Abstract Class: BaseOAuthIntrospectRouteSQL

Defined in: auth/src/routes/sql/BaseOAuthIntrospectRouteSQL.ts:8

Handles the OAuth 2.0 token introspection endpoint (RFC 7662). The caller must itself authenticate as a confidential client — unlike /revoke, RFC 7662 introspection exposes information about another caller's token (its scope, subject, client), so an unauthenticated or public-client caller (which can't prove its identity) is never trusted with it. Returns {active:false} for anything invalid, expired, revoked, or simply unrecognized — RFC 7662 §2.2 treats all of those identically, never as an error, so a caller can't distinguish "this token doesn't exist" from "this token exists but isn't yours to see".

Extends

• BaseOAuthIntrospectRoute<ClientSQL, OAuthRefreshTokenSQL>

Constructors

Constructor

new BaseOAuthIntrospectRouteSQL(): BaseOAuthIntrospectRouteSQL

Returns

BaseOAuthIntrospectRouteSQL

Inherited from

BaseOAuthIntrospectRoute.constructor

Properties

accessTokenDenylist?

protected optional accessTokenDenylist?: AccessTokenDenylist

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:31

Inherited from

BaseOAuthIntrospectRoute.accessTokenDenylist

---

clientAuthUtils?

protected optional clientAuthUtils?: ClientAuthUtils

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:36

Inherited from

BaseOAuthIntrospectRoute.clientAuthUtils

---

clientClass

protected clientClass: any = ClientSQL

Defined in: auth/src/routes/sql/BaseOAuthIntrospectRouteSQL.ts:9

Overrides

BaseOAuthIntrospectRoute.clientClass

---

clientRepo?

protected optional clientRepo?: RepoUtils<ClientSQL>

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:40

Inherited from

BaseOAuthIntrospectRoute.clientRepo

---

oauthTokenUtils?

protected optional oauthTokenUtils?: OAuthTokenUtils

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:42

Inherited from

BaseOAuthIntrospectRoute.oauthTokenUtils

---

rateLimiter?

protected optional rateLimiter?: RateLimiter

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:45

Inherited from

BaseOAuthIntrospectRoute.rateLimiter

---

refreshTokenClass

protected refreshTokenClass: any = OAuthRefreshTokenSQL

Defined in: auth/src/routes/sql/BaseOAuthIntrospectRouteSQL.ts:10

Overrides

BaseOAuthIntrospectRoute.refreshTokenClass

---

refreshTokenRepo?

protected optional refreshTokenRepo?: RepoUtils<OAuthRefreshTokenSQL>

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:49

Inherited from

BaseOAuthIntrospectRoute.refreshTokenRepo

---

signingKeyClass

protected signingKeyClass: any = SigningKeySQL

Defined in: auth/src/routes/sql/BaseOAuthIntrospectRouteSQL.ts:11

Overrides

BaseOAuthIntrospectRoute.signingKeyClass

Methods

introspect()

introspect(req, res): Promise<any>

Defined in: auth/src/routes/BaseOAuthIntrospectRoute.ts:156

Introspects the given token (RFC 7662). Always responds 200 — an unrecognized, expired, or revoked token yields {active:false} rather than an error. Only a missing token parameter or a client-authentication failure is reported as an error.

Parameters

req

HttpRequest

res

HttpResponse

Returns

Promise<any>

Inherited from

BaseOAuthIntrospectRoute.introspect