Abstract Class: BaseOAuthIntrospectRoute<C, R>

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:30

Handles the OAuth 2.0 token introspection endpoint (RFC 7662). The caller must itself authenticate as a confidential client — unlike /revoke, RFC 7662 introspection exposes information about another caller's token (its scope, subject, client), so an unauthenticated or public-client caller (which can't prove its identity) is never trusted with it. Returns {active:false} for anything invalid, expired, revoked, or simply unrecognized — RFC 7662 §2.2 treats all of those identically, never as an error, so a caller can't distinguish "this token doesn't exist" from "this token exists but isn't yours to see".

Extended by

• BaseOAuthIntrospectRouteMongo
• BaseOAuthIntrospectRouteSQL

Type Parameters

C

C extends Client

R

R extends OAuthRefreshToken

Constructors

Constructor

new BaseOAuthIntrospectRoute<C, R>(): BaseOAuthIntrospectRoute<C, R>

Returns

BaseOAuthIntrospectRoute<C, R>

Properties

accessTokenDenylist?

protected optional accessTokenDenylist?: AccessTokenDenylist

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:31

---

clientAuthUtils?

protected optional clientAuthUtils?: ClientAuthUtils

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:36

---

clientClass

abstract protected clientClass: any

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:38

---

clientRepo?

protected optional clientRepo?: RepoUtils<C>

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:40

---

oauthTokenUtils?

protected optional oauthTokenUtils?: OAuthTokenUtils

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:42

---

rateLimiter?

protected optional rateLimiter?: RateLimiter

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:45

---

refreshTokenClass

abstract protected refreshTokenClass: any

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:47

---

refreshTokenRepo?

protected optional refreshTokenRepo?: RepoUtils<R>

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:49

---

signingKeyClass

abstract protected signingKeyClass: any

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:51

Methods

introspect()

introspect(req, res): Promise<any>

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:156

Introspects the given token (RFC 7662). Always responds 200 — an unrecognized, expired, or revoked token yields {active:false} rather than an error. Only a missing token parameter or a client-authentication failure is reported as an error.

Parameters

req

HttpRequest

res

HttpResponse

Returns

Promise<any>