构建 OAuth2 授权服务器

项目概述

本项目实现一个面向 oauth2 delegation 的完整系统，核心要解决的问题是 issuing access tokens with scoped consent and validating them at resource servers without a shared secret。整体由 Authorization endpoint、Token issuer、Consent screen、Refresh rotation、Token introspection 五个模块组成，每个模块单一职责、可独立测试，最后通过集成测试验证端到端正确性。设计上把 a stolen refresh token that is replayed before rotation detects the anomaly and revokes the session 作为第一类需求先行处理，而非事后再补。

架构与关键决策

数据模型为 a signed JWT access token carrying scopes and expiry, plus a refresh token stored as a hashed rotating credential。Authorization endpoint 定义其余阶段共同依赖的数据形状并在边界处校验输入；Token issuer 承载 oauth2 delegation 的正确性逻辑；Consent screen 专门处理 a stolen refresh token that is replayed before rotation detects the anomaly and revokes the session，在失败路径上给出明确的拒绝、重试或降级策略；Refresh rotation 提供可观测性，每次操作输出带关联 id 的结构化事件；Token introspection 在过载时按既定方式降级，避免过载演变为数据损坏。配置与代码分离，使风险变更可经 diff 审阅。

实施与测试

按五个阶段依次实现 Authorization endpoint、Token issuer、Consent screen、Refresh rotation、Token introspection，每阶段配套聚焦单测。集成测试组合各模块并驱动真实 oauth2 delegation 场景：先验证正常路径，再刻意触发 a stolen refresh token that is replayed before rotation detects the anomaly and revokes the session 并断言系统降级而非损坏。所有依赖均在进程内或被桩替换，用例在 CI 中确定可复现。

限制与后续

• 单区域设计，多区域复制超出范围。
• Authorization endpoint 默认进程内，未水平共享。
• 无鉴权层，假定部署在强制身份的边缘之后。

代码示例

# setup for oauth2-authz-server
pnpm init
pnpm add express jose argon2
pnpm add -D typescript tsx vitest

oauth2_authz_server/
├── src/index.ts
├── src/authorization-endpoint.ts
├── src/token-issuer.ts
├── tests/oauth2_authz_server.test.ts
└── package.json

// Authorization endpoint: oauth2 delegation core
export function authorizationendpoint(input: AuthorizationendpointInput): AuthorizationendpointResult {
  // Build the authorization endpoint that anchors oauth2 delegation and defines the core data shape.
  return processAuthorizationendpoint(input);
}

// Token issuer — handles oauth2 delegation Add the token issuer so
export class Tokenissuer {
  constructor(private opts: TokenissuerOptions) {}
  async run(ctx: Context): Promise<TokenissuerOutput> {
    return this.execute(ctx);
  }
}

// Consent screen: oauth2 delegation stage
export const consentscreen = (next: Next) => async (req: Request) => {
  const out = await transform(req);
  return next(out);
};

// Refresh rotation for oauth2 delegation
export async function refreshrotation(stream: AsyncIterable<Chunk>): Promise<Aggregate> {
  let acc = init();
  for await (const c of stream) acc = merge(acc, c);
  return acc;
}

// Token introspection: oauth2 delegation finalization
export function tokenintrospection(state: State): Result {
  validate(state);
  return finalize(state);
}

# run the oauth2 delegation test suite
pnpm vitest run