@_mustachio/openauth 0.10.0 → 0.11.0

package/dist/esm/adapters/memory/session-store.js

@@ -7,6 +7,7 @@ class MemorySessionStore {
   #clock;
   #flows = new Map;
   #sessions = new Map;
+  #par = new Map;
   constructor(opts = {}) {
     this.#clock = opts.clock ?? realClock;
   }
@@ -76,6 +77,27 @@ class MemorySessionStore {
     this.#sessions.delete(sessionId);
     return ok(undefined);
   }
+  async savePar(requestUri, payload, ttl) {
+    if (ttl <= 0) {
+      return err(authError.internalError(`savePar: ttl must be positive, got ${ttl}`));
+    }
+    this.#par.set(requestUri, {
+      record: payload,
+      expiresAt: this.#clock() + ttl
+    });
+    return ok(undefined);
+  }
+  async consumePar(requestUri) {
+    const stored = this.#par.get(requestUri);
+    if (!stored) {
+      return err(authError.unknownState(`par "${requestUri}" unknown or already consumed`));
+    }
+    this.#par.delete(requestUri);
+    if (this.#clock() >= stored.expiresAt) {
+      return err(authError.unknownState(`par "${requestUri}" expired`));
+    }
+    return ok(stored.record);
+  }
 }
 export {
   MemorySessionStore

package/dist/esm/adapters/memory/token-store.js

@@ -8,6 +8,7 @@ class MemoryTokenStore {
   #clock;
   #codes = new Map;
   #refresh = new Map;
+  #dpopJtis = new Map;
   constructor(opts = {}) {
     this.#clock = opts.clock ?? realClock;
   }
@@ -85,6 +86,18 @@ class MemoryTokenStore {
     }
     return ok(undefined);
   }
+  async recordDpopJti(jti, ttlMs) {
+    const now = this.#clock();
+    for (const [k, exp] of this.#dpopJtis) {
+      if (exp <= now)
+        this.#dpopJtis.delete(k);
+    }
+    if (this.#dpopJtis.has(jti)) {
+      return err(authError.invalidGrant(`dpop jti "${jti}" replayed`));
+    }
+    this.#dpopJtis.set(jti, now + ttlMs);
+    return ok(undefined);
+  }
 }
 export {
   MemoryTokenStore

package/dist/esm/client.js

@@ -49,6 +49,11 @@ function createClient(input) {
       result2.searchParams.set("state", challenge.state);
       if (opts?.provider)
         result2.searchParams.set("provider", opts.provider);
+      if (opts?.scope !== undefined) {
+        const scope = Array.isArray(opts.scope) ? opts.scope.join(" ") : opts.scope;
+        if (scope)
+          result2.searchParams.set("scope", scope);
+      }
       if (opts?.pkce && response === "code") {
         const pkce = await generatePKCE();
         result2.searchParams.set("code_challenge_method", "S256");
@@ -97,7 +102,8 @@ function createClient(input) {
         tokens: {
           access: json.access_token,
           refresh: json.refresh_token,
-          expiresIn: json.expires_in
+          expiresIn: json.expires_in,
+          ...typeof json.id_token === "string" ? { idToken: json.id_token } : {}
         }
       };
     },
@@ -136,7 +142,8 @@ function createClient(input) {
         tokens: {
           access: json.access_token,
           refresh: json.refresh_token,
-          expiresIn: json.expires_in
+          expiresIn: json.expires_in,
+          ...typeof json.id_token === "string" ? { idToken: json.id_token } : {}
         }
       };
     },

package/dist/esm/domain/authorize.js

@@ -73,6 +73,8 @@ async function startAuthorize(input, deps) {
     prompt: req.prompt,
     uiLocales: req.uiLocales,
     nonce,
+    ...req.nonce !== undefined ? { appNonce: req.nonce } : {},
+    ...req.claimsRequest !== undefined ? { claimsRequest: req.claimsRequest } : {},
     clientPkce: req.codeChallenge ? { challenge: req.codeChallenge, method: "S256" } : undefined,
     methodState: null,
     context: tenant.request.custom,
@@ -194,6 +196,9 @@ async function issueCodeFromInlineSuccess(result, record, deps) {
     context: flow.context ?? null,
     providerSubject: result.providerSubject,
     properties: result.properties,
+    ...flow.appNonce !== undefined ? { appNonce: flow.appNonce } : {},
+    ...flow.claimsRequest !== undefined ? { claimsRequest: flow.claimsRequest } : {},
+    authTime: Math.floor(now / 1000),
     expiresAt: now + AUTH_CODE_TTL_MS
   }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
   if (isErr(saved))

