@absolutejs/auth 0.29.0-beta.1 → 0.29.0-beta.2

package/dist/index.d.ts

@@ -13488,6 +13488,8 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
                 grant_type?: string | undefined;
                 code?: string | undefined;
                 redirect_uri?: string | undefined;
+                client_assertion?: string | undefined;
+                client_assertion_type?: string | undefined;
                 code_verifier?: string | undefined;
                 subject_token?: string | undefined;
                 subject_token_type?: string | undefined;
@@ -14900,9 +14902,10 @@ export { generateSigningKey, jwkThumbprint, signJwt, toPublicJwk, verifyJwt } fr
 export type { SigningKey } from './oidc/keys';
 export { verifyDpopProof } from './oidc/dpop';
 export type { DpopResult } from './oidc/dpop';
-export { createInMemoryAuthorizationCodeStore, createInMemoryDeviceAuthorizationStore, createInMemoryLogoutDeliveryStore, createInMemoryOAuthClientStore, createInMemoryOidcRefreshTokenStore } from './oidc/inMemoryStores';
+export { CLIENT_ASSERTION_TYPE, verifyClientAssertion } from './oidc/clientAuth';
+export { createInMemoryAuthorizationCodeStore, createInMemoryClientAssertionJtiStore, createInMemoryDeviceAuthorizationStore, createInMemoryLogoutDeliveryStore, createInMemoryOAuthClientStore, createInMemoryOidcRefreshTokenStore } from './oidc/inMemoryStores';
 export { fanOutBackchannelLogout, mintLogoutToken, resolvePostLogoutRedirect, verifyIdTokenHint } from './oidc/logout';
-export { createNeonAuthorizationCodeStore, createNeonDeviceAuthorizationStore, createNeonLogoutDeliveryStore, createNeonOAuthClientStore, createNeonOidcRefreshTokenStore, createPostgresAuthorizationCodeStore, createPostgresDeviceAuthorizationStore, createPostgresLogoutDeliveryStore, createPostgresOAuthClientStore, createPostgresOidcRefreshTokenStore, oauthClientsTable, oauthCodesTable, oauthDeviceAuthorizationsTable, oauthLogoutDeliveriesTable, oauthRefreshTokensTable } from './oidc/postgresStores';
+export { createNeonAuthorizationCodeStore, createNeonClientAssertionJtiStore, createNeonDeviceAuthorizationStore, createNeonLogoutDeliveryStore, createNeonOAuthClientStore, createNeonOidcRefreshTokenStore, createPostgresAuthorizationCodeStore, createPostgresClientAssertionJtiStore, createPostgresDeviceAuthorizationStore, createPostgresLogoutDeliveryStore, createPostgresOAuthClientStore, createPostgresOidcRefreshTokenStore, oauthClientAssertionJtisTable, oauthClientsTable, oauthCodesTable, oauthDeviceAuthorizationsTable, oauthLogoutDeliveriesTable, oauthRefreshTokensTable } from './oidc/postgresStores';
 export * from './adaptive/config';
 export * from './adaptive/fingerprint';
 export * from './adaptive/types';

package/dist/index.js

@@ -4452,6 +4452,105 @@ var exchangeDeviceCode = async ({
   return { ...tokenSet, ok: true };
 };
 
+// src/oidc/clientAuth.ts
+var CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+var MAX_ASSERTION_LIFETIME_MINUTES = 5;
+var SECONDS_PER_MINUTE = 60;
+var MAX_ASSERTION_LIFETIME_MS = MAX_ASSERTION_LIFETIME_MINUTES * SECONDS_PER_MINUTE * MILLISECONDS_IN_A_SECOND;
+var jwksCache = new Map;
+var JWKS_CACHE_TTL_MS = SECONDS_PER_MINUTE * MILLISECONDS_IN_A_SECOND;
+var JWKS_FETCH_TIMEOUT_SECONDS = 5;
+var JWKS_FETCH_TIMEOUT_MS = JWKS_FETCH_TIMEOUT_SECONDS * MILLISECONDS_IN_A_SECOND;
+var fetchJwksUri = async (jwksUri) => {
+  const cached = jwksCache.get(jwksUri);
+  if (cached && Date.now() - cached.fetchedAt < JWKS_CACHE_TTL_MS) {
