Function createOAuthRouter

Parameters

• express: {
      json: () => RequestHandler;
      Router: () => Router;
      urlencoded: (opts: { extended: boolean }) => RequestHandler;
  }
• __namedParameters: {
      accessTokenDenylist?: AccessTokenDenylist;
      auditSink?: AuditSink;
      clientRepository: ClientRepository;
      codeRepository: CodeRepository;
      config: {
          accessTokenDenylist?: { adapter?: "redis" | "memory" };
          audit?: { sink: { type: string; [key: string]: unknown } };
          cors: { allowedOrigins: string[] };
          deployment?: { mode?: "single" | "multi" };
          endpoints: { login: { url: string } };
          federations: z.ZodRecord<
              z.ZodString,
              z.ZodObject<
                  {
                      enabled: z.ZodPreprocess<z.ZodBoolean>;
                      type: z.ZodOptional<z.ZodString>;
                  },
                  z.core.$loose,
              >,
          >;
          http: {
              port: number;
              readinessTimeoutMs: number;
              trustProxy: number
              | boolean
              | string[];
          };
          logging: {
              level: | "trace"
              | "debug"
              | "info"
              | "warn"
              | "error"
              | "fatal"
              | "silent";
          };
          memoryRateLimiter?: {
              defaultLimit?: { limit: number; windowSeconds: number };
              limits?: Record<string, { limit: number; windowSeconds: number }>;
              maxBuckets?: number;
          };
          oauth: {
              accessToken: { expiresIn: number };
              authorize?: Record<string, never>;
              code?: { adapter?: "redis" | "memory" };
              grants: { [key: string]: unknown };
              jwt: {
                  issuer: string;
                  jwksCacheMaxAge?: number;
                  jwksPath?: string;
                  legacyTypAccept?: boolean;
                  signingKey: {
                      local?:
                          | {
                              algorithm: "HS256";
                              kid: string;
                              previousSecrets?: { expiresAt: string; kid: string; secret: string }[];
                              secret?: string;
                          }
                          | {
                              algorithm: "RS256"
                              | "ES256"
                              | "EdDSA";
                              kid: string;
                              previousKeys?: {
                                  expiresAt: string;
                                  kid: string;
                                  publicKey?: (...) | (...);
                                  publicKeyPath?: (...) | (...);
                              }[];
                              privateKey?: string;
                              privateKeyPath?: string;
                              publicKey?: string;
                              publicKeyPath?: string;
                              [key: string]: unknown;
                          };
                      provider: string;
                      [key: string]: unknown;
                  };
              };
              nonce?: { maxLength: number };
              oidcMode: "oidc-required" | "dual";
              refreshToken: {
                  expiresIn: number;
                  legacyRtPolicy: "reject";
                  unknownFamilyPolicy: "accept" | "reject";
              };
              requireEmailVerified?: boolean;
              resourceIndicator?: { enabled: boolean };
              revocation?: { accessToken: "denylist" | "unsupported" };
              tokenBinding?: {
                  "dispatch-policy": "intent-explicit" | "strict-mutual-exclusion";
              };
              tokenExchange?: { maxActorChainDepth: number };
          };
          rateLimit: {
              failMode: "open"
              | "closed";
              login: { limit: number; windowMs: number };
          };
          rateLimiter?: { adapter?: "redis"
          | "memory" };
          redisAccessTokenDenylist?: { keyPrefix?: string };
          redisCodeRepository?: { defaultExpiresIn?: number; keyPrefix?: string };
          redisRefreshTokenFamilyStore?: {
              casRetryLimit?: number;
              keyPrefix?: string;
          };
          redisSessionStores?: { keyPrefix?: string };
          refreshTokenFamilyStore?: { redis?: { password?: string; url: string } };
          repositories: {
              client: { type: string; [key: string]: unknown };
              code: { type: string; [key: string]: unknown };
              user: { type: string; [key: string]: unknown };
          };
          session: {
              csrf?: { trustedOrigins: string[]; ttlSeconds: number };
              domain: string | null;
              maxAge: number;
              name: string;
              sameSite: "none" | "lax" | "strict";
              secret: string;
              secure: boolean;
              storage: {
                  redis?: { password?: string; url: string };
                  type: string;
                  [key: string]: unknown;
              };
          };
          userSessionStores?: { adapter?: "redis"
          | "memory" };
      };
      federationTokenStore?: FederationTokenStore;
      getFederationProviders?: () => | ReadonlyMap<
          string,
          FederationProviderHandle,
      >
      | undefined;
      grantPolicy?: GrantPolicyHook;
      keyStore: KeyStore;
      logger?: Logger;
      rateLimiter?: RateLimiter;
      refreshTokenFamilyRevocation?: RefreshTokenFamilyRevocation;
      registry: GrantHandlerResolver;
      sessionFamilyIndex?: SessionFamilyIndex;
      sessionFederationIndex?: SessionFederationIndex;
      sessionRPRegistry?: SessionRPRegistry;
      subjectRevocation?: SubjectRevocation;
      userSessionStore?: UserSessionStore;
  }

  • OptionalaccessTokenDenylist?: AccessTokenDenylist

    Wave 1 — RFC 7009 access-token revocation. Optional: when absent, AT revocation is a warn-logged no-op.

