@_mustachio/openauth 0.10.0 → 0.12.0

package/src/http/handlers/token.ts

@@ -17,6 +17,7 @@
  * refresh-token snapshot is authoritative.
  */
 import { clientCredentialsGrant } from "../../domain/client-credentials"
+import { canonicalHtu, verifyDpopProof } from "../../domain/dpop"
 import { exchangeCode } from "../../domain/token"
 import { exchangeToken } from "../../domain/token-exchange"
 import { refreshTokens } from "../../domain/refresh"
@@ -39,12 +40,53 @@ export function makeTokenHandler(deps: HttpDeps) {
       )
     }
 
+    // `Authorization` carries Basic client auth on /token. DPoP travels in
+    // its own `DPoP:` header (RFC 9449 §5) — never inside `Authorization`.
+    // Parsing Basic first lets a confidential client present its secret
+    // alongside a DPoP proof.
     const basic = parseBasicAuth(c.req.header("authorization") ?? null)
     if (basic) {
       body.set("client_id", basic.id)
       body.set("client_secret", basic.secret)
     }
 
+    // RFC 9449 §5.1 — verify any presented DPoP proof against this
+    // request's actual method + URI. Absent header is fine here (the
+    // grant-specific path enforces `dpopRequired`).
+    const dpopHeader = c.req.header("dpop") ?? null
+    let dpopJkt: string | undefined
+    if (dpopHeader) {
+      const dpopRes = await verifyDpopProof(
+        {
+          proofJwt: dpopHeader,
+          htu: canonicalHtu(c.req.url),
+          htm: "POST",
+          nowSec: Math.floor(deps.clock() / 1000),
+        },
+        { tokenStore: deps.tokenStore },
+      )
+      if (isErr(dpopRes)) {
+        // RFC 9449 §11.1 replay → first-class audit event so operators /
+        // SIEM can spot stolen-key probing distinct from generic proof
+        // verification failures.
+        const errVal = dpopRes.error
+        if (
+          errVal.code === "invalid_dpop_proof" &&
+          errVal.replaySignal &&
+          deps.auditLog
+        ) {
+          await deps.auditLog.log({
+            kind: "dpop_replay_detected",
+            tenantId: null,
+            jtiPrefix: errVal.replaySignal.jti.slice(0, 16),
+            timestamp: deps.clock(),
+          })
+        }
+        return tokenEndpointErrorResponse(errVal)
+      }
+      dpopJkt = dpopRes.value.jkt
+    }
+
     const parsed = tokenRequestSchema.safeParse(
       Object.fromEntries(body.entries()),
     )
@@ -77,6 +119,7 @@ export function makeTokenHandler(deps: HttpDeps) {
           ...(req.code_verifier !== undefined
             ? { codeVerifier: req.code_verifier }
             : {}),
+          ...(dpopJkt !== undefined ? { dpopJkt } : {}),
         },
         {
           configStore: deps.configStore,
@@ -89,6 +132,9 @@ export function makeTokenHandler(deps: HttpDeps) {
             : {}),
           issuerUrl: c.get("issuerUrl"),
           clock: deps.clock,
+          ...(deps.customScopeClaims !== undefined
+            ? { customScopeClaims: deps.customScopeClaims }
+            : {}),
         },
       )
       if (isErr(result)) return tokenEndpointErrorResponse(result.error)
@@ -133,6 +179,9 @@ export function makeTokenHandler(deps: HttpDeps) {
             : {}),
           issuerUrl: c.get("issuerUrl"),
           clock: deps.clock,
+          ...(deps.customScopeClaims !== undefined
+            ? { customScopeClaims: deps.customScopeClaims }
+            : {}),
         },
         tenantRes.value,
       )
@@ -150,6 +199,7 @@ export function makeTokenHandler(deps: HttpDeps) {
           ...(req.client_secret !== undefined
             ? { clientSecret: req.client_secret }
             : {}),
+          ...(dpopJkt !== undefined ? { dpopJkt } : {}),
         },
         {
           configStore: deps.configStore,
@@ -158,6 +208,9 @@ export function makeTokenHandler(deps: HttpDeps) {
           ...(deps.auditLog ? { auditLog: deps.auditLog } : {}),
           issuerUrl: c.get("issuerUrl"),
           clock: deps.clock,
+          ...(deps.customScopeClaims !== undefined
+            ? { customScopeClaims: deps.customScopeClaims }
+            : {}),
         },
       )
       if (isErr(refreshResult))
@@ -195,6 +248,9 @@ export function makeTokenHandler(deps: HttpDeps) {
           : {}),
         issuerUrl: c.get("issuerUrl"),
         clock: deps.clock,
+        ...(deps.customScopeClaims !== undefined
+          ? { customScopeClaims: deps.customScopeClaims }
+          : {}),
       },
     )
     if (isErr(exchangeResult)) {

