) {
+            at.revoked = true;
+            this.accessTokens.set(token, at);
+            logger_1.logger.info({ tokenType: 'access', clientId: at.client_id }, 'Token revoked');
+            return true;
+        }
+        // Check refresh tokens - also revoke all associated access tokens
+        const rt = this.refreshTokens.get(token);
+        if (rt) {
+            rt.revoked = true;
+            this.refreshTokens.set(token, rt);
+            // Revoke all access tokens for same client+user
+            for (const [key, accessToken] of this.accessTokens) {
+                if (accessToken.client_id === rt.client_id && accessToken.user_id === rt.user_id) {
+                    accessToken.revoked = true;
+                    this.accessTokens.set(key, accessToken);
+                }
+            }
+            logger_1.logger.info({ tokenType: 'refresh', clientId: rt.client_id }, 'Refresh token and associated access tokens revoked');
+            return true;
+        }
+        return false;
+    }
+    // ── Metadata ──
+    getServerMetadata(issuer) {
+        return {
+            issuer,
+            authorization_endpoint: `${issuer}/oauth2/authorize`,
+            token_endpoint: `${issuer}/oauth2/token`,
+            revocation_endpoint: `${issuer}/oauth2/revoke`,
+            scopes_supported: [...exports.UCP_SCOPES],
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code', 'refresh_token'],
+            token_endpoint_auth_methods_supported: ['client_secret_basic'],
+            code_challenge_methods_supported: ['S256'],
+            service_documentation: `${issuer}/docs/oauth2`,
+        };
+    }
+}
+exports.OAuthManager = OAuthManager;

package/dist/schema.d.ts

@@ -21,6 +21,17 @@ export declare const PaymentHandlerSchema: z.ZodObject<{
     id: z.ZodString;
     config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
+export declare const OAuthConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    provider: z.ZodLiteral<"built-in">;
+}, z.core.$strip>, z.ZodObject<{
+    provider: z.ZodLiteral<"external">;
+    issuer: z.ZodString;
+    authorization_endpoint: z.ZodString;
+    token_endpoint: z.ZodString;
+    revocation_endpoint: z.ZodOptional<z.ZodString>;
+    jwks_uri: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "provider">;
+export type OAuthConfig = z.infer<typeof OAuthConfigSchema>;
 export declare const MerchantConfigSchema: z.ZodObject<{
     name: z.ZodString;
     domain: z.ZodString;
@@ -50,6 +61,16 @@ export declare const MerchantConfigSchema: z.ZodObject<{
     }, z.core.$strip>>>;
     tax_rate: z.ZodDefault<z.ZodNumber>;
     port: z.ZodDefault<z.ZodNumber>;
+    oauth: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        provider: z.ZodLiteral<"built-in">;
+    }, z.core.$strip>, z.ZodObject<{
+        provider: z.ZodLiteral<"external">;
+        issuer: z.ZodString;
+        authorization_endpoint: z.ZodString;
+        token_endpoint: z.ZodString;
+        revocation_endpoint: z.ZodOptional<z.ZodString>;
+        jwks_uri: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>], "provider">>;
 }, z.core.$strip>;
 export type Item = z.infer<typeof ItemSchema>;
 export type ShippingOption = z.infer<typeof ShippingOptionSchema>;