package/dist/esm/domain/callback.js

@@ -117,6 +117,9 @@ async function translate(result, flow, deps) {
         context: flow.context ?? null,
         providerSubject: result.providerSubject,
         properties: result.properties,
+        ...flow.appNonce !== undefined ? { appNonce: flow.appNonce } : {},
+        ...flow.claimsRequest !== undefined ? { claimsRequest: flow.claimsRequest } : {},
+        authTime: Math.floor(now / 1000),
         expiresAt: now + AUTH_CODE_TTL_MS
       }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
       if (isErr(saved))

package/dist/esm/domain/discovery.js

@@ -4,6 +4,12 @@ import { buildJwksDocument } from "./jwt";
 function buildDiscoveryDocument(deps) {
   const base = deps.issuerUrl.replace(/\/+$/, "");
   const p = deps.paths ?? {};
+  const customScopeKeys = Object.keys(deps.customScopeClaims ?? {});
+  const customClaimNames = new Set;
+  for (const list of Object.values(deps.customScopeClaims ?? {})) {
+    for (const name of list)
+      customClaimNames.add(name);
+  }
   return {
     issuer: deps.issuerUrl,
     authorization_endpoint: `${base}${p.authorize ?? "/authorize"}`,
@@ -12,15 +18,51 @@ function buildDiscoveryDocument(deps) {
     jwks_uri: `${base}${p.jwks ?? "/.well-known/jwks.json"}`,
     revocation_endpoint: `${base}${p.revoke ?? "/revoke"}`,
     introspection_endpoint: `${base}${p.introspect ?? "/introspect"}`,
+    end_session_endpoint: `${base}${p.endSession ?? "/end_session"}`,
+    registration_endpoint: `${base}${p.register ?? "/register"}`,
+    pushed_authorization_request_endpoint: `${base}${p.par ?? "/par"}`,
+    require_pushed_authorization_requests: false,
+    dpop_signing_alg_values_supported: ["ES256", "EdDSA"],
     response_types_supported: ["code"],
     grant_types_supported: [
       "authorization_code",
       "refresh_token",
       "client_credentials"
     ],
-    subject_types_supported: ["public"],
+    subject_types_supported: ["public", "pairwise"],
     id_token_signing_alg_values_supported: ["ES256", "EdDSA"],
-    scopes_supported: deps.scopes ?? ["openid", "email", "profile"],
+    scopes_supported: [
+      ...deps.scopes ?? ["openid", "email", "profile"],
+      ...customScopeKeys
+    ],
+    claims_supported: [
+      "sub",
+      "iss",
+      "aud",
+      "exp",
+      "iat",
+      "auth_time",
+      "nonce",
+      "amr",
+      "at_hash",
+      "email",
+      "email_verified",
+      "name",
+      "given_name",
+      "family_name",
+      "preferred_username",
+      "picture",
+      "locale",
+      "phone_number",
+      "phone_number_verified",
+      "address",
+      ...customClaimNames
+    ],
+    claims_parameter_supported: true,
+    request_parameter_supported: false,
+    request_uri_parameter_supported: false,
+    require_request_uri_registration: false,
+    ui_locales_supported: deps.uiLocales ?? ["en"],
     token_endpoint_auth_methods_supported: [
       "client_secret_basic",
       "client_secret_post",