+    return cached.jwks;
+  }
+  try {
+    const response = await fetch(jwksUri, {
+      signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS)
+    });
+    if (!response.ok)
+      return;
+    const body = await response.json();
+    if (!Array.isArray(body.keys))
+      return;
+    jwksCache.set(jwksUri, { fetchedAt: Date.now(), jwks: body.keys });
+    return body.keys;
+  } catch {
+    return;
+  }
+};
+var resolveClientJwks = async (client) => {
+  if (client.jwks && client.jwks.length > 0)
+    return client.jwks;
+  if (client.jwksUri !== undefined)
+    return fetchJwksUri(client.jwksUri);
+  return;
+};
+var verifyAgainstAny = async (assertion, candidates) => {
+  for (const jwk of candidates) {
+    const verified = await verifyJwt(assertion, jwk);
+    if (verified !== undefined)
+      return verified;
+  }
+  return;
+};
+var verifyClientAssertion = async ({
+  assertion,
+  expectedAudience,
+  jtiStore,
+  resolveClient
+}) => {
+  const [, payloadSegment] = assertion.split(".");
+  if (payloadSegment === undefined)
+    return;
+  let payload;
+  try {
+    const parsed = JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf8"));
+    if (typeof parsed !== "object" || parsed === null)
+      return;
+    payload = parsed;
+  } catch {
+    return;
+  }
+  const {
+    aud,
+    exp,
+    iss,
+    jti,
+    sub
+  } = payload;
+  if (typeof iss !== "string" || typeof sub !== "string" || iss !== sub || typeof exp !== "number") {
+    return;
+  }
+  const audMatches = typeof aud === "string" && aud === expectedAudience || Array.isArray(aud) && aud.includes(expectedAudience);
+  if (!audMatches)
+    return;
+  const expMs = exp * MILLISECONDS_IN_A_SECOND;
+  const now = Date.now();
+  if (expMs <= now || expMs - now > MAX_ASSERTION_LIFETIME_MS) {
+    return;
+  }
+  const client = await resolveClient(iss);
+  if (client === undefined)
+    return;
+  const candidates = await resolveClientJwks(client);
+  if (candidates === undefined || candidates.length === 0)
+    return;
+  const verified = await verifyAgainstAny(assertion, candidates);
+  if (verified === undefined)
+    return;
+  if (jtiStore !== undefined) {
+    if (typeof jti !== "string")
+      return;
+    const fresh = await jtiStore.recordIfFresh(client.clientId, jti, expMs);
+    if (!fresh)
+      return;
+  }
+  return client;
+};
+
 // src/oidc/dpop.ts
 var DEFAULT_MAX_AGE_MS = 60000;
 var SECONDS_TO_MS = 1000;
@@ -4694,6 +4793,28 @@ var oidcProviderRoutes = (config) => {
     const matches = await constantTimeEqual(await hashToken(clientSecret), client.hashedSecret);
     return matches ? client : undefined;
   };
+  const authenticateTokenClient = async ({
+    basicClientId,
+    basicClientSecret,
+    bodyClientAssertion,
+    bodyClientAssertionType,
+    bodyClientId,
+    bodyClientSecret
+  }) => {
+    if (bodyClientAssertion !== undefined && bodyClientAssertionType === CLIENT_ASSERTION_TYPE) {
+      return verifyClientAssertion({
+        assertion: bodyClientAssertion,
+        expectedAudience: tokenUrl,
+        jtiStore: config.clientAssertionJtiStore,
+        resolveClient: clientStore.findClient
+      });
+    }
+    const clientId = bodyClientId ?? basicClientId;
+    const clientSecret = bodyClientSecret ?? basicClientSecret;
+    if (clientId === undefined)
+      return;
+    return authenticateClient(clientId, clientSecret);
+  };
   const grantAuthorizationCode = async (client, body, dpop) => {
     const {
       code,
