feat(oidc): persist hashed OIDC tokens, authorization codes, and user consent in smartdata storage

ts_interfaces/data/loint-reception.oidc.ts

@@ -11,86 +11,94 @@ export type TOidcScope = 'openid' | 'profile' | 'email' | 'organizations' | 'rol
  * Authorization code for OAuth 2.0 authorization code flow
  */
 export interface IAuthorizationCode {
-  /** The authorization code string */
-  code: string;
-  /** OAuth client ID */
-  clientId: string;
-  /** User ID who authorized */
-  userId: string;
-  /** Scopes granted */
-  scopes: TOidcScope[];
-  /** Redirect URI used in authorization request */
-  redirectUri: string;
-  /** PKCE code challenge (S256 hashed) */
-  codeChallenge?: string;
-  /** PKCE code challenge method */
-  codeChallengeMethod?: 'S256';
-  /** Nonce from authorization request (for ID token) */
-  nonce?: string;
-  /** Expiration timestamp (10 minutes from creation) */
-  expiresAt: number;
-  /** Whether the code has been used (single-use) */
-  used: boolean;
+  id: string;
+  data: {
+    /** Hashed authorization code string */
+    codeHash: string;
+    /** OAuth client ID */
+    clientId: string;
+    /** User ID who authorized */
+    userId: string;
+    /** Scopes granted */
+    scopes: TOidcScope[];
+    /** Redirect URI used in authorization request */
+    redirectUri: string;
+    /** PKCE code challenge (S256 hashed) */
+    codeChallenge?: string;
+    /** PKCE code challenge method */
+    codeChallengeMethod?: 'S256';
+    /** Nonce from authorization request (for ID token) */
+    nonce?: string;
+    /** Expiration timestamp (10 minutes from creation) */
+    expiresAt: number;
+    /** Creation timestamp */
+    issuedAt: number;
+    /** Whether the code has been used (single-use) */
+    used: boolean;
+  };
 }
 
 /**
  * OIDC Access Token (opaque or JWT)
  */
 export interface IOidcAccessToken {
-  /** Token identifier */
   id: string;
-  /** The access token string (or hash for storage) */
-  tokenHash: string;
-  /** OAuth client ID */
-  clientId: string;
-  /** User ID */
-  userId: string;
-  /** Granted scopes */
-  scopes: TOidcScope[];
-  /** Expiration timestamp */
-  expiresAt: number;
-  /** Creation timestamp */
-  issuedAt: number;
+  data: {
+    /** The access token string hash for storage */
+    tokenHash: string;
+    /** OAuth client ID */
+    clientId: string;
+    /** User ID */
+    userId: string;
+    /** Granted scopes */
+    scopes: TOidcScope[];
+    /** Expiration timestamp */
+    expiresAt: number;
+    /** Creation timestamp */
+    issuedAt: number;
+  };
 }
 
 /**
  * OIDC Refresh Token
  */
 export interface IOidcRefreshToken {
-  /** Token identifier */
   id: string;
-  /** The refresh token string (or hash for storage) */
-  tokenHash: string;
-  /** OAuth client ID */
-  clientId: string;
-  /** User ID */
-  userId: string;
-  /** Granted scopes */
-  scopes: TOidcScope[];
-  /** Expiration timestamp */
-  expiresAt: number;
-  /** Creation timestamp */
-  issuedAt: number;
-  /** Whether the token has been revoked */
-  revoked: boolean;
+  data: {
+    /** The refresh token string hash for storage */
+    tokenHash: string;
+    /** OAuth client ID */
+    clientId: string;
+    /** User ID */
+    userId: string;
+    /** Granted scopes */
+    scopes: TOidcScope[];
+    /** Expiration timestamp */
+    expiresAt: number;
+    /** Creation timestamp */
+    issuedAt: number;
+    /** Whether the token has been revoked */
+    revoked: boolean;
+  };
 }
 
 /**
  * User consent record for an OAuth client
  */
 export interface IUserConsent {
-  /** Unique identifier */
   id: string;
-  /** User who gave consent */
-  userId: string;
-  /** OAuth client ID */
-  clientId: string;
-  /** Scopes the user consented to */
-  scopes: TOidcScope[];
-  /** When consent was granted */
-  grantedAt: number;
-  /** When consent was last updated */
-  updatedAt: number;
+  data: {
+    /** User who gave consent */
+    userId: string;
+    /** OAuth client ID */
+    clientId: string;
+    /** Scopes the user consented to */
+    scopes: TOidcScope[];
+    /** When consent was granted */
+    grantedAt: number;
+    /** When consent was last updated */
+    updatedAt: number;
+  };
 }
 
 /**