@_mustachio/openauth 0.10.0 → 0.12.0

package/dist/esm/domain/authorize.js

@@ -73,6 +73,8 @@ async function startAuthorize(input, deps) {
     prompt: req.prompt,
     uiLocales: req.uiLocales,
     nonce,
+    ...req.nonce !== undefined ? { appNonce: req.nonce } : {},
+    ...req.claimsRequest !== undefined ? { claimsRequest: req.claimsRequest } : {},
     clientPkce: req.codeChallenge ? { challenge: req.codeChallenge, method: "S256" } : undefined,
     methodState: null,
     context: tenant.request.custom,
@@ -194,6 +196,9 @@ async function issueCodeFromInlineSuccess(result, record, deps) {
     context: flow.context ?? null,
     providerSubject: result.providerSubject,
     properties: result.properties,
+    ...flow.appNonce !== undefined ? { appNonce: flow.appNonce } : {},
+    ...flow.claimsRequest !== undefined ? { claimsRequest: flow.claimsRequest } : {},
+    authTime: Math.floor(now / 1000),
     expiresAt: now + AUTH_CODE_TTL_MS
   }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
   if (isErr(saved))
@@ -206,7 +211,7 @@ async function issueCodeFromInlineSuccess(result, record, deps) {
   });
 }
 export {
-  startAuthorize,
+  AUTH_CODE_TTL_MS,
   DEFAULT_FLOW_TTL_MS,
-  AUTH_CODE_TTL_MS
+  startAuthorize
 };

