@_mustachio/openauth 0.10.0 → 0.12.0

package/dist/esm/http/handlers/authorize.js

@@ -4,13 +4,16 @@ import { startAuthorize } from "../../domain/authorize";
 import { asTenantId } from "../../types/tenant";
 import { authError } from "../../types/error";
 import { renderPicker as renderDefaultPicker } from "../../ui/picker";
-import { applyResponsePolicy } from "../cookies";
+import { applyResponsePolicy, cacheControlHeader } from "../cookies";
 import {
   authorizeDirectErrorResponse,
   authorizeRedirectErrorResponse,
   isNonRecoverable
 } from "../errors";
-import { authorizeQuerySchema } from "../schemas/authorize";
+import {
+  authorizeQuerySchema,
+  authorizeRequestUriQuerySchema
+} from "../schemas/authorize";
 function makeAuthorizeHandler(deps) {
   return async (c) => {
     const tenant = c.get("tenant");
@@ -19,13 +22,37 @@ function makeAuthorizeHandler(deps) {
     }
     const url = new URL(c.req.url);
     const raw = Object.fromEntries(url.searchParams.entries());
-    const parsed = authorizeQuerySchema.safeParse(raw);
+    let workingRaw = raw;
+    if (raw.request_uri !== undefined) {
+      const parParsed = authorizeRequestUriQuerySchema.safeParse(raw);
+      if (!parParsed.success) {
+        return authorizeDirectErrorResponse(authError.invalidRequest(parParsed.error.issues[0]?.message ?? "invalid request", parParsed.error.issues[0]?.path[0]?.toString() ?? "request"));
+      }
+      if (!deps.sessionStore.consumePar) {
+        return authorizeDirectErrorResponse(authError.invalidRequest("session adapter does not support PAR", "request_uri"));
+      }
+      const par = await deps.sessionStore.consumePar(parParsed.data.request_uri);
+      if (isErr(par)) {
+        return authorizeDirectErrorResponse(authError.invalidRequest("unknown or expired request_uri", "request_uri"));
+      }
+      if (par.value.clientId !== parParsed.data.client_id) {
+        return authorizeDirectErrorResponse(authError.invalidRequest("request_uri belongs to a different client", "request_uri"));
+      }
+      workingRaw = par.value.params;
+    }
+    const parsed = authorizeQuerySchema.safeParse(workingRaw);
     if (!parsed.success) {
       const first = parsed.error.issues[0];
       const field = first?.path[0]?.toString() ?? "request";
       return authorizeDirectErrorResponse(authError.invalidRequest(first?.message ?? "invalid request", field));
     }
     const q = parsed.data;
+    if (raw.request_uri === undefined) {
+      const client = tenant.config.clients.find((c) => c.id === q.client_id);
+      if (client?.requirePushedAuthorizationRequests) {
+        return authorizeDirectErrorResponse(authError.invalidRequest("this client requires Pushed Authorization Requests (RFC 9126)", "request_uri"));
+      }
+    }
     if (q.response_type !== "code") {
       return authorizeDirectErrorResponse({
         code: "invalid_request",
@@ -33,6 +60,14 @@ function makeAuthorizeHandler(deps) {
         field: "response_type"
       });
     }
+    let claimsRequest;
+    if (q.claims !== undefined) {
+      const parsedClaims = parseClaimsParameter(q.claims);
+      if (!parsedClaims.ok) {
+        return authorizeDirectErrorResponse(authError.invalidRequest(parsedClaims.error, "claims"));
+      }
+      claimsRequest = parsedClaims.value;
+    }
     const request = {
       tenantId: asTenantId(tenant.id),
       clientId: q.client_id,
@@ -46,7 +81,8 @@ function makeAuthorizeHandler(deps) {
       ...q.code_challenge_method !== undefined ? { codeChallengeMethod: q.code_challenge_method } : {},
       ...q.prompt !== undefined ? { prompt: q.prompt } : {},
       ...q.ui_locales !== undefined ? { uiLocales: q.ui_locales } : {},
-      ...q.nonce !== undefined ? { nonce: q.nonce } : {}
+      ...q.nonce !== undefined ? { nonce: q.nonce } : {},
+      ...claimsRequest !== undefined ? { claimsRequest } : {}
     };
     const result = await startAuthorize({
       request,
@@ -87,7 +123,7 @@ function makeAuthorizeHandler(deps) {
         return applyResponsePolicy(out.response, {
           setCookies: [flowCookie, ...out.setCookies],
           cookieDefaults: deps.cookieDefaults,
-          cacheControl: cacheControlFor(out.cache)
+          cacheControl: cacheControlHeader(out.cache)
         });
       }
       case "issue-code": {
@@ -132,6 +168,57 @@ function makeAuthorizeHandler(deps) {
     }
   };
 }
+function parseClaimsParameter(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return {
+      ok: false,
+      error: `claims parameter is not valid JSON: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { ok: false, error: "claims parameter must be a JSON object" };
+  }
+  const obj = parsed;
+  const result = {};
+  for (const section of ["userinfo", "id_token"]) {
+    const v = obj[section];
+    if (v === undefined)
+      continue;
+    if (!v || typeof v !== "object" || Array.isArray(v)) {
+      return {
+        ok: false,
+        error: `claims.${section} must be a JSON object`
+      };
+    }
+    const sectionMap = {};
+    for (const [name, entry] of Object.entries(v)) {
+      if (entry === null) {
+        sectionMap[name] = null;
+        continue;
+      }
+      if (typeof entry !== "object" || Array.isArray(entry)) {
+        return {
+          ok: false,
+          error: `claims.${section}.${name} must be null or a JSON object`
+        };
+      }
+      const e = entry;
+      const normalized = {};
+      if (typeof e.essential === "boolean")
+        normalized.essential = e.essential;
+      if ("value" in e)
+        normalized.value = e.value;
+      if (Array.isArray(e.values))
+        normalized.values = e.values;
+      sectionMap[name] = normalized;
+    }
+    result[section] = sectionMap;
+  }
+  return { ok: true, value: result };
+}
 function clearFlowCookie() {
   return {
     name: "idp.flow",
@@ -142,22 +229,6 @@ function clearFlowCookie() {
     maxAge: 0
   };
 }
-function cacheControlFor(cache) {
-  if (!cache)
-    return "no-store";
-  if ((cache.maxAge ?? -1) === 0)
-    return "no-store";
-  const parts = [];
-  if (cache.isPrivate)
-    parts.push("private");
-  if (cache.maxAge !== undefined)
-    parts.push(`max-age=${cache.maxAge}`);
-  if (cache.sMaxAge !== undefined)
-    parts.push(`s-maxage=${cache.sMaxAge}`);
-  if (cache.immutable)
-    parts.push("immutable");
-  return parts.length ? parts.join(", ") : "no-store";
-}
 export {
   makeAuthorizeHandler
 };