  • OptionalauditSink?: AuditSink

  • clientRepository: ClientRepository

  • codeRepository: CodeRepository

  • config: {
        accessTokenDenylist?: { adapter?: "redis" | "memory" };
        audit?: { sink: { type: string; [key: string]: unknown } };
        cors: { allowedOrigins: string[] };
        deployment?: { mode?: "single" | "multi" };
        endpoints: { login: { url: string } };
        federations: z.ZodRecord<
            z.ZodString,
            z.ZodObject<
                {
                    enabled: z.ZodPreprocess<z.ZodBoolean>;
                    type: z.ZodOptional<z.ZodString>;
                },
                z.core.$loose,
            >,
        >;
        http: {
            port: number;
            readinessTimeoutMs: number;
            trustProxy: number
            | boolean
            | string[];
        };
        logging: {
            level: | "trace"
            | "debug"
            | "info"
            | "warn"
            | "error"
            | "fatal"
            | "silent";
        };
        memoryRateLimiter?: {
            defaultLimit?: { limit: number; windowSeconds: number };
            limits?: Record<string, { limit: number; windowSeconds: number }>;
            maxBuckets?: number;
        };
        oauth: {
            accessToken: { expiresIn: number };
            authorize?: Record<string, never>;
            code?: { adapter?: "redis" | "memory" };
            grants: { [key: string]: unknown };
            jwt: {
                issuer: string;
                jwksCacheMaxAge?: number;
                jwksPath?: string;
                legacyTypAccept?: boolean;
                signingKey: {
                    local?:
                        | {
                            algorithm: "HS256";
                            kid: string;
                            previousSecrets?: { expiresAt: string; kid: string; secret: string }[];
                            secret?: string;
                        }
                        | {
                            algorithm: "RS256"
                            | "ES256"
                            | "EdDSA";
                            kid: string;
                            previousKeys?: {
                                expiresAt: string;
                                kid: string;
                                publicKey?: (...) | (...);
                                publicKeyPath?: (...) | (...);
                            }[];
                            privateKey?: string;
                            privateKeyPath?: string;
                            publicKey?: string;
                            publicKeyPath?: string;
                            [key: string]: unknown;
                        };
                    provider: string;
                    [key: string]: unknown;
                };
            };
            nonce?: { maxLength: number };
            oidcMode: "oidc-required" | "dual";
            refreshToken: {
                expiresIn: number;
                legacyRtPolicy: "reject";
                unknownFamilyPolicy: "accept" | "reject";
            };
            requireEmailVerified?: boolean;
            resourceIndicator?: { enabled: boolean };
            revocation?: { accessToken: "denylist" | "unsupported" };
            tokenBinding?: {
                "dispatch-policy": "intent-explicit" | "strict-mutual-exclusion";
            };
            tokenExchange?: { maxActorChainDepth: number };
        };
        rateLimit: {
            failMode: "open"
            | "closed";
            login: { limit: number; windowMs: number };
        };
        rateLimiter?: { adapter?: "redis"
        | "memory" };
        redisAccessTokenDenylist?: { keyPrefix?: string };
        redisCodeRepository?: { defaultExpiresIn?: number; keyPrefix?: string };
        redisRefreshTokenFamilyStore?: {
            casRetryLimit?: number;
            keyPrefix?: string;
        };
        redisSessionStores?: { keyPrefix?: string };
        refreshTokenFamilyStore?: { redis?: { password?: string; url: string } };
        repositories: {
            client: { type: string; [key: string]: unknown };
            code: { type: string; [key: string]: unknown };
            user: { type: string; [key: string]: unknown };
        };
        session: {
            csrf?: { trustedOrigins: string[]; ttlSeconds: number };
            domain: string | null;
            maxAge: number;
            name: string;
            sameSite: "none" | "lax" | "strict";
            secret: string;
            secure: boolean;
            storage: {
                redis?: { password?: string; url: string };
                type: string;
                [key: string]: unknown;
            };
        };
        userSessionStores?: { adapter?: "redis"
        | "memory" };
    }

  • OptionalfederationTokenStore?: FederationTokenStore

  • OptionalgetFederationProviders?: () => ReadonlyMap<string, FederationProviderHandle> | undefined

    Lazy getter for the federation providers Map. Evaluated at request time so module init order does not affect resolution — pass () => context.federationProviders from module.mts. Defaults to () => undefined when not provided.

  • OptionalgrantPolicy?: GrantPolicyHook

  • keyStore: KeyStore

  • Optionallogger?: Logger

  • OptionalrateLimiter?: RateLimiter

  • OptionalrefreshTokenFamilyRevocation?: RefreshTokenFamilyRevocation

  • registry: GrantHandlerResolver

  • OptionalsessionFamilyIndex?: SessionFamilyIndex

  • OptionalsessionFederationIndex?: SessionFederationIndex

  • OptionalsessionRPRegistry?: SessionRPRegistry

  • OptionalsubjectRevocation?: SubjectRevocation

    #296 — per-subject access-token watermark. The subject-level companion to accessTokenDenylist: the denylist revokes a token the client named, this revokes every token a subject held as of a credential change, which cannot be expressed as a set of jtis. Forwarded to every surface that already consults the denylist, so a watermark written by revokeAllForSubject is honoured rather than inert.

  • OptionaluserSessionStore?: UserSessionStore