package/dist/esm/domain/callback.js

@@ -7,21 +7,42 @@ import { dispatchMethod } from "./method-dispatch";
 import { saveEncryptedCode } from "./token";
 import { verifyStateEnvelope } from "./state-envelope";
 import { AUTH_CODE_TTL_MS } from "./authorize";
+async function extractCallbackState(req) {
+  const fromQuery = new URL(req.url).searchParams.get("state");
+  if (fromQuery)
+    return fromQuery;
+  if (req.method !== "POST")
+    return null;
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.includes("application/x-www-form-urlencoded"))
+    return null;
+  try {
+    const body = await req.clone().text();
+    const form = new URLSearchParams(body);
+    const v = form.get("state") ?? form.get("RelayState");
+    return v && v.length > 0 ? v : null;
+  } catch {
+    return null;
+  }
+}
 async function handleCallback(input, deps) {
   const url = new URL(input.rawRequest.url);
-  const state = url.searchParams.get("state");
-  if (!state) {
-    return err(authError.invalidRequest("missing state parameter", "state"));
-  }
-  const envelopeRes = await verifyStateEnvelope(state, deps.stateKeys);
-  if (isErr(envelopeRes)) {
+  const state = await extractCallbackState(input.rawRequest);
+  const envelopeRes = state ? await verifyStateEnvelope(state, deps.stateKeys) : null;
+  if (envelopeRes === null || isErr(envelopeRes)) {
+    const idp = await tryIdpInitiated(input, deps, url);
+    if (idp)
+      return idp;
+    if (!state) {
+      return err(authError.invalidRequest("missing state parameter", "state"));
+    }
     await safeAudit(deps, {
       kind: "flow_replay_attempt",
       tenantId: null,
       flowId: "unknown",
       timestamp: deps.clock()
     });
-    return err(authError.invalidRequest(envelopeRes.error.description, "state"));
+    return err(authError.invalidRequest(envelopeRes && isErr(envelopeRes) ? envelopeRes.error.description : "invalid state", "state"));
   }
   const envelope = envelopeRes.value;
   const flowRes = await deps.sessionStore.consumeFlow(envelope.flowId);
@@ -117,6 +138,9 @@ async function translate(result, flow, deps) {
         context: flow.context ?? null,
         providerSubject: result.providerSubject,
         properties: result.properties,
+        ...flow.appNonce !== undefined ? { appNonce: flow.appNonce } : {},
+        ...flow.claimsRequest !== undefined ? { claimsRequest: flow.claimsRequest } : {},
+        authTime: Math.floor(now / 1000),
         expiresAt: now + AUTH_CODE_TTL_MS
       }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
       if (isErr(saved))
@@ -165,6 +189,99 @@ async function translate(result, flow, deps) {
       return err(result.error);
   }
 }
+async function tryIdpInitiated(input, deps, url) {
+  if (input.rawRequest.method !== "POST")
+    return null;
+  if (!input.tenant || !input.issuerUrl)
+    return null;
+  const segments = url.pathname.split("/").filter(Boolean);
+  if (segments.length < 2 || segments[0] !== "cb")
+    return null;
+  const methodId = segments[1];
+  const methodRes = await deps.methodCache.resolve(input.tenant.config, methodId);
+  if (isErr(methodRes))
+    return null;
+  const method = methodRes.value;
+  if (method.unsolicitedCallback !== true)
+    return null;
+  const callbackUrl = `${url.protocol}//${url.host}/cb/${methodId}`;
+  const dispatched = await dispatchMethod({
+    method,
+    route: "GET /callback",
+    tenant: input.tenant,
+    request: input.rawRequest,
+    subPath: "/callback",
+    flow: null,
+    cookies: input.cookies,
+    sessionStore: deps.sessionStore,
+    dispatch: { state: "", callbackUrl, issuerUrl: input.issuerUrl }
+  });
+  if (isErr(dispatched))
+    return err(dispatched.error);
+  const result = dispatched.value;
+  if (result.kind === "challenge") {
+    return ok({
+      kind: "challenge",
+      response: result.response,
+      setCookies: result.setCookies ?? [],
+      ...result.cache !== undefined ? { cache: result.cache } : {}
+    });
+  }
+  if (result.kind === "denied") {
+    await safeAudit(deps, {
+      kind: "authorize_failed",
+      tenantId: input.tenant.id,
+      clientId: "idp-initiated",
+      methodId,
+      methodKind: method.kind,
+      flowId: "idp-initiated",
+      reason: result.reason,
+      timestamp: deps.clock()
+    });
+    return ok({
+      kind: "denied",
+      reason: result.reason,
+      setCookies: result.setCookies ?? []
+    });
+  }
+  if (result.kind === "error")
+    return err(result.error);
+  const binding = result.unsolicitedBinding;
+  if (!binding) {
+    return err(authError.internalError(`method "${methodId}" handled an unsolicited callback but returned ` + `no unsolicitedBinding`));
+  }
+  const client = input.tenant.config.clients.find((c) => c.id === binding.clientId);
+  if (!client) {
+    return err(authError.invalidRequest(`IdP-initiated binding references unknown client "${binding.clientId}"`));
+  }
+  if (!client.redirectUris.includes(binding.redirectUri)) {
+    return err(authError.invalidRequest(`IdP-initiated redirect_uri "${binding.redirectUri}" is not ` + `registered for client "${binding.clientId}"`));
+  }
+  const code = (deps.newCodeId ?? randomToken)();
+  const now = deps.clock();
+  const saved = await saveEncryptedCode(code, {
+    tenantId: input.tenant.id,
+    clientId: binding.clientId,
+    appRedirectUri: binding.redirectUri,
+    appState: null,
+    scopes: binding.scopes,
+    methodId,
+    methodKind: method.kind,
+    context: input.tenant.request.custom ?? null,
+    providerSubject: result.providerSubject,
+    properties: result.properties,
+    authTime: Math.floor(now / 1000),
+    expiresAt: now + AUTH_CODE_TTL_MS
+  }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
+  if (isErr(saved))
+    return err(saved.error);
+  return ok({
+    kind: "issue-code",
+    code,
+    appRedirectUri: binding.redirectUri,
+    appState: null
+  });
+}
 function normalizePath(p) {
   return p.replace(/\/+$/, "");
 }

package/dist/esm/domain/client-auth.js

@@ -55,7 +55,7 @@ function resolveClientCredentials(input) {
   };
 }
 export {
-  verifyClientCredentials,
+  parseBasicAuth,
   resolveClientCredentials,
-  parseBasicAuth
+  verifyClientCredentials
 };

package/dist/esm/domain/crypto.js

@@ -79,19 +79,19 @@ function generateSymmetricKey() {
   return buf;
 }
 export {
-  utf8,
-  timingSafeEqualStr,
-  timingSafeEqual,
-  sha256,
-  randomToken,
-  randomId,
-  randomHex,
-  randomBytes,
-  importHmacKey,
-  hmacVerify,
-  hmacSign,
-  generateSymmetricKey,
-  encryptPayload,
+  base64url,
   decryptPayload,
-  base64url
+  encryptPayload,
+  generateSymmetricKey,
+  hmacSign,
+  hmacVerify,
+  importHmacKey,
+  randomBytes,
+  randomHex,
+  randomId,
+  randomToken,
+  sha256,
+  timingSafeEqual,
+  timingSafeEqualStr,
+  utf8
 };