package/dist/esm/http/handlers/callback.js

@@ -5,7 +5,13 @@ import { applyResponsePolicy } from "../cookies";
 import { authorizeDirectErrorResponse } from "../errors";
 function makeCallbackHandler(deps) {
   return async (c) => {
-    const result = await handleCallback({ rawRequest: c.req.raw, cookies: c.get("cookies") }, {
+    const tenant = c.get("tenant");
+    const result = await handleCallback({
+      rawRequest: c.req.raw,
+      cookies: c.get("cookies"),
+      ...tenant ? { tenant } : {},
+      issuerUrl: c.get("issuerUrl")
+    }, {
       configStore: deps.configStore,
       sessionStore: deps.sessionStore,
       tokenStore: deps.tokenStore,

package/dist/esm/http/handlers/end-session.js

@@ -0,0 +1,64 @@
+// src/http/handlers/end-session.ts
+import { endSession } from "../../domain/logout";
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { applyResponsePolicy } from "../cookies";
+import { tokenEndpointErrorResponse } from "../errors";
+import { endSessionParamsSchema } from "../schemas/end-session";
+function makeEndSessionHandler(deps) {
+  return async (c) => {
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("tenant unresolved"));
+    }
+    let raw;
+    const httpMethod = c.req.method.toUpperCase();
+    if (httpMethod === "GET") {
+      raw = Object.fromEntries(new URL(c.req.url).searchParams.entries());
+    } else if (httpMethod === "POST") {
+      const ct = (c.req.header("content-type") ?? "").toLowerCase();
+      if (!ct.startsWith("application/x-www-form-urlencoded")) {
+        return tokenEndpointErrorResponse(authError.invalidRequest("POST /end_session requires application/x-www-form-urlencoded body"));
+      }
+      raw = Object.fromEntries(new URLSearchParams(await c.req.raw.text()));
+    } else {
+      return tokenEndpointErrorResponse(authError.invalidRequest(`unsupported method "${httpMethod}"`));
+    }
+    const parsed = endSessionParamsSchema.safeParse(raw);
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid request"));
+    }
+    const q = parsed.data;
+    const res = await endSession({
+      ...q.id_token_hint !== undefined ? { idTokenHint: q.id_token_hint } : {},
+      ...q.client_id !== undefined ? { clientId: q.client_id } : {},
+      ...q.post_logout_redirect_uri !== undefined ? { postLogoutRedirectUri: q.post_logout_redirect_uri } : {},
+      ...q.state !== undefined ? { state: q.state } : {}
+    }, tenant, {
+      configStore: deps.configStore,
+      tokenStore: deps.tokenStore,
+      keyStore: deps.keyStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      issuerUrl: c.get("issuerUrl"),
+      clock: deps.clock
+    });
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    if (res.value.kind === "redirect") {
+      return applyResponsePolicy(new Response(null, {
+        status: 302,
+        headers: { location: res.value.url }
+      }), { setCookies: [], cookieDefaults: deps.cookieDefaults });
+    }
+    return new Response("Logged out.", {
+      status: 200,
+      headers: {
+        "content-type": "text/plain; charset=utf-8",
+        "cache-control": "no-store"
+      }
+    });
+  };
+}
+export {
+  makeEndSessionHandler
+};

package/dist/esm/http/handlers/metadata.js

@@ -2,9 +2,12 @@
 import { buildDiscoveryDocument, buildJwks } from "../../domain/discovery";
 import { isErr } from "../../types/result";
 import { tokenEndpointErrorResponse } from "../errors";