package/src/http/handlers/userinfo.ts

@@ -1,7 +1,10 @@
 /**
  * OIDC `/userinfo` handler (OIDC Core §5.3). Accepts `GET` or `POST` per
- * the spec.
+ * the spec. Supports both `Authorization: Bearer ...` (RFC 6750) and
+ * `Authorization: DPoP ...` (RFC 9449) — the domain layer enforces the
+ * proof match against the access token's `cnf.jkt` when bound.
  */
+import { canonicalHtu } from "../../domain/dpop"
 import { userinfo } from "../../domain/userinfo"
 import { isErr } from "../../types/result"
 
@@ -9,44 +12,43 @@ import type { HttpContext, HttpDeps } from "../context"
 
 export function makeUserinfoHandler(deps: HttpDeps) {
   return async (c: HttpContext): Promise<Response> => {
-    const bearer = extractBearer(c.req.header("authorization") ?? null)
-    if (!bearer) {
-      const r = new Response(
-        JSON.stringify({
-          error: "invalid_token",
-          error_description: "missing bearer token",
-        }),
-        {
-          status: 401,
-          headers: {
-            "content-type": "application/json",
-            "www-authenticate": 'Bearer realm="userinfo"',
-          },
-        },
+    const auth = extractAuthorization(c.req.header("authorization") ?? null)
+    if (!auth) {
+      return wwwAuthenticateResponse(
+        "Bearer",
+        "invalid_token",
+        "missing bearer / DPoP token",
+        401,
       )
-      return r
     }
 
-    const res = await userinfo(bearer, {
-      keyStore: deps.keyStore,
-      issuerUrl: c.get("issuerUrl"),
-    })
+    const dpopProof = c.req.header("dpop") ?? undefined
+    const res = await userinfo(
+      {
+        accessToken: auth.token,
+        scheme: auth.scheme,
+        ...(dpopProof !== undefined ? { dpopProof } : {}),
+        htu: canonicalHtu(c.req.url),
+        htm: c.req.method.toUpperCase(),
+        nowSec: Math.floor(deps.clock() / 1000),
+      },
+      {
+        keyStore: deps.keyStore,
+        tokenStore: deps.tokenStore,
+        issuerUrl: c.get("issuerUrl"),
+        ...(deps.customScopeClaims !== undefined
+          ? { customScopeClaims: deps.customScopeClaims }
+          : {}),
+      },
+    )
     if (isErr(res)) {
-      // OIDC userinfo returns 401 on invalid token (vs. 400 elsewhere).
-      const err = res.error
-      return new Response(
-        JSON.stringify({
-          error: "invalid_token",
-          error_description: err.description,
-        }),
-        {
-          status: 401,
-          headers: {
-            "content-type": "application/json",
-            "www-authenticate": `Bearer error="invalid_token"`,
-          },
-        },
-      )
+      const error = res.error
+      const scheme = auth.scheme
+      const wireError =
+        error.code === "invalid_dpop_proof"
+          ? "invalid_dpop_proof"
+          : "invalid_token"
+      return wwwAuthenticateResponse(scheme, wireError, error.description, 401)
     }
 
     return new Response(JSON.stringify(res.value), {
@@ -59,8 +61,30 @@ export function makeUserinfoHandler(deps: HttpDeps) {
   }
 }
 
-function extractBearer(header: string | null): string | null {
+function extractAuthorization(
+  header: string | null,
+): { scheme: "Bearer" | "DPoP"; token: string } | null {
   if (!header) return null
-  const m = /^Bearer\s+(.+)$/i.exec(header)
-  return m?.[1] ?? null
+  const m = /^(Bearer|DPoP)\s+(.+)$/i.exec(header)
+  if (!m || !m[1] || !m[2]) return null
+  const scheme = m[1].toLowerCase() === "dpop" ? "DPoP" : "Bearer"
+  return { scheme, token: m[2] }
+}
+
+function wwwAuthenticateResponse(
+  scheme: "Bearer" | "DPoP",
+  error: string,
+  description: string,
+  status: number,
+): Response {
+  return new Response(
+    JSON.stringify({ error, error_description: description }),
+    {
+      status,
+      headers: {
+        "content-type": "application/json",
+        "www-authenticate": `${scheme} error="${error}"`,
+      },
+    },
+  )
 }