package/dist/esm/domain/dpop.js

@@ -0,0 +1,122 @@
+// src/domain/dpop.ts
+import {
+  calculateJwkThumbprint,
+  decodeProtectedHeader,
+  importJWK,
+  jwtVerify
+} from "jose";
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { base64url, sha256, utf8 } from "./crypto";
+var DPOP_ASYMMETRIC_ALGS = new Set(["ES256", "EdDSA"]);
+var DEFAULT_DPOP_IAT_TOLERANCE_SEC = 60;
+var DEFAULT_DPOP_JTI_TTL_MS = 2 * DEFAULT_DPOP_IAT_TOLERANCE_SEC * 1000;
+async function verifyDpopProof(input, deps) {
+  if (!deps.tokenStore.recordDpopJti) {
+    return err(authError.invalidDpopProof("token-store adapter does not support DPoP replay protection"));
+  }
+  let header;
+  try {
+    header = decodeProtectedHeader(input.proofJwt);
+  } catch (e) {
+    return err(authError.invalidDpopProof(`dpop proof header is not a valid compact JWS: ${stringifyError(e)}`));
+  }
+  if (header.typ !== "dpop+jwt") {
+    return err(authError.invalidDpopProof(`dpop proof header.typ must be "dpop+jwt", got "${String(header.typ)}"`));
+  }
+  if (!header.alg || !DPOP_ASYMMETRIC_ALGS.has(header.alg)) {
+    return err(authError.invalidDpopProof(`dpop proof alg "${String(header.alg)}" not in {ES256, EdDSA}`));
+  }
+  const jwk = header.jwk;
+  if (!jwk || typeof jwk !== "object") {
+    return err(authError.invalidDpopProof("dpop proof header.jwk missing or not an object"));
+  }
+  if ("d" in jwk) {
+    return err(authError.invalidDpopProof("dpop proof header.jwk must be a public key (private material present)"));
+  }
+  let key;
+  try {
+    key = await importJWK(jwk, header.alg);
+  } catch (e) {
+    return err(authError.invalidDpopProof(`dpop proof JWK import failed: ${stringifyError(e)}`));
+  }
+  let verified;
+  try {
+    verified = await jwtVerify(input.proofJwt, key, {
+      algorithms: [header.alg]
+    });
+  } catch (e) {
+    return err(authError.invalidDpopProof(`dpop proof signature verification failed: ${stringifyError(e)}`));
+  }
+  const payload = verified.payload;
+  if (typeof payload.htm !== "string") {
+    return err(authError.invalidDpopProof("dpop proof missing string htm"));
+  }
+  if (typeof payload.htu !== "string") {
+    return err(authError.invalidDpopProof("dpop proof missing string htu"));
+  }
+  if (typeof payload.iat !== "number") {
+    return err(authError.invalidDpopProof("dpop proof missing numeric iat"));
+  }
+  if (typeof payload.jti !== "string" || payload.jti.length === 0) {
+    return err(authError.invalidDpopProof("dpop proof missing non-empty string jti"));
+  }
+  if (payload.htm !== input.htm) {
+    return err(authError.invalidDpopProof(`dpop htm "${payload.htm}" does not match request method "${input.htm}"`));
+  }
+  if (payload.htu !== input.htu) {
+    return err(authError.invalidDpopProof(`dpop htu "${payload.htu}" does not match request uri "${input.htu}"`));
+  }
+  const tolerance = input.iatToleranceSec ?? DEFAULT_DPOP_IAT_TOLERANCE_SEC;
+  const skew = Math.abs(input.nowSec - payload.iat);
+  if (skew > tolerance) {
+    return err(authError.invalidDpopProof(`dpop iat skew ${skew}s exceeds tolerance ${tolerance}s`));
+  }
+  if (input.expectedAth !== undefined) {
+    if (typeof payload.ath !== "string" || payload.ath !== input.expectedAth) {
+      return err(authError.invalidDpopProof("dpop ath does not match SHA-256 of the access token"));
+    }
+  }
+  const recorded = await deps.tokenStore.recordDpopJti(payload.jti, deps.jtiTtlMs ?? DEFAULT_DPOP_JTI_TTL_MS);
+  if (isErr(recorded)) {
+    return err(authError.invalidDpopProof(`dpop jti "${payload.jti}" replayed`, {
+      jti: payload.jti
+    }));
+  }
+  let jkt;
+  try {
+    jkt = await calculateJwkThumbprint(jwk, "sha256");
+  } catch (e) {
+    return err(authError.invalidDpopProof(`dpop jkt thumbprint computation failed: ${stringifyError(e)}`));
+  }
+  return ok({
+    jkt,
+    payload: {
+      htm: payload.htm,
+      htu: payload.htu,
+      iat: payload.iat,
+      jti: payload.jti,
+      ...payload.ath !== undefined ? { ath: payload.ath } : {},
+      ...payload.nonce !== undefined ? { nonce: payload.nonce } : {}
+    }
+  });
+}
+function canonicalHtu(rawUrl) {
+  const u = new URL(rawUrl);
+  u.search = "";
+  u.hash = "";
+  return u.toString();
+}
+async function computeAth(accessToken) {
+  return base64url.encode(await sha256(utf8.encode(accessToken)));
+}
+function stringifyError(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+export {
+  verifyDpopProof,
+  computeAth,
+  canonicalHtu,
+  DEFAULT_DPOP_JTI_TTL_MS,
+  DEFAULT_DPOP_IAT_TOLERANCE_SEC
+};

