@absolutejs/auth 0.27.0-beta.1 → 0.27.0-beta.10

package/dist/mfa/rotation.d.ts

@@ -0,0 +1,17 @@
+import type { MFAStore } from './types';
+export type MfaKeyRotationResult = {
+    alreadyRotated: number;
+    rotated: number;
+    skippedNoSecret: number;
+    total: number;
+};
+export declare const rotateMfaEncryptionKey: ({ mfaStore, newKey, oldKey }: {
+    mfaStore: MFAStore;
+    newKey: string;
+    oldKey: string;
+}) => Promise<{
+    alreadyRotated: number;
+    rotated: number;
+    skippedNoSecret: number;
+    total: number;
+}>;

package/dist/mfa/types.d.ts

@@ -10,6 +10,7 @@ export type MfaEnrollment = {
 };
 export type MFAStore = {
     getEnrollment: (userId: string) => Promise<MfaEnrollment | undefined>;
+    listEnrollments: () => Promise<MfaEnrollment[]>;
     removeEnrollment: (userId: string) => Promise<void>;
     saveEnrollment: (enrollment: MfaEnrollment) => Promise<void>;
 };

package/dist/oidc/config.d.ts

@@ -0,0 +1,71 @@
+import type { RouteString } from '../types';
+import { type SigningKey } from './keys';
+import type { AuthorizationCodeStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
+export declare const DEFAULT_OIDC_ROUTE: RouteString;
+export type OidcProviderConfig<UserType> = {
+    accessTokenTtlMs?: number;
+    authorizationCodeStore: AuthorizationCodeStore;
+    clientStore: OAuthClientStore;
+    getClaims?: (user: UserType) => Record<string, unknown>;
+    getGrantedScopes?: (context: {
+        client: {
+            clientId: string;
+            name: string;
+        };
+        requestedScopes: string[];
+        user: UserType;
+    }) => string[] | undefined | Promise<string[] | undefined>;
+    getUserId: (user: UserType) => string;
+    idTokenTtlMs?: number;
+    issuer: string;
+    loginUrl?: string;
+    oidcRoute?: RouteString;
+    refreshTokenStore: OidcRefreshTokenStore;
+    refreshTokenTtlMs?: number;
+    signingKey: SigningKey;
+};
+export type TokenExchangeResult = {
+    error: 'invalid_grant' | 'invalid_scope';
+    ok: false;
+} | {
+    accessToken: string;
+    expiresIn: number;
+    ok: true;
+    scope: string;
+};
+export declare const exchangeToken: <UserType>({ actorClientId, audience, config, dpopJkt, now, requestedScopes, subjectToken }: {
+    actorClientId: string;
+    audience?: string;
+    config: OidcProviderConfig<UserType>;
+    dpopJkt?: string;
+    now?: number;
+    requestedScopes?: string[];
+    subjectToken: string;
+}) => Promise<TokenExchangeResult>;
+export declare const issueTokenSet: <UserType>({ claims, clientId, config, dpopJkt, nonce, now, scopes, sub }: {
+    claims?: Record<string, unknown>;
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    dpopJkt?: string;
+    nonce?: string;
+    now?: number;
+    scopes: string[];
+    sub: string;
+}) => Promise<{
+    access_token: string;
+    expires_in: number;
+    id_token: string;
+    refresh_token: string;
+    scope: string;
+    token_type: string;
+}>;
+export declare const mcpProtectedResourceMetadata: ({ issuer, resource, scopes }: {
+    issuer: string;
+    resource: string;
+    scopes?: string[];
+}) => {
+    authorization_servers: string[];
+    resource: string;
+    scopes_supported: string[];
+};
+export declare const verifyPkce: (codeVerifier: string, codeChallenge: string) => Promise<boolean>;

package/dist/oidc/dpop.d.ts

@@ -0,0 +1,12 @@
+export type DpopResult = {
+    jkt: string;
+    jti?: string;
+};
+export declare const verifyDpopProof: ({ htm, htu, isUsedJti, maxAgeMs, now, proof }: {
+    htm: string;
+    htu: string;
+    isUsedJti?: (jti: string) => boolean | Promise<boolean>;
+    maxAgeMs?: number;
+    now?: number;
+    proof: string | undefined;
+}) => Promise<DpopResult | undefined>;

package/dist/oidc/inMemoryStores.d.ts

@@ -0,0 +1,4 @@
+import type { AuthorizationCodeStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore } from './types';
+export declare const createInMemoryAuthorizationCodeStore: () => AuthorizationCodeStore;
+export declare const createInMemoryOAuthClientStore: (clients: OAuthClient[]) => OAuthClientStore;
+export declare const createInMemoryOidcRefreshTokenStore: () => OidcRefreshTokenStore;

package/dist/oidc/keys.d.ts

@@ -0,0 +1,21 @@
+export type SigningKey = {
+    kid: string;
+    privateJwk: JsonWebKey;
+    publicJwk: JsonWebKey;
+};
+export declare const generateSigningKey: () => Promise<SigningKey>;
+export declare const jwkThumbprint: (jwk: JsonWebKey) => Promise<string>;
+export declare const signJwt: (payload: Record<string, unknown>, signing: SigningKey) => Promise<string>;
+export declare const toPublicJwk: (key: SigningKey) => {
+    alg: string;
+    crv: string | undefined;
+    kid: string;
+    kty: string | undefined;
+    use: string;
+    x: string | undefined;
+    y: string | undefined;
+};
+export declare const verifyJwt: (token: string, publicJwk: JsonWebKey) => Promise<{
+    header: any;
+    payload: any;
+} | undefined>;