package/dist/esm/domain/discovery.js

@@ -4,6 +4,12 @@ import { buildJwksDocument } from "./jwt";
 function buildDiscoveryDocument(deps) {
   const base = deps.issuerUrl.replace(/\/+$/, "");
   const p = deps.paths ?? {};
+  const customScopeKeys = Object.keys(deps.customScopeClaims ?? {});
+  const customClaimNames = new Set;
+  for (const list of Object.values(deps.customScopeClaims ?? {})) {
+    for (const name of list)
+      customClaimNames.add(name);
+  }
   return {
     issuer: deps.issuerUrl,
     authorization_endpoint: `${base}${p.authorize ?? "/authorize"}`,
@@ -12,15 +18,51 @@ function buildDiscoveryDocument(deps) {
     jwks_uri: `${base}${p.jwks ?? "/.well-known/jwks.json"}`,
     revocation_endpoint: `${base}${p.revoke ?? "/revoke"}`,
     introspection_endpoint: `${base}${p.introspect ?? "/introspect"}`,
+    end_session_endpoint: `${base}${p.endSession ?? "/end_session"}`,
+    registration_endpoint: `${base}${p.register ?? "/register"}`,
+    pushed_authorization_request_endpoint: `${base}${p.par ?? "/par"}`,
+    require_pushed_authorization_requests: false,
+    dpop_signing_alg_values_supported: ["ES256", "EdDSA"],
     response_types_supported: ["code"],
     grant_types_supported: [
       "authorization_code",
       "refresh_token",
       "client_credentials"
     ],
-    subject_types_supported: ["public"],
+    subject_types_supported: ["public", "pairwise"],
     id_token_signing_alg_values_supported: ["ES256", "EdDSA"],
-    scopes_supported: deps.scopes ?? ["openid", "email", "profile"],
+    scopes_supported: [
+      ...deps.scopes ?? ["openid", "email", "profile"],
+      ...customScopeKeys
+    ],
+    claims_supported: [
+      "sub",
+      "iss",
+      "aud",
+      "exp",
+      "iat",
+      "auth_time",
+      "nonce",
+      "amr",
+      "at_hash",
+      "email",
+      "email_verified",
+      "name",
+      "given_name",
+      "family_name",
+      "preferred_username",
+      "picture",
+      "locale",
+      "phone_number",
+      "phone_number_verified",
+      "address",
+      ...customClaimNames
+    ],
+    claims_parameter_supported: true,
+    request_parameter_supported: false,
+    request_uri_parameter_supported: false,
+    require_request_uri_registration: false,
+    ui_locales_supported: deps.uiLocales ?? ["en"],
     token_endpoint_auth_methods_supported: [
       "client_secret_basic",
       "client_secret_post",
@@ -36,6 +78,6 @@ async function buildJwks(keyStore) {
   return ok(buildJwksDocument(res.value));
 }
 export {
-  buildJwks,
-  buildDiscoveryDocument
+  buildDiscoveryDocument,
+  buildJwks
 };