-function makeDiscoveryHandler(_deps) {
+function makeDiscoveryHandler(deps) {
   return async (c) => {
-    const doc = buildDiscoveryDocument({ issuerUrl: c.get("issuerUrl") });
+    const doc = buildDiscoveryDocument({
+      issuerUrl: c.get("issuerUrl"),
+      ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
+    });
     return new Response(JSON.stringify(doc), {
       status: 200,
       headers: {
@@ -29,6 +32,6 @@ function makeJwksHandler(deps) {
   };
 }
 export {
-  makeJwksHandler,
-  makeDiscoveryHandler
+  makeDiscoveryHandler,
+  makeJwksHandler
 };

package/dist/esm/http/handlers/method-route.js

@@ -1,8 +1,11 @@
 // src/http/handlers/method-route.ts
-import { handleMethodRoute } from "../../domain/method-route";
+import {
+  handleMethodRoute,
+  handlePublicMethodRoute
+} from "../../domain/method-route";
 import { authError } from "../../types/error";
 import { isErr } from "../../types/result";
-import { applyResponsePolicy } from "../cookies";
+import { applyResponsePolicy, cacheControlHeader } from "../cookies";
 import { authorizeDirectErrorResponse } from "../errors";
 function makeMethodRouteHandler(deps) {
   return async (c) => {
@@ -10,6 +13,48 @@ function makeMethodRouteHandler(deps) {
     if (!tenant) {
       return authorizeDirectErrorResponse(authError.invalidRequest("tenant unresolved"));
     }
+    {
+      const u = new URL(c.req.url);
+      const segs = u.pathname.split("/").filter(Boolean);
+      if (segs.length >= 3 && segs[0] === "m") {
+        const methodId = segs[1];
+        const subPath = "/" + segs.slice(2).join("/");
+        const httpMethod = c.req.method.toUpperCase() === "POST" ? "POST" : "GET";
+        const routeKey = `${httpMethod} ${subPath}`;
+        const resolved = await deps.methodCache.resolve(tenant.config, methodId);
+        if (!isErr(resolved) && resolved.value.publicRoutes?.includes(routeKey)) {
+          const issuerUrl = c.get("issuerUrl");
+          const callbackHost = deps.callbackHostFor?.(tenant.id) ?? new URL(issuerUrl).host;
+          const callbackUrl = `${new URL(issuerUrl).protocol}//${callbackHost}/cb/${methodId}`;
+          const pub = await handlePublicMethodRoute({
+            rawRequest: c.req.raw,
+            tenant,
+            method: resolved.value,
+            route: routeKey,
+            subPath,
+            dispatch: { state: "", callbackUrl, issuerUrl }
+          }, {
+            sessionStore: deps.sessionStore,
+            tokenStore: deps.tokenStore,
+            clock: deps.clock,
+            ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+            ...deps.onLogout ? { onLogout: deps.onLogout } : {}
+          });
+          if (isErr(pub))
+            return authorizeDirectErrorResponse(pub.error);
+          if (pub.value.kind === "denied") {
+            return applyResponsePolicy(new Response(`access_denied: ${pub.value.reason}`, {
+              status: 403,
+              headers: { "content-type": "text/plain" }
+            }), { cookieDefaults: deps.cookieDefaults });
+          }
+          return applyResponsePolicy(pub.value.response, {
+            cacheControl: cacheControlHeader(pub.value.cache),
+            cookieDefaults: deps.cookieDefaults
+          });
+        }
+      }
+    }
     const cookies = c.get("cookies");
     const flowId = cookies.get("idp.flow");
     if (!flowId) {