package/src/http/router.ts

@@ -19,8 +19,11 @@ import { Hono } from "hono"
 
 import { makeAuthorizeHandler } from "./handlers/authorize"
 import { makeCallbackHandler } from "./handlers/callback"
+import { makeEndSessionHandler } from "./handlers/end-session"
 import { makeDiscoveryHandler, makeJwksHandler } from "./handlers/metadata"
 import { makeMethodRouteHandler } from "./handlers/method-route"
+import { makeParHandler } from "./handlers/par"
+import { makeRegisterHandler } from "./handlers/register"
 import { makeIntrospectHandler, makeRevokeHandler } from "./handlers/revocation"
 import { makeTokenHandler } from "./handlers/token"
 import { makeUserinfoHandler } from "./handlers/userinfo"
@@ -62,5 +65,21 @@ export function buildRouter(deps: HttpDeps): Hono<HttpEnv> {
   app.post("/revoke", makeRevokeHandler(deps))
   app.post("/introspect", makeIntrospectHandler(deps))
 
+  // OIDC RP-Initiated Logout 1.0. Tenant resolved via the standard
+  // middleware — same partitioning rules as `/authorize`.
+  app.use("/end_session", tenantMiddleware(deps))
+  app.get("/end_session", makeEndSessionHandler(deps))
+  app.post("/end_session", makeEndSessionHandler(deps))
+
+  // RFC 9126 Pushed Authorization Requests.
+  app.use("/par", tenantMiddleware(deps))
+  app.post("/par", makeParHandler(deps))
+
+  // RFC 7591 Dynamic Client Registration. Tenant resolution uses the
+  // standard middleware — partitioned hosts may carve out per-tenant
+  // registration endpoints transparently.
+  app.use("/register", tenantMiddleware(deps))
+  app.post("/register", makeRegisterHandler(deps))
+
   return app
 }

package/src/http/schemas/authorize.ts

@@ -32,6 +32,12 @@ const scopeParam = z
   )
   .pipe(z.array(z.string().regex(SCOPE_TOKEN, "invalid scope token")))
 
+/**
+ * Standard `/authorize` query schema. Used both for direct calls and as
+ * the validation target after a PAR record is rehydrated — the PAR'd
+ * params are passed through this same parser so semantic checks stay in
+ * a single place.
+ */
 export const authorizeQuerySchema = z
   .object({
     response_type: z.string({
@@ -52,6 +58,27 @@ export const authorizeQuerySchema = z
     prompt: csv.optional(),
     ui_locales: csv.optional(),
     nonce: z.string().optional(),
+    /**
+     * OIDC Core §5.5 — JSON-encoded claims request. Parsing + structural
+     * validation happens in the domain layer; here we just accept any
+     * non-empty string and let the handler parse + reject malformed.
+     */
+    claims: z.string().min(1).optional(),
+  })
+  .passthrough()
+
+/**
+ * RFC 9126 §4: when `request_uri` is presented, the user-agent's
+ * `/authorize` URL is allowed to carry only `client_id` and
+ * `request_uri`; the rest of the parameter set must come from the
+ * stored PAR record.
+ */
+export const authorizeRequestUriQuerySchema = z
+  .object({
+    client_id: z
+      .string({ required_error: "missing client_id" })
+      .min(1, "empty client_id"),
+    request_uri: z.string({ required_error: "missing request_uri" }).min(1),
   })
   .passthrough()
 

package/src/http/schemas/end-session.ts

@@ -0,0 +1,23 @@
+/**
+ * Zod schema for `/end_session` (OIDC RP-Initiated Logout 1.0 §2).
+ *
+ * Every parameter is optional per spec. The domain layer enforces the
+ * "needs identifying client to honor post_logout_redirect_uri" rule.
+ */
+import { z } from "zod"
+
+export const endSessionParamsSchema = z
+  .object({
+    id_token_hint: z.string().optional(),
+    client_id: z.string().min(1).optional(),
+    post_logout_redirect_uri: z
+      .string()
+      .url("post_logout_redirect_uri must be a valid URL")
+      .optional(),
+    state: z.string().optional(),
+    logout_hint: z.string().optional(),
+    ui_locales: z.string().optional(),
+  })
+  .passthrough()
+
+export type EndSessionParams = z.infer<typeof endSessionParamsSchema>