package/dist/esm/domain/dpop.js

@@ -0,0 +1,122 @@
+// src/domain/dpop.ts
+import {
+  calculateJwkThumbprint,
+  decodeProtectedHeader,
+  importJWK,
+  jwtVerify
+} from "jose";
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { base64url, sha256, utf8 } from "./crypto";
+var DPOP_ASYMMETRIC_ALGS = new Set(["ES256", "EdDSA"]);
+var DEFAULT_DPOP_IAT_TOLERANCE_SEC = 60;
+var DEFAULT_DPOP_JTI_TTL_MS = 2 * DEFAULT_DPOP_IAT_TOLERANCE_SEC * 1000;
+async function verifyDpopProof(input, deps) {
+  if (!deps.tokenStore.recordDpopJti) {
+    return err(authError.invalidDpopProof("token-store adapter does not support DPoP replay protection"));
+  }
+  let header;
+  try {
+    header = decodeProtectedHeader(input.proofJwt);
+  } catch (e) {
+    return err(authError.invalidDpopProof(`dpop proof header is not a valid compact JWS: ${stringifyError(e)}`));
+  }
+  if (header.typ !== "dpop+jwt") {
+    return err(authError.invalidDpopProof(`dpop proof header.typ must be "dpop+jwt", got "${String(header.typ)}"`));
+  }
+  if (!header.alg || !DPOP_ASYMMETRIC_ALGS.has(header.alg)) {
+    return err(authError.invalidDpopProof(`dpop proof alg "${String(header.alg)}" not in {ES256, EdDSA}`));
+  }
+  const jwk = header.jwk;
+  if (!jwk || typeof jwk !== "object") {
+    return err(authError.invalidDpopProof("dpop proof header.jwk missing or not an object"));
+  }
+  if ("d" in jwk) {
+    return err(authError.invalidDpopProof("dpop proof header.jwk must be a public key (private material present)"));
+  }
+  let key;
+  try {
+    key = await importJWK(jwk, header.alg);
+  } catch (e) {
+    return err(authError.invalidDpopProof(`dpop proof JWK import failed: ${stringifyError(e)}`));
+  }
+  let verified;
+  try {
+    verified = await jwtVerify(input.proofJwt, key, {
+      algorithms: [header.alg]
+    });
+  } catch (e) {
+    return err(authError.invalidDpopProof(`dpop proof signature verification failed: ${stringifyError(e)}`));
+  }
+  const payload = verified.payload;
+  if (typeof payload.htm !== "string") {
+    return err(authError.invalidDpopProof("dpop proof missing string htm"));
+  }
+  if (typeof payload.htu !== "string") {
+    return err(authError.invalidDpopProof("dpop proof missing string htu"));
+  }
+  if (typeof payload.iat !== "number") {
+    return err(authError.invalidDpopProof("dpop proof missing numeric iat"));
+  }
+  if (typeof payload.jti !== "string" || payload.jti.length === 0) {
+    return err(authError.invalidDpopProof("dpop proof missing non-empty string jti"));
+  }
+  if (payload.htm !== input.htm) {
+    return err(authError.invalidDpopProof(`dpop htm "${payload.htm}" does not match request method "${input.htm}"`));
+  }
+  if (payload.htu !== input.htu) {
+    return err(authError.invalidDpopProof(`dpop htu "${payload.htu}" does not match request uri "${input.htu}"`));
+  }
+  const tolerance = input.iatToleranceSec ?? DEFAULT_DPOP_IAT_TOLERANCE_SEC;
+  const skew = Math.abs(input.nowSec - payload.iat);
+  if (skew > tolerance) {
+    return err(authError.invalidDpopProof(`dpop iat skew ${skew}s exceeds tolerance ${tolerance}s`));
+  }
+  if (input.expectedAth !== undefined) {
+    if (typeof payload.ath !== "string" || payload.ath !== input.expectedAth) {
+      return err(authError.invalidDpopProof("dpop ath does not match SHA-256 of the access token"));
+    }
+  }
+  const recorded = await deps.tokenStore.recordDpopJti(payload.jti, deps.jtiTtlMs ?? DEFAULT_DPOP_JTI_TTL_MS);
+  if (isErr(recorded)) {
+    return err(authError.invalidDpopProof(`dpop jti "${payload.jti}" replayed`, {
+      jti: payload.jti
+    }));
+  }
+  let jkt;
+  try {
+    jkt = await calculateJwkThumbprint(jwk, "sha256");
+  } catch (e) {
+    return err(authError.invalidDpopProof(`dpop jkt thumbprint computation failed: ${stringifyError(e)}`));
+  }
+  return ok({
+    jkt,
+    payload: {
+      htm: payload.htm,
+      htu: payload.htu,
+      iat: payload.iat,
+      jti: payload.jti,
+      ...payload.ath !== undefined ? { ath: payload.ath } : {},
+      ...payload.nonce !== undefined ? { nonce: payload.nonce } : {}
+    }
+  });
+}
+function canonicalHtu(rawUrl) {
+  const u = new URL(rawUrl);
+  u.search = "";
+  u.hash = "";
+  return u.toString();
+}
+async function computeAth(accessToken) {
+  return base64url.encode(await sha256(utf8.encode(accessToken)));
+}
+function stringifyError(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+export {
+  DEFAULT_DPOP_IAT_TOLERANCE_SEC,
+  DEFAULT_DPOP_JTI_TTL_MS,
+  canonicalHtu,
+  computeAth,
+  verifyDpopProof
+};