package/dist/esm/http/handlers/par.js

@@ -0,0 +1,53 @@
+// src/http/handlers/par.ts
+import { resolveClientCredentials } from "../../domain/client-auth";
+import { pushAuthorizationRequest } from "../../domain/par";
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { tokenEndpointErrorResponse } from "../errors";
+import { parBodySchema } from "../schemas/par";
+function makeParHandler(deps) {
+  return async (c) => {
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("tenant unresolved"));
+    }
+    const ct = (c.req.header("content-type") ?? "").toLowerCase();
+    if (!ct.startsWith("application/x-www-form-urlencoded")) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("body must be application/x-www-form-urlencoded"));
+    }
+    const raw = Object.fromEntries(new URLSearchParams(await c.req.raw.text()).entries());
+    const parsed = parBodySchema.safeParse(raw);
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid request"));
+    }
+    const creds = resolveClientCredentials({
+      authorizationHeader: c.req.header("authorization") ?? null,
+      bodyClientId: parsed.data.client_id,
+      bodyClientSecret: parsed.data.client_secret
+    });
+    const clientId = creds?.clientId ?? parsed.data.client_id;
+    const { client_secret: _strip, ...paramsForAuthorize } = parsed.data;
+    const res = await pushAuthorizationRequest({
+      clientId,
+      ...creds?.clientSecret !== undefined ? { clientSecret: creds.clientSecret } : {},
+      params: paramsForAuthorize
+    }, tenant, {
+      configStore: deps.configStore,
+      sessionStore: deps.sessionStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      clock: deps.clock
+    });
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    return new Response(JSON.stringify(res.value), {
+      status: 201,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store"
+      }
+    });
+  };
+}
+export {
+  makeParHandler
+};

package/dist/esm/http/handlers/register.js

@@ -0,0 +1,46 @@
+// src/http/handlers/register.ts
+import { registerNewClient } from "../../domain/register";
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { tokenEndpointErrorResponse } from "../errors";
+import { registerBodySchema } from "../schemas/register";
+function makeRegisterHandler(deps) {
+  return async (c) => {
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("tenant unresolved"));
+    }
+    const ct = (c.req.header("content-type") ?? "").toLowerCase();
+    if (!ct.startsWith("application/json")) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("body must be application/json"));
+    }
+    let raw;
+    try {
+      raw = await c.req.raw.json();
+    } catch (e) {
+      const reason = e instanceof Error ? e.message : String(e);
+      return tokenEndpointErrorResponse(authError.invalidRequest(`malformed JSON: ${reason}`));
+    }
+    const parsed = registerBodySchema.safeParse(raw);
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid request"));
+    }
+    const request = parsed.data;
+    const res = await registerNewClient(request, tenant, {
+      ...deps.registerClient ? { registerClient: deps.registerClient } : {},
+      clock: deps.clock
+    });
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    return new Response(JSON.stringify(res.value), {
+      status: 201,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store"
+      }
+    });
+  };
+}
+export {
+  makeRegisterHandler
+};

package/dist/esm/http/handlers/revocation.js

@@ -93,6 +93,6 @@ async function readForm(req) {
   return new URLSearchParams(await req.text());
 }
 export {
-  makeRevokeHandler,
-  makeIntrospectHandler
+  makeIntrospectHandler,
+  makeRevokeHandler
 };