package/dist/esm/domain/id-token.js

@@ -0,0 +1,94 @@
+// src/domain/id-token.ts
+import { base64url, sha256, utf8 } from "./crypto";
+var SCOPE_TO_CLAIMS = {
+  profile: [
+    "name",
+    "given_name",
+    "family_name",
+    "middle_name",
+    "nickname",
+    "preferred_username",
+    "profile",
+    "picture",
+    "website",
+    "gender",
+    "birthdate",
+    "zoneinfo",
+    "locale",
+    "updated_at"
+  ],
+  email: ["email", "email_verified"],
+  phone: ["phone_number", "phone_number_verified"],
+  address: ["address"]
+};
+function deriveAmr(methodKind) {
+  switch (methodKind) {
+    case "password":
+      return ["pwd"];
+    case "code":
+      return ["otp"];
+    case "passkey":
+      return ["hwk"];
+    default:
+      return;
+  }
+}
+async function computeAtHash(accessToken) {
+  const digest = await sha256(utf8.encode(accessToken));
+  const half = digest.slice(0, digest.byteLength / 2);
+  return base64url.encode(half);
+}
+function pickScopedClaims(claim, scopes, extra = [], customMappings = {}) {
+  const props = claim.properties;
+  if (!props || typeof props !== "object")
+    return {};
+  const mappings = {
+    ...customMappings,
+    ...SCOPE_TO_CLAIMS
+  };
+  const granted = new Set;
+  for (const scope of scopes) {
+    const list = mappings[scope];
+    if (!list)
+      continue;
+    for (const c of list)
+      granted.add(c);
+  }
+  for (const name of extra)
+    granted.add(name);
+  const out = {};
+  for (const key of granted) {
+    if (key in props && props[key] !== undefined)
+      out[key] = props[key];
+  }
+  return out;
+}
+var DEFAULT_ID_TOKEN_TTL_MS = 5 * 60 * 1000;
+async function buildIdTokenClaims(input) {
+  const ttl = input.ttlMs ?? DEFAULT_ID_TOKEN_TTL_MS;
+  const amr = deriveAmr(input.methodKind);
+  const extraClaims = Object.keys(input.claimsRequest?.id_token ?? {});
+  return {
+    iss: input.issuerUrl,
+    sub: input.subjectId,
+    aud: input.audience,
+    exp: Math.floor((input.now + ttl) / 1000),
+    iat: Math.floor(input.now / 1000),
+    auth_time: input.authTime,
+    at_hash: await computeAtHash(input.accessToken),
+    ...input.appNonce !== undefined ? { nonce: input.appNonce } : {},
+    ...amr ? { amr } : {},
+    ...pickScopedClaims(input.claim, input.scopes, extraClaims, input.customScopeClaims ?? {})
+  };
+}
+function shouldIssueIdToken(scopes) {
+  return scopes.includes("openid");
+}
+export {
+  shouldIssueIdToken,
+  pickScopedClaims,
+  deriveAmr,
+  computeAtHash,
+  buildIdTokenClaims,
+  DEFAULT_ID_TOKEN_TTL_MS
+};

package/dist/esm/domain/introspect.js

@@ -32,6 +32,7 @@ async function introspect(req, deps) {
   if (claims.aud !== req.clientId) {
     return ok({ active: false });
   }
+  const subjectType = claims.claim?.type;
   return ok({
     active: true,
     sub: claims.sub,
@@ -41,9 +42,12 @@ async function introspect(req, deps) {
     iat: claims.iat,
     scope: claims.scope,
     client_id: claims.aud,
+    token_type: claims.cnf?.jkt !== undefined ? "DPoP" : "Bearer",
     tid: claims.tid,
     mid: claims.mid,
-    mkind: claims.mkind
+    mkind: claims.mkind,
+    ...subjectType !== undefined ? { subject_type: subjectType } : {},
+    ...claims.cnf !== undefined ? { cnf: claims.cnf } : {}
   });
 }
 export {