@@ -4842,8 +4963,10 @@ var oidcProviderRoutes = (config) => {
     token_endpoint_auth_methods_supported: [
       "client_secret_basic",
       "client_secret_post",
-      "none"
-    ]
+      "none",
+      "private_key_jwt"
+    ],
+    token_endpoint_auth_signing_alg_values_supported: ["ES256"]
   };
   if (config.deviceAuthorizationStore) {
     discovery.device_authorization_endpoint = `${issuer}${deviceAuthorizationRoute}`;
@@ -4968,12 +5091,14 @@ var oidcProviderRoutes = (config) => {
     })
   }).post(tokenRoute, async ({ body, headers }) => {
     const basic = readBasicAuth2(headers.authorization);
-    const clientId = basic.clientId ?? body.client_id;
-    const clientSecret = basic.clientSecret ?? body.client_secret;
-    if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
-    }
-    const client = await authenticateClient(clientId, clientSecret);
+    const client = await authenticateTokenClient({
+      basicClientId: basic.clientId,
+      basicClientSecret: basic.clientSecret,
+      bodyClientAssertion: body.client_assertion,
+      bodyClientAssertionType: body.client_assertion_type,
+      bodyClientId: body.client_id,
+      bodyClientSecret: body.client_secret
+    });
     if (client === undefined) {
       return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
     }
@@ -4993,6 +5118,8 @@ var oidcProviderRoutes = (config) => {
   }, {
     body: t12.Object({
       audience: t12.Optional(t12.String()),
+      client_assertion: t12.Optional(t12.String()),
+      client_assertion_type: t12.Optional(t12.String()),
       client_id: t12.Optional(t12.String()),
       client_secret: t12.Optional(t12.String()),
       code: t12.Optional(t12.String()),
@@ -20310,6 +20437,23 @@ var createInMemoryAuthorizationCodeStore = () => {
     }
   };
 };
+var createInMemoryClientAssertionJtiStore = () => {
+  const seen = new Map;
+  return {
+    recordIfFresh: async (clientId, jti, expiresAt) => {
+      const now = Date.now();
+      for (const [key, expiry] of seen) {
+        if (expiry < now)
+          seen.delete(key);
+      }
+      const composite = `${clientId}|${jti}`;
+      if (seen.has(composite))
+        return false;
+      seen.set(composite, expiresAt);
+      return true;
+    }
+  };
+};
 var createInMemoryDeviceAuthorizationStore = () => {
   const byDeviceCode = new Map;
   return {
@@ -20384,12 +20528,22 @@ var createInMemoryOidcRefreshTokenStore = () => {
 var URL_LENGTH = 2048;
 var DEFAULT_LIST_LIMIT2 = 100;
 var ID_LENGTH7 = 255;
+var oauthClientAssertionJtisTable = pgTable("auth_oauth_client_assertion_jtis", {
+  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  composite_key: varchar("composite_key", {
+    length: ID_LENGTH7
+  }).primaryKey(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  jti: varchar("jti", { length: ID_LENGTH7 }).notNull()
+});
 var oauthClientsTable = pgTable("auth_oauth_clients", {
   backchannel_logout_uri: varchar("backchannel_logout_uri", {
     length: URL_LENGTH
   }),
   client_id: varchar("client_id", { length: ID_LENGTH7 }).primaryKey(),
   hashed_secret: varchar("hashed_secret", { length: ID_LENGTH7 }),
+  jwks_json: jsonb("jwks_json").$type(),
+  jwks_uri: varchar("jwks_uri", { length: URL_LENGTH }),
   name: varchar("name", { length: ID_LENGTH7 }).notNull(),
   post_logout_redirect_uris: text("post_logout_redirect_uris").array(),
   redirect_uris: text("redirect_uris").array().notNull(),
@@ -20446,6 +20600,8 @@ var toClient2 = (row) => ({