package/dist/esm/http/handlers/token.js

@@ -1,5 +1,6 @@
 // src/http/handlers/token.ts
 import { clientCredentialsGrant } from "../../domain/client-credentials";
+import { canonicalHtu, verifyDpopProof } from "../../domain/dpop";
 import { exchangeCode } from "../../domain/token";
 import { exchangeToken } from "../../domain/token-exchange";
 import { refreshTokens } from "../../domain/refresh";
@@ -19,6 +20,29 @@ function makeTokenHandler(deps) {
       body.set("client_id", basic.id);
       body.set("client_secret", basic.secret);
     }
+    const dpopHeader = c.req.header("dpop") ?? null;
+    let dpopJkt;
+    if (dpopHeader) {
+      const dpopRes = await verifyDpopProof({
+        proofJwt: dpopHeader,
+        htu: canonicalHtu(c.req.url),
+        htm: "POST",
+        nowSec: Math.floor(deps.clock() / 1000)
+      }, { tokenStore: deps.tokenStore });
+      if (isErr(dpopRes)) {
+        const errVal = dpopRes.error;
+        if (errVal.code === "invalid_dpop_proof" && errVal.replaySignal && deps.auditLog) {
+          await deps.auditLog.log({
+            kind: "dpop_replay_detected",
+            tenantId: null,
+            jtiPrefix: errVal.replaySignal.jti.slice(0, 16),
+            timestamp: deps.clock()
+          });
+        }
+        return tokenEndpointErrorResponse(errVal);
+      }
+      dpopJkt = dpopRes.value.jkt;
+    }
     const parsed = tokenRequestSchema.safeParse(Object.fromEntries(body.entries()));
     if (!parsed.success) {
       const first = parsed.error.issues[0];
@@ -35,7 +59,8 @@ function makeTokenHandler(deps) {
         redirectUri: req.redirect_uri,
         clientId: req.client_id,
         ...req.client_secret !== undefined ? { clientSecret: req.client_secret } : {},
-        ...req.code_verifier !== undefined ? { codeVerifier: req.code_verifier } : {}
+        ...req.code_verifier !== undefined ? { codeVerifier: req.code_verifier } : {},
+        ...dpopJkt !== undefined ? { dpopJkt } : {}
       }, {
         configStore: deps.configStore,
         tokenStore: deps.tokenStore,
@@ -44,7 +69,8 @@ function makeTokenHandler(deps) {
         success: deps.success,
         ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
         issuerUrl: c.get("issuerUrl"),
-        clock: deps.clock
+        clock: deps.clock,
+        ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
       });
       if (isErr(result))
         return tokenEndpointErrorResponse(result.error);
@@ -75,7 +101,8 @@ function makeTokenHandler(deps) {
         success: deps.success,
         ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
         issuerUrl: c.get("issuerUrl"),
-        clock: deps.clock
+        clock: deps.clock,
+        ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
       }, tenantRes.value);
       if (isErr(result))
         return tokenEndpointErrorResponse(result.error);
@@ -87,14 +114,16 @@ function makeTokenHandler(deps) {
         refreshToken: req.refresh_token,
         ...req.scope !== undefined ? { scope: req.scope } : {},
         ...req.client_id !== undefined ? { clientId: req.client_id } : {},
-        ...req.client_secret !== undefined ? { clientSecret: req.client_secret } : {}
+        ...req.client_secret !== undefined ? { clientSecret: req.client_secret } : {},
+        ...dpopJkt !== undefined ? { dpopJkt } : {}
       }, {
         configStore: deps.configStore,
         tokenStore: deps.tokenStore,
         keyStore: deps.keyStore,
         ...deps.auditLog ? { auditLog: deps.auditLog } : {},
         issuerUrl: c.get("issuerUrl"),
-        clock: deps.clock
+        clock: deps.clock,
+        ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
       });
       if (isErr(refreshResult))
         return tokenEndpointErrorResponse(refreshResult.error);
@@ -117,7 +146,8 @@ function makeTokenHandler(deps) {
       ...deps.auditLog ? { auditLog: deps.auditLog } : {},
       ...deps.exchangeAudience ? { exchangeAudience: deps.exchangeAudience } : {},
       issuerUrl: c.get("issuerUrl"),
-      clock: deps.clock
+      clock: deps.clock,
+      ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
     });
     if (isErr(exchangeResult)) {
       return tokenEndpointErrorResponse(exchangeResult.error);