package/dist/esm/domain/jwt.js

@@ -3,6 +3,32 @@ import { importJWK, jwtVerify, SignJWT } from "jose";
 async function signAccessToken(claims, privateKey, alg, kid) {
   return new SignJWT(claims).setProtectedHeader({ alg, typ: "JWT", kid }).sign(privateKey);
 }
+async function signIdToken(claims, privateKey, alg, kid) {
+  return new SignJWT(claims).setProtectedHeader({ alg, typ: "JWT", kid }).sign(privateKey);
+}
+async function verifyIdToken(token, keys, options = {}) {
+  const algorithms = Array.from(new Set(keys.map((k) => k.alg).filter((a) => ASYMMETRIC_ALGS.has(a))));
+  const { payload } = await jwtVerify(token, async (header) => {
+    if (!header.alg || header.alg === "none") {
+      throw new Error(`verifyIdToken: refusing alg "${header.alg ?? ""}"`);
+    }
+    const match = keys.find((k) => k.kid === header.kid);
+    if (!match) {
+      throw new Error(`verifyIdToken: unknown kid "${header.kid}"`);
+    }
+    if (match.alg !== header.alg) {
+      throw new Error(`verifyIdToken: header.alg "${header.alg}" does not match key alg "${match.alg}"`);
+    }
+    const imported = await importJWK(match.publicJwk, match.alg);
+    return imported;
+  }, {
+    algorithms,
+    ...options.issuer ? { issuer: options.issuer } : {},
+    ...options.audience ? { audience: options.audience } : {},
+    ...options.acceptExpired ? { clockTolerance: Number.MAX_SAFE_INTEGER } : {}
+  });
+  return payload;
+}
 var ASYMMETRIC_ALGS = new Set(["ES256", "EdDSA"]);
 async function verifyAccessToken(token, keys, options = {}) {
   const algorithms = Array.from(new Set(keys.map((k) => k.alg).filter((a) => ASYMMETRIC_ALGS.has(a))));
@@ -37,7 +63,9 @@ function buildJwksDocument(keys) {
   };
 }
 export {
+  verifyIdToken,
   verifyAccessToken,
+  signIdToken,
   signAccessToken,
   buildJwksDocument
 };

package/dist/esm/domain/logout.js

@@ -0,0 +1,75 @@
+// src/domain/logout.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { safeAudit } from "./audit";
+import { verifyIdToken } from "./jwt";
+import { revokeAllForSubject } from "./revoke";
+async function endSession(req, tenant, deps) {
+  let hintSubject;
+  let hintAud;
+  if (req.idTokenHint) {
+    const keysRes = await deps.keyStore.signingKeys();
+    if (isErr(keysRes))
+      return err(keysRes.error);
+    try {
+      const claims = await verifyIdToken(req.idTokenHint, keysRes.value, {
+        issuer: deps.issuerUrl,
+        acceptExpired: true
+      });
+      hintSubject = claims.sub;
+      hintAud = claims.aud;
+    } catch (e) {
+      const reason = e instanceof Error ? e.message : String(e);
+      return err(authError.invalidRequest(`id_token_hint failed signature/issuer verification: ${reason}`, "id_token_hint"));
+    }
+  }
+  if (req.clientId && hintAud && req.clientId !== hintAud) {
+    return err(authError.invalidRequest("client_id does not match id_token_hint.aud", "client_id"));
+  }
+  const resolvedClientId = req.clientId ?? hintAud;
+  let client;
+  if (resolvedClientId) {
+    client = tenant.config.clients.find((c) => c.id === resolvedClientId);
+    if (!client) {
+      return err(authError.invalidRequest(`unknown client "${resolvedClientId}"`, "client_id"));
+    }
+  }
+  if (req.postLogoutRedirectUri) {
+    if (!client) {
+      return err(authError.invalidRequest("post_logout_redirect_uri requires identifying the client via client_id or id_token_hint", "post_logout_redirect_uri"));
+    }
+    const registered = client.postLogoutRedirectUris ?? [];
+    if (!registered.includes(req.postLogoutRedirectUri)) {
+      return err(authError.invalidRequest("post_logout_redirect_uri is not registered for this client", "post_logout_redirect_uri"));
+    }
+  }
+  if (hintSubject) {
+    const revoked = await revokeAllForSubject(tenant.id, hintSubject, {
+      tokenStore: deps.tokenStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      clock: deps.clock
+    });
+    if (isErr(revoked))
+      return err(revoked.error);
+  }
+  await safeAudit(deps, {
+    kind: "session_logout",
+    tenantId: tenant.id,
+    ...resolvedClientId ? { clientId: resolvedClientId } : {},
+    ...hintSubject ? { subjectId: hintSubject } : {},
+    timestamp: deps.clock()
+  });
+  if (req.postLogoutRedirectUri) {
+    const url = new URL(req.postLogoutRedirectUri);
+    if (req.state !== undefined)
+      url.searchParams.set("state", req.state);
+    return ok({ kind: "redirect", url: url.toString() });
+  }
+  return ok({
+    kind: "ok",
+    ...hintSubject ? { subjectId: hintSubject } : {}
+  });
+}
+export {
+  endSession
+};