package/src/http/schemas/par.ts

@@ -0,0 +1,23 @@
+/**
+ * Zod schema for the `POST /par` body (RFC 9126 §2).
+ *
+ * The shape is identical to `/authorize` query parameters; we just need
+ * `client_id` to identify the authenticating client. `client_secret` is
+ * accepted in-body for `client_secret_post` auth.
+ */
+import { z } from "zod"
+
+export const parBodySchema = z
+  .object({
+    client_id: z
+      .string({ required_error: "missing client_id" })
+      .min(1, "empty client_id"),
+    client_secret: z.string().optional(),
+  })
+  // `.catchall(z.string())` validates AND types passthrough keys as
+  // strings — `application/x-www-form-urlencoded` values are always
+  // strings at the wire level, so this also rejects malformed bodies
+  // where a key somehow carries a non-string value.
+  .catchall(z.string())
+
+export type ParBody = z.infer<typeof parBodySchema>

package/src/http/schemas/register.ts

@@ -0,0 +1,29 @@
+/**
+ * Zod schema for `POST /register` (RFC 7591 §2).
+ *
+ * The body is `application/json`. We surface invalid structure as
+ * `invalid_request` rather than the spec's `invalid_client_metadata` /
+ * `invalid_redirect_uri` codes — the library collapses all wire-format
+ * problems to the OAuth-2.0 `invalid_request` family for consistency.
+ */
+import { z } from "zod"
+
+export const registerBodySchema = z
+  .object({
+    client_name: z.string().min(1).optional(),
+    redirect_uris: z
+      .array(z.string().url("redirect_uri must be a valid URL"))
+      .min(1, "redirect_uris must be a non-empty array"),
+    grant_types: z.array(z.string()).optional(),
+    response_types: z.array(z.string()).optional(),
+    token_endpoint_auth_method: z
+      .enum(["none", "client_secret_basic", "client_secret_post"])
+      .optional(),
+    scope: z.string().optional(),
+    post_logout_redirect_uris: z.array(z.string().url()).optional(),
+    sector_identifier_uri: z.string().url().optional(),
+    contacts: z.array(z.string()).optional(),
+  })
+  .passthrough()
+
+export type RegisterBody = z.infer<typeof registerBodySchema>

package/src/index.ts

@@ -57,8 +57,11 @@ export type {
 
 export type {
   AccessTokenClaims,
+  AddressClaim,
   CodePayload,
+  IdTokenClaims,
   RefreshTokenPayload,
+  ScopedProfileClaims,
   TokenResponse,
 } from "./types/token"
 
@@ -73,7 +76,12 @@ export type {
   FailureEvent,
   IdP,
   IdPOptions,
+  LogoutEventInput,
+  LogoutHookResult,
   PersistUpstreamTokens,
+  RegisterClient,
+  RegisterClientRequest,
+  RegisterClientResponse,
   RenderPicker,
   SuccessEvent,
   SuccessMapInput,
@@ -90,7 +98,11 @@ export type {
   SigningKey,
 } from "./ports/key-store"
 export type { MethodStore } from "./ports/method-store"
-export type { SessionRecord, SessionStore } from "./ports/session-store"
+export type {
+  ParRecord,
+  SessionRecord,
+  SessionStore,
+} from "./ports/session-store"
 export type { TokenStore } from "./ports/token-store"
 
 /**
@@ -236,6 +248,7 @@ export function createIdP(opts: IdPOptions): IdP {
     ...(opts.callbackHostFor ? { callbackHostFor: opts.callbackHostFor } : {}),
     resolveTenant: opts.resolveTenant,
     success: opts.success,
+    ...(opts.onLogout ? { onLogout: opts.onLogout } : {}),
     ...(opts.persistUpstreamTokens
       ? { persistUpstreamTokens: opts.persistUpstreamTokens }
       : {}),
@@ -243,6 +256,7 @@ export function createIdP(opts: IdPOptions): IdP {
       ? { exchangeAudience: opts.exchangeAudience }
       : {}),
     ...(opts.renderPicker ? { renderPicker: opts.renderPicker } : {}),
+    ...(opts.registerClient ? { registerClient: opts.registerClient } : {}),
     ...(opts.buildCustomContext
       ? { buildCustomContext: opts.buildCustomContext }
       : {}),
@@ -254,6 +268,9 @@ export function createIdP(opts: IdPOptions): IdP {
         : {}),
       ...(opts.cookies?.path !== undefined ? { path: opts.cookies.path } : {}),
     },
+    ...(opts.customScopeClaims !== undefined
+      ? { customScopeClaims: opts.customScopeClaims }
+      : {}),
   }
 
   const app = buildRouter(deps)
@@ -268,5 +285,8 @@ export function createIdP(opts: IdPOptions): IdP {
     discovery: fetch,
     revoke: fetch,
     introspect: fetch,
+    endSession: fetch,
+    par: fetch,
+    register: fetch,
   }
 }