package/dist/esm/http/handlers/userinfo.js

@@ -1,38 +1,32 @@
 // src/http/handlers/userinfo.ts
+import { canonicalHtu } from "../../domain/dpop";
 import { userinfo } from "../../domain/userinfo";
 import { isErr } from "../../types/result";
 function makeUserinfoHandler(deps) {
   return async (c) => {
-    const bearer = extractBearer(c.req.header("authorization") ?? null);
-    if (!bearer) {
-      const r = new Response(JSON.stringify({
-        error: "invalid_token",
-        error_description: "missing bearer token"
-      }), {
-        status: 401,
-        headers: {
-          "content-type": "application/json",
-          "www-authenticate": 'Bearer realm="userinfo"'
-        }
-      });
-      return r;
+    const auth = extractAuthorization(c.req.header("authorization") ?? null);
+    if (!auth) {
+      return wwwAuthenticateResponse("Bearer", "invalid_token", "missing bearer / DPoP token", 401);
     }
-    const res = await userinfo(bearer, {
+    const dpopProof = c.req.header("dpop") ?? undefined;
+    const res = await userinfo({
+      accessToken: auth.token,
+      scheme: auth.scheme,
+      ...dpopProof !== undefined ? { dpopProof } : {},
+      htu: canonicalHtu(c.req.url),
+      htm: c.req.method.toUpperCase(),
+      nowSec: Math.floor(deps.clock() / 1000)
+    }, {
       keyStore: deps.keyStore,
-      issuerUrl: c.get("issuerUrl")
+      tokenStore: deps.tokenStore,
+      issuerUrl: c.get("issuerUrl"),
+      ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
     });
     if (isErr(res)) {
-      const err = res.error;
-      return new Response(JSON.stringify({
-        error: "invalid_token",
-        error_description: err.description
-      }), {
-        status: 401,
-        headers: {
-          "content-type": "application/json",
-          "www-authenticate": `Bearer error="invalid_token"`
-        }
-      });
+      const error = res.error;
+      const scheme = auth.scheme;
+      const wireError = error.code === "invalid_dpop_proof" ? "invalid_dpop_proof" : "invalid_token";
+      return wwwAuthenticateResponse(scheme, wireError, error.description, 401);
     }
     return new Response(JSON.stringify(res.value), {
       status: 200,
@@ -43,11 +37,23 @@ function makeUserinfoHandler(deps) {
     });
   };
 }
-function extractBearer(header) {
+function extractAuthorization(header) {
   if (!header)
     return null;
-  const m = /^Bearer\s+(.+)$/i.exec(header);
-  return m?.[1] ?? null;
+  const m = /^(Bearer|DPoP)\s+(.+)$/i.exec(header);
+  if (!m || !m[1] || !m[2])
+    return null;
+  const scheme = m[1].toLowerCase() === "dpop" ? "DPoP" : "Bearer";
+  return { scheme, token: m[2] };
+}
+function wwwAuthenticateResponse(scheme, error, description, status) {
+  return new Response(JSON.stringify({ error, error_description: description }), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "www-authenticate": `${scheme} error="${error}"`
+    }
+  });
 }
 export {
   makeUserinfoHandler

package/dist/esm/http/middleware/tenant.js

@@ -27,12 +27,12 @@ function tenantMiddleware(deps) {
       const recovery = await runCallbackRecovery(c.req.raw, deps);
       c.set("recovery", recovery);
       if (recovery.kind !== "fresh-request") {
-        const cfg2 = await deps.configStore.getTenantConfig(recovery.tenantId);
-        if (isErr(cfg2)) {
-          return tokenEndpointErrorResponse(cfg2.error);
+        const cfg = await deps.configStore.getTenantConfig(recovery.tenantId);
+        if (isErr(cfg)) {
+          return tokenEndpointErrorResponse(cfg.error);
         }
         const customCb = deps.buildCustomContext ? await deps.buildCustomContext(c.req.raw) : {};
-        c.set("tenant", buildTenantContext(c.req.raw, recovery.tenantId, cfg2.value, customCb));
+        c.set("tenant", buildTenantContext(c.req.raw, recovery.tenantId, cfg.value, customCb));
         return next();
       }
     }
@@ -97,6 +97,6 @@ async function extractStateParam(req) {
   }
 }
 export {
-  tenantMiddleware,
-  bootstrapMiddleware
+  bootstrapMiddleware,
+  tenantMiddleware
 };