@lastshotlabs/slingshot-m2m

npm install @lastshotlabs/slingshot-m2m

Functions

createM2MClient

Look up an M2M client by clientId. Only active clients are returned.

async function createM2MClient(opts: { clientId: string; name: string; scopes?: string[]; adapter: AuthAdapter; password: RuntimePassword; }): Promise<

Source: packages/slingshot-m2m/src/lib/m2m.ts

createM2MPlugin

Creates the Slingshot M2M (machine-to-machine) plugin.

Mounts an OAuth 2.0 POST /oauth/token endpoint that issues short-lived JWTs via the client_credentials grant. Requires slingshot-auth to be registered as a dependency and auth.m2m to be set in the auth plugin config.

Remarks: Use requireScope() middleware to protect routes that should only be accessible with specific OAuth scopes granted to M2M clients.

function createM2MPlugin(): SlingshotPlugin

Source: packages/slingshot-m2m/src/plugin.ts

createM2MRouter

Rate-limit options for POST /oauth/token. 30 requests per minute per client IP.

function createM2MRouter(runtime: AuthRuntimeContext): void

Source: packages/slingshot-m2m/src/routes/m2m.ts

deleteM2MClient

Look up an M2M client by clientId. Only active clients are returned.

async function deleteM2MClient(adapter: AuthAdapter, clientId: string): Promise<void>

Source: packages/slingshot-m2m/src/lib/m2m.ts

getM2MClient

Look up an M2M client by clientId. Only active clients are returned.

async function getM2MClient(adapter: AuthAdapter, clientId: string,): Promise<(M2MClientRecord &

Source: packages/slingshot-m2m/src/lib/m2m.ts

listM2MClients

Look up an M2M client by clientId. Only active clients are returned.

async function listM2MClients(adapter: AuthAdapter): Promise<M2MClientRecord[]>

Source: packages/slingshot-m2m/src/lib/m2m.ts

requireScope

Hono middleware factory that enforces OAuth 2.0 scope requirements on a route.

Only machine-to-machine access tokens are eligible: the actor must have kind: 'service-account' as resolved by the identify middleware from slingshot-auth. The middleware then reads the scope claim from tokenPayload. All requiredScopes must be present in the space-delimited scope string; if any is missing the request is rejected.

Remarks: The scope claim is parsed as a space-delimited string per OAuth 2.0 RFC 6749 §3.3. Each token in the space-separated list is treated as a distinct granted scope. The token must contain all of the requiredScopes — partial matches are rejected. For example, a token with scope: "read:invoices write:invoices" satisfies requireScope('read:invoices', 'write:invoices') but not requireScope('admin').

function requireScope(...requiredScopes: string[]): MiddlewareHandler<AppEnv>

Source: packages/slingshot-m2m/src/middleware/requireScope.ts

Interfaces

M2MClientRecord

Normalised identity profile sourced from an OAuth provider.

Populated by OAuthAdapter.findOrCreateByProvider() when a user authenticates via an external provider. All fields are optional — each provider exposes different claim sets.

Source: packages/slingshot-core/src/auth-adapter.ts