package/dist/esm/domain/id-token.js

@@ -0,0 +1,94 @@
+// src/domain/id-token.ts
+import { base64url, sha256, utf8 } from "./crypto";
+var SCOPE_TO_CLAIMS = {
+  profile: [
+    "name",
+    "given_name",
+    "family_name",
+    "middle_name",
+    "nickname",
+    "preferred_username",
+    "profile",
+    "picture",
+    "website",
+    "gender",
+    "birthdate",
+    "zoneinfo",
+    "locale",
+    "updated_at"
+  ],
+  email: ["email", "email_verified"],
+  phone: ["phone_number", "phone_number_verified"],
+  address: ["address"]
+};
+function deriveAmr(methodKind) {
+  switch (methodKind) {
+    case "password":
+      return ["pwd"];
+    case "code":
+      return ["otp"];
+    case "passkey":
+      return ["hwk"];
+    default:
+      return;
+  }
+}
+async function computeAtHash(accessToken) {
+  const digest = await sha256(utf8.encode(accessToken));
+  const half = digest.slice(0, digest.byteLength / 2);
+  return base64url.encode(half);
+}
+function pickScopedClaims(claim, scopes, extra = [], customMappings = {}) {
+  const props = claim.properties;
+  if (!props || typeof props !== "object")
+    return {};
+  const mappings = {
+    ...customMappings,
+    ...SCOPE_TO_CLAIMS
+  };
+  const granted = new Set;
+  for (const scope of scopes) {
+    const list = mappings[scope];
+    if (!list)
+      continue;
+    for (const c of list)
+      granted.add(c);
+  }
+  for (const name of extra)
+    granted.add(name);
+  const out = {};
+  for (const key of granted) {
+    if (key in props && props[key] !== undefined)
+      out[key] = props[key];
+  }
+  return out;
+}
+var DEFAULT_ID_TOKEN_TTL_MS = 5 * 60 * 1000;
+async function buildIdTokenClaims(input) {
+  const ttl = input.ttlMs ?? DEFAULT_ID_TOKEN_TTL_MS;
+  const amr = deriveAmr(input.methodKind);
+  const extraClaims = Object.keys(input.claimsRequest?.id_token ?? {});
+  return {
+    iss: input.issuerUrl,
+    sub: input.subjectId,
+    aud: input.audience,
+    exp: Math.floor((input.now + ttl) / 1000),
+    iat: Math.floor(input.now / 1000),
+    auth_time: input.authTime,
+    at_hash: await computeAtHash(input.accessToken),
+    ...input.appNonce !== undefined ? { nonce: input.appNonce } : {},
+    ...amr ? { amr } : {},
+    ...pickScopedClaims(input.claim, input.scopes, extraClaims, input.customScopeClaims ?? {})
+  };
+}
+function shouldIssueIdToken(scopes) {
+  return scopes.includes("openid");
+}
+export {
+  DEFAULT_ID_TOKEN_TTL_MS,
+  buildIdTokenClaims,
+  computeAtHash,
+  deriveAmr,
+  pickScopedClaims,
+  shouldIssueIdToken
+};

package/dist/esm/domain/introspect.js

@@ -32,6 +32,7 @@ async function introspect(req, deps) {
   if (claims.aud !== req.clientId) {
     return ok({ active: false });
   }
+  const subjectType = claims.claim?.type;
   return ok({
     active: true,
     sub: claims.sub,
@@ -41,9 +42,12 @@ async function introspect(req, deps) {
     iat: claims.iat,
     scope: claims.scope,
     client_id: claims.aud,
+    token_type: claims.cnf?.jkt !== undefined ? "DPoP" : "Bearer",
     tid: claims.tid,
     mid: claims.mid,
-    mkind: claims.mkind
+    mkind: claims.mkind,
+    ...subjectType !== undefined ? { subject_type: subjectType } : {},
+    ...claims.cnf !== undefined ? { cnf: claims.cnf } : {}
   });
 }
 export {

