src/oauth-client-docs.ts

Functions

Imports

It imports no other module of this repo. Imported by src/routes.ts.

Source

1// OAuth client documents the Worker serves itself (job_bf05bc756c5e, the master to main
2// plan; Dustin 2026-10-03: "the two OAuth client documents are served by the capsid Worker
3// itself at a stable path, so no client id depends on a branch name again").
4//
5// Since design PR 4 of capsid/research/design-capsid-access-login.md the Worker takes
6// clients by Client ID Metadata Document only, and a client id is the URL of its document.
7// The verify-live probe's document was a file on the master branch
8// (scripts/verify-live-client.json, through raw.githubusercontent.com), so renaming the
9// branch would have changed the probe's identity. Here it is served at a path that names
10// no branch. The document's client_id is the URL it was fetched at, which is what the
11// provider requires (scripts/cimd-probe-lib.mjs, probeDocumentProblem).
12//
13// Public by nature: a CIMD document is fetched by the authorization server with no
14// credential and holds no secret (token_endpoint_auth_method "none").
15
16const OAUTH_CLIENT_PREFIX = "/oauth/clients/";
17export const VERIFY_LIVE_CLIENT_PATH = `${OAUTH_CLIENT_PREFIX}verify-live.json`;
18
19const DOCUMENTS: Record<string, Record<string, unknown>> = {
20  [VERIFY_LIVE_CLIENT_PATH]: {
21    client_name: "capsid verify-live probe",
22    redirect_uris: ["https://example.com/verify-live-callback"],
23    token_endpoint_auth_method: "none",
24    grant_types: ["authorization_code"],
25    response_types: ["code"],
26  },
27};
28
29/** The client document at `url`, or null when no document lives at that path. */
30export function clientDocument(url: URL): Record<string, unknown> | null {
31  const doc = DOCUMENTS[url.pathname];
32  return doc ? { client_id: `${url.origin}${url.pathname}`, ...doc } : null;
33}
34
35export function handleClientDocument(request: Request): Response {
36  const url = new URL(request.url);
37  const doc = clientDocument(url);
38  if (!doc) return new Response("no such client document", { status: 404, headers: { "Content-Type": "text/plain;charset=utf-8" } });
39  return Response.json(doc, { headers: { "Cache-Control": "public, max-age=300", "X-Content-Type-Options": "nosniff" } });
40}