   backchannelLogoutUri: row.backchannel_logout_uri ?? undefined,
   clientId: row.client_id,
   hashedSecret: row.hashed_secret ?? undefined,
+  jwks: row.jwks_json ?? undefined,
+  jwksUri: row.jwks_uri ?? undefined,
   name: row.name,
   postLogoutRedirectUris: row.post_logout_redirect_uris ?? undefined,
   redirectUris: row.redirect_uris,
@@ -20520,6 +20676,7 @@ var toRefreshValues = (token) => ({
   user_id: token.userId
 });
 var createNeonAuthorizationCodeStore = (databaseUrl) => createPostgresAuthorizationCodeStore(createNeonDatabase(databaseUrl));
+var createNeonClientAssertionJtiStore = (databaseUrl) => createPostgresClientAssertionJtiStore(createNeonDatabase(databaseUrl));
 var createNeonDeviceAuthorizationStore = (databaseUrl) => createPostgresDeviceAuthorizationStore(createNeonDatabase(databaseUrl));
 var createNeonLogoutDeliveryStore = (databaseUrl) => createPostgresLogoutDeliveryStore(createNeonDatabase(databaseUrl));
 var createNeonOAuthClientStore = (databaseUrl) => createPostgresOAuthClientStore(createNeonDatabase(databaseUrl));
@@ -20533,6 +20690,23 @@ var createPostgresAuthorizationCodeStore = (db) => ({
     await db.insert(oauthCodesTable).values(toCodeValues(code));
   }
 });
+var createPostgresClientAssertionJtiStore = (db) => ({
+  recordIfFresh: async (clientId, jti, expiresAt) => {
+    await db.delete(oauthClientAssertionJtisTable).where(lt(oauthClientAssertionJtisTable.expires_at_ms, Date.now()));
+    const compositeKey = `${clientId}|${jti}`;
+    try {
+      await db.insert(oauthClientAssertionJtisTable).values({
+        client_id: clientId,
+        composite_key: compositeKey,
+        expires_at_ms: expiresAt,
+        jti
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+});
 var createPostgresDeviceAuthorizationStore = (db) => ({
   deleteByDeviceCodeHash: async (deviceCodeHash) => {
     await db.delete(oauthDeviceAuthorizationsTable).where(eq(oauthDeviceAuthorizationsTable.device_code_hash, deviceCodeHash));
@@ -22033,6 +22207,7 @@ export {
   verifyIdTokenHint,
   verifyHcaptcha,
   verifyDpopProof,
+  verifyClientAssertion,
   verifyAuditChain,
   verifyApiKey,
   verifyAccessToken,
@@ -22101,6 +22276,7 @@ export {
   oauthDeviceAuthorizationsTable,
   oauthCodesTable,
   oauthClientsTable,
+  oauthClientAssertionJtisTable,
   mintLogoutToken,
   mfaTotpRoutes,
   mfaRoutes,
@@ -22208,6 +22384,7 @@ export {
   createPostgresKnownDeviceStore,
   createPostgresDeviceAuthorizationStore,
   createPostgresCredentialStore,
+  createPostgresClientAssertionJtiStore,
   createPostgresAuthorizationCodeStore,
   createPostgresAuditSink,
   createPostgresApiKeyStore,
@@ -22237,6 +22414,7 @@ export {
   createNeonDeviceAuthorizationStore,
   createNeonDatabase,
   createNeonCredentialStore,
+  createNeonClientAssertionJtiStore,
   createNeonAuthorizationCodeStore,
   createNeonAuthSessionStore,
   createNeonAuditSink,
@@ -22267,6 +22445,7 @@ export {
   createInMemoryKnownDeviceStore,
   createInMemoryDeviceAuthorizationStore,
   createInMemoryCredentialStore,
+  createInMemoryClientAssertionJtiStore,
   createInMemoryCheckCache,
   createInMemoryAuthorizationCodeStore,
   createInMemoryAuthSessionStore,
@@ -22332,8 +22511,9 @@ export {
   DEFAULT_INVITATION_TTL_MS,
   DEFAULT_CREDENTIAL_SESSION_TTL_MS,
   DEFAULT_BACKUP_CODE_COUNT,
+  CLIENT_ASSERTION_TYPE,
   AuthIdentityConflictError
 };
 
-//# debugId=9518CC46948D590564756E2164756E21
+//# debugId=A9BAB004D30595D664756E2164756E21
 //# sourceMappingURL=index.js.map