Skip to main content

Abstract Class: BaseOAuthSessionTokenRouteSQL

Defined in: auth/src/routes/sql/BaseOAuthSessionTokenRouteSQL.ts:8

Exchanges a presented OAuth 2.0 access token (Authorization: Bearer, verified via the same OAuthBearerStrategy that protects /userinfo) for one of this library's own ordinary session JWTs - the exact token every other sign-in route (password/MFA/passkey/refresh/OIDC) hands back via TokenUtils.createAuthResult().

This exists for a native app (see e.g. tauri-client) that signs in entirely through the standard OAuth 2.0 + PKCE authorization-code flow this server already exposes (/oauth/authorize, /oauth/token, both unmodified) but then also needs to call this deployment's ordinary, JWTStrategy-protected /api/... routes - which only ever accept a plain session jwt, never an OAuth access token directly. Widening every such route to accept oauth_bearer was deliberately rejected: those routes live in service-core (shared far beyond this library) and would need a new @rapidrest/auth dependency they don't have today, and - more fundamentally - an OAuth access token carries no roles claim at all (OAuthBearerStrategy.authenticate() always mints { roles: [] }), so accepting it directly on a role-gated route would silently authorize as "no roles" rather than fail loudly. This route sidesteps both problems in one small, local place: it looks up the real User record behind the token's sub and mints a normal session JWT carrying that user's actual roles.

Deliberately calls createAuthResult() with no res (no Set-Cookie at all - a native app has no cookie jar this endpoint should be writing into; the response body's token is the only thing that matters here) and no authMethod (this exchange verifies no new credential of its own - the actual credential check already happened when the access token's underlying authorization was granted through the interactive /oauth/authorize flow - so, exactly like BaseAuthRefreshRoute's routine refresh, it must never fire a SIGNED_IN audit entry; see TokenUtils.createAuthResult()'s own doc comment on that gating). Only token is ever returned to the caller - never refresh - since a native app's long-term credential remains its own OAuth refresh token, renewed via the unmodified /oauth/token refresh_token grant, not this session-refresh token.

Extends​

Constructors​

Constructor​

new BaseOAuthSessionTokenRouteSQL(): BaseOAuthSessionTokenRouteSQL

Returns​

BaseOAuthSessionTokenRouteSQL

Inherited from​

BaseOAuthSessionTokenRoute.constructor

Properties​

authMiddleware?​

protected optional authMiddleware?: AuthMiddleware

Defined in: auth/src/routes/BaseOAuthSessionTokenRoute.ts:72

Inherited from​

BaseOAuthSessionTokenRoute.authMiddleware

defaultScopes​

protected defaultScopes: string[] = []

Defined in: auth/src/routes/BaseOAuthSessionTokenRoute.ts:75

Inherited from​

BaseOAuthSessionTokenRoute.defaultScopes

oauthTokenUtils?​

protected optional oauthTokenUtils?: OAuthTokenUtils

Defined in: auth/src/routes/BaseOAuthSessionTokenRoute.ts:77

Inherited from​

BaseOAuthSessionTokenRoute.oauthTokenUtils

signingKeyClass​

protected signingKeyClass: any = SigningKeySQL

Defined in: auth/src/routes/sql/BaseOAuthSessionTokenRouteSQL.ts:9

Overrides​

BaseOAuthSessionTokenRoute.signingKeyClass

tokenUtils?​

protected optional tokenUtils?: TokenUtils

Defined in: auth/src/routes/BaseOAuthSessionTokenRoute.ts:82

Inherited from​

BaseOAuthSessionTokenRoute.tokenUtils

userClass​

protected userClass: any = UserSQL

Defined in: auth/src/routes/sql/BaseOAuthSessionTokenRouteSQL.ts:10

Overrides​

BaseOAuthSessionTokenRoute.userClass

userRepo?​

protected optional userRepo?: RepoUtils<UserSQL>

Defined in: auth/src/routes/BaseOAuthSessionTokenRoute.ts:86

Inherited from​

BaseOAuthSessionTokenRoute.userRepo

Methods​

sessionToken()​

sessionToken(oauthUser, req): Promise<{ token: string; }>

Defined in: auth/src/routes/BaseOAuthSessionTokenRoute.ts:148

Exchanges the presented OAuth access token for an ordinary session JWT. oauthUser.uid (the token's sub) is trusted only to look up the real account - the token's own roles/scopes (always []/ its OAuth scope) are never carried over into the minted session JWT; the account's actual roles and this deployment's configured auth:default_scopes are used instead, exactly as every other sign-in route does.

Parameters​

oauthUser​

JWTUser

req​

HttpRequest

Returns​

Promise<{ token: string; }>

Inherited from​

BaseOAuthSessionTokenRoute.sessionToken