Build a Secure Internal Token Issuance Service

Problem/Feature Description

A platform team is building a lightweight OAuth authorization server component in Fastify that will issue short-lived access tokens to internal microservices using the client credentials flow. The service will expose a /token endpoint that microservices can call to obtain JWTs for service-to-service communication.

During a threat model review, the security team flagged two concerns: the token endpoint must be protected from brute-force and credential-stuffing attacks, and all communication must use TLS — the service should refuse to issue tokens if the request came in over plain HTTP. The service will only be deployed behind an HTTPS load balancer, but the code itself should enforce these constraints.

Output Specification

Produce a TypeScript Fastify application with the following files:

• package.json — listing all required dependencies
• plugins/oauth.ts — OAuth client credentials plugin setup
• routes/token.ts — the /token endpoint implementation
• middleware/security.ts — any rate limiting or HTTPS enforcement logic

Read server credentials from environment variables: CLIENT_ID, CLIENT_SECRET, AUTH_SERVER.

No need to start a server or connect to a live identity provider. Produce only the source files.