package/dist/esm/domain/jwt.js

@@ -3,6 +3,32 @@ import { importJWK, jwtVerify, SignJWT } from "jose";
 async function signAccessToken(claims, privateKey, alg, kid) {
   return new SignJWT(claims).setProtectedHeader({ alg, typ: "JWT", kid }).sign(privateKey);
 }
+async function signIdToken(claims, privateKey, alg, kid) {
+  return new SignJWT(claims).setProtectedHeader({ alg, typ: "JWT", kid }).sign(privateKey);
+}
+async function verifyIdToken(token, keys, options = {}) {
+  const algorithms = Array.from(new Set(keys.map((k) => k.alg).filter((a) => ASYMMETRIC_ALGS.has(a))));
+  const { payload } = await jwtVerify(token, async (header) => {
+    if (!header.alg || header.alg === "none") {
+      throw new Error(`verifyIdToken: refusing alg "${header.alg ?? ""}"`);
+    }
+    const match = keys.find((k) => k.kid === header.kid);
+    if (!match) {
+      throw new Error(`verifyIdToken: unknown kid "${header.kid}"`);
+    }
+    if (match.alg !== header.alg) {
+      throw new Error(`verifyIdToken: header.alg "${header.alg}" does not match key alg "${match.alg}"`);
+    }
+    const imported = await importJWK(match.publicJwk, match.alg);
+    return imported;
+  }, {
+    algorithms,
+    ...options.issuer ? { issuer: options.issuer } : {},
+    ...options.audience ? { audience: options.audience } : {},
+    ...options.acceptExpired ? { clockTolerance: Number.MAX_SAFE_INTEGER } : {}
+  });
+  return payload;
+}
 var ASYMMETRIC_ALGS = new Set(["ES256", "EdDSA"]);
 async function verifyAccessToken(token, keys, options = {}) {
   const algorithms = Array.from(new Set(keys.map((k) => k.alg).filter((a) => ASYMMETRIC_ALGS.has(a))));
@@ -37,7 +63,9 @@ function buildJwksDocument(keys) {
   };
 }
 export {
-  verifyAccessToken,
+  buildJwksDocument,
   signAccessToken,
-  buildJwksDocument
+  signIdToken,
+  verifyAccessToken,
+  verifyIdToken
 };

package/dist/esm/domain/logout.js

@@ -0,0 +1,75 @@
+// src/domain/logout.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { safeAudit } from "./audit";
+import { verifyIdToken } from "./jwt";
+import { revokeAllForSubject } from "./revoke";
+async function endSession(req, tenant, deps) {
+  let hintSubject;
+  let hintAud;
+  if (req.idTokenHint) {
+    const keysRes = await deps.keyStore.signingKeys();
+    if (isErr(keysRes))
+      return err(keysRes.error);
+    try {
+      const claims = await verifyIdToken(req.idTokenHint, keysRes.value, {
+        issuer: deps.issuerUrl,
+        acceptExpired: true
+      });
+      hintSubject = claims.sub;
+      hintAud = claims.aud;
+    } catch (e) {
+      const reason = e instanceof Error ? e.message : String(e);
+      return err(authError.invalidRequest(`id_token_hint failed signature/issuer verification: ${reason}`, "id_token_hint"));
+    }
+  }
+  if (req.clientId && hintAud && req.clientId !== hintAud) {
+    return err(authError.invalidRequest("client_id does not match id_token_hint.aud", "client_id"));
+  }
+  const resolvedClientId = req.clientId ?? hintAud;
+  let client;
+  if (resolvedClientId) {
+    client = tenant.config.clients.find((c) => c.id === resolvedClientId);
+    if (!client) {
+      return err(authError.invalidRequest(`unknown client "${resolvedClientId}"`, "client_id"));
+    }
+  }
+  if (req.postLogoutRedirectUri) {
+    if (!client) {
+      return err(authError.invalidRequest("post_logout_redirect_uri requires identifying the client via client_id or id_token_hint", "post_logout_redirect_uri"));
+    }
+    const registered = client.postLogoutRedirectUris ?? [];
+    if (!registered.includes(req.postLogoutRedirectUri)) {
+      return err(authError.invalidRequest("post_logout_redirect_uri is not registered for this client", "post_logout_redirect_uri"));
+    }
+  }
+  if (hintSubject) {
+    const revoked = await revokeAllForSubject(tenant.id, hintSubject, {
+      tokenStore: deps.tokenStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      clock: deps.clock
+    });
+    if (isErr(revoked))
+      return err(revoked.error);
+  }
+  await safeAudit(deps, {
+    kind: "session_logout",
+    tenantId: tenant.id,
+    ...resolvedClientId ? { clientId: resolvedClientId } : {},
+    ...hintSubject ? { subjectId: hintSubject } : {},
+    timestamp: deps.clock()
+  });
+  if (req.postLogoutRedirectUri) {
+    const url = new URL(req.postLogoutRedirectUri);
+    if (req.state !== undefined)
+      url.searchParams.set("state", req.state);
+    return ok({ kind: "redirect", url: url.toString() });
+  }
+  return ok({
+    kind: "ok",
+    ...hintSubject ? { subjectId: hintSubject } : {}
+  });
+}
+export {
+  endSession
+};