package/dist/esm/domain/method-route.js

@@ -65,6 +65,9 @@ async function translate(result, flow, deps) {
         context: final.context ?? null,
         providerSubject: result.providerSubject,
         properties: result.properties,
+        ...final.appNonce !== undefined ? { appNonce: final.appNonce } : {},
+        ...final.claimsRequest !== undefined ? { claimsRequest: final.claimsRequest } : {},
+        authTime: Math.floor(now / 1000),
         expiresAt: now + AUTH_CODE_TTL_MS
       }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
       if (isErr(saved))

package/dist/esm/domain/par.js

@@ -0,0 +1,51 @@
+// src/domain/par.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { verifyClientCredentials } from "./client-auth";
+import { randomToken } from "./crypto";
+var PAR_URI_PREFIX = "urn:ietf:params:oauth:request_uri:";
+var DEFAULT_PAR_TTL_MS = 60 * 1000;
+async function pushAuthorizationRequest(req, tenant, deps) {
+  if (!deps.sessionStore.savePar || !deps.sessionStore.consumePar) {
+    return err(authError.invalidRequest("session adapter does not implement PAR storage"));
+  }
+  const client = tenant.config.clients.find((c) => c.id === req.clientId);
+  if (!client) {
+    return err(authError.invalidClient(`unknown client "${req.clientId}"`));
+  }
+  if (client.type === "confidential") {
+    const authErr = await verifyClientCredentials(client, req.clientSecret);
+    if (authErr)
+      return err(authErr);
+  } else if (req.clientSecret !== undefined) {
+    return err(authError.invalidClient("public client must not present client_secret"));
+  }
+  if (req.params.client_id && req.params.client_id !== req.clientId) {
+    return err(authError.invalidRequest("client_id in body conflicts with authenticated client", "client_id"));
+  }
+  if ("request_uri" in req.params) {
+    return err(authError.invalidRequest("request_uri MUST NOT be present in a PAR request", "request_uri"));
+  }
+  const suffix = (deps.newRequestUriSuffix ?? randomToken)();
+  const requestUri = PAR_URI_PREFIX + suffix;
+  const ttl = deps.ttlMs ?? DEFAULT_PAR_TTL_MS;
+  const now = deps.clock();
+  const saved = await deps.sessionStore.savePar(requestUri, {
+    requestUri,
+    params: { ...req.params, client_id: req.clientId },
+    clientId: req.clientId,
+    issuedAt: now,
+    expiresAt: now + ttl
+  }, ttl);
+  if (isErr(saved))
+    return err(saved.error);
+  return ok({
+    request_uri: requestUri,
+    expires_in: Math.floor(ttl / 1000)
+  });
+}
+export {
+  pushAuthorizationRequest,
+  PAR_URI_PREFIX,
+  DEFAULT_PAR_TTL_MS
+};

package/dist/esm/domain/refresh.js

@@ -31,6 +31,14 @@ async function refreshTokens(req, deps) {
   } else if (client.type === "confidential") {
     return err(authError.invalidGrant(INVALID_REFRESH_DESC));
   }
+  if (peekedPayload.dpopJkt !== undefined) {
+    if (req.dpopJkt === undefined) {
+      return err(authError.invalidDpopProof("refresh token is DPoP-bound; request is missing a DPoP proof"));
+    }
+    if (req.dpopJkt !== peekedPayload.dpopJkt) {
+      return err(authError.invalidDpopProof("refresh token DPoP jkt does not match the original binding"));
+    }
+  }
   const consumed = await deps.tokenStore.consumeRefresh(req.refreshToken, {
     reuseWindowMs: deps.reuseWindowMs
   });
@@ -68,7 +76,10 @@ async function refreshTokens(req, deps) {
       methodId: payload.methodId,
       methodKind: payload.methodKind,
       scopes: requestedScopes,
-      audience: payload.audience
+      audience: payload.audience,
+      authTime: payload.authTime,
+      ...payload.dpopJkt !== undefined ? { dpopJkt: payload.dpopJkt } : {},
+      ...payload.claimsRequest !== undefined ? { claimsRequest: payload.claimsRequest } : {}
     },
     family: payload.family,
     deps