feat: add OAuth service with PKCE, token management, and tests

Implements client registration, authorization code flow with PKCE (S256),
access/refresh token generation/verification, and cleanup utilities.
Follows TDD — all 12 service-level tests pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/server/services/oauth.service.ts

@@ -0,0 +1,159 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { and, eq, lt } from "drizzle-orm";
+import { db as prodDb } from "../../db/index.ts";
+import { oauthClients, oauthCodes, oauthTokens } from "../../db/schema.ts";
+
+type Db = typeof prodDb;
+
+// ── Client Registration ──────────────────────────────────────────────
+
+export function registerClient(
+	db: Db = prodDb,
+	clientName: string,
+	redirectUris: string[],
+): { clientId: string } {
+	const clientId = randomUUID();
+	const redirectUrisJson = JSON.stringify(redirectUris);
+
+	db.insert(oauthClients)
+		.values({ clientId, clientName, redirectUris: redirectUrisJson })
+		.run();
+
+	return { clientId };
+}
+
+export function getClient(db: Db = prodDb, clientId: string) {
+	return (
+		db
+			.select()
+			.from(oauthClients)
+			.where(eq(oauthClients.clientId, clientId))
+			.get() ?? null
+	);
+}
+
+// ── Authorization Code ───────────────────────────────────────────────
+
+export function createAuthorizationCode(
+	db: Db = prodDb,
+	clientId: string,
+	codeChallenge: string,
+	codeChallengeMethod: string,
+	redirectUri: string,
+): { code: string } {
+	const code = randomBytes(32).toString("hex");
+	const expiresAt = new Date(Date.now() + 10 * 60 * 1000); // 10 minutes
+
+	db.insert(oauthCodes)
+		.values({ code, clientId, codeChallenge, codeChallengeMethod, redirectUri, expiresAt })
+		.run();
+
+	return { code };
+}
+
+export async function exchangeCode(
+	db: Db = prodDb,
+	code: string,
+	codeVerifier: string,
+	clientId: string,
+	redirectUri: string,
+): Promise<{ accessToken: string; refreshToken: string; expiresIn: number } | null> {
+	const record = db
+		.select()
+		.from(oauthCodes)
+		.where(eq(oauthCodes.code, code))
+		.get();
+
+	if (!record) return null;
+	if (record.used !== 0) return null;
+	if (record.clientId !== clientId) return null;
+	if (record.redirectUri !== redirectUri) return null;
+	if (record.expiresAt < new Date()) return null;
+
+	// Verify PKCE: SHA-256(verifier) encoded as base64url must match stored challenge
+	const computedChallenge = createHash("sha256")
+		.update(codeVerifier)
+		.digest("base64url");
+
+	if (computedChallenge !== record.codeChallenge) return null;
+
+	// Mark code as used
+	db.update(oauthCodes).set({ used: 1 }).where(eq(oauthCodes.code, code)).run();
+
+	return generateTokens(db, clientId);
+}
+
+// ── Token Management ─────────────────────────────────────────────────
+
+function generateTokens(
+	db: Db,
+	clientId: string,
+): { accessToken: string; refreshToken: string; expiresIn: number } {
+	const accessToken = randomBytes(32).toString("hex");
+	const refreshToken = randomBytes(32).toString("hex");
+
+	const accessTokenHash = createHash("sha256").update(accessToken).digest("hex");
+	const refreshTokenHash = createHash("sha256").update(refreshToken).digest("hex");
+
+	const expiresAt = new Date(Date.now() + 3600 * 1000); // 1 hour
+	const refreshExpiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000); // 30 days
+
+	db.insert(oauthTokens)
+		.values({ accessTokenHash, refreshTokenHash, clientId, expiresAt, refreshExpiresAt })
+		.run();
+
+	return { accessToken, refreshToken, expiresIn: 3600 };
+}
+
+export async function verifyAccessToken(
+	db: Db = prodDb,
+	token: string,
+): Promise<boolean> {
+	const tokenHash = createHash("sha256").update(token).digest("hex");
+
+	const record = db
+		.select()
+		.from(oauthTokens)
+		.where(eq(oauthTokens.accessTokenHash, tokenHash))
+		.get();
+
+	if (!record) return false;
+	if (record.expiresAt < new Date()) return false;
+
+	return true;
+}
+
+export async function refreshAccessToken(
+	db: Db = prodDb,
+	refreshToken: string,
+	clientId: string,
+): Promise<{ accessToken: string; refreshToken: string; expiresIn: number } | null> {
+	const tokenHash = createHash("sha256").update(refreshToken).digest("hex");
+
+	const record = db
+		.select()
+		.from(oauthTokens)
+		.where(
+			and(
+				eq(oauthTokens.refreshTokenHash, tokenHash),
+				eq(oauthTokens.clientId, clientId),
+			),
+		)
+		.get();
+
+	if (!record) return null;
+	if (record.refreshExpiresAt < new Date()) return null;
+
+	// Delete old token pair
+	db.delete(oauthTokens).where(eq(oauthTokens.id, record.id)).run();
+
+	return generateTokens(db, clientId);
+}
+
+// ── Cleanup ──────────────────────────────────────────────────────────
+
+export function cleanExpiredOAuthData(db: Db = prodDb): void {
+	const now = new Date();
+	db.delete(oauthCodes).where(lt(oauthCodes.expiresAt, now)).run();
+	db.delete(oauthTokens).where(lt(oauthTokens.expiresAt, now)).run();
+}