@absolutejs/auth 0.29.0-beta.2 → 0.29.0-beta.3

package/dist/index.js

@@ -4727,11 +4727,218 @@ var fanOutBackchannelLogout = async ({
   return reachable.map(({ client }) => client.clientId);
 };
 
+// src/oidc/registration.ts
+var REG_TOKEN_BYTES = 32;
+var CLIENT_ID_BYTES = 16;
+var mintRegistrationToken = async (clientId) => {
+  const plain = generateSecureToken(REG_TOKEN_BYTES);
+  return {
+    plain,
+    record: {
+      clientId,
+      createdAt: Date.now(),
+      tokenHash: await hashToken(plain)
+    }
+  };
+};
+var metadataToClient = (clientId, metadata, transform) => {
+  const requestedScopes = metadata.scope === undefined || metadata.scope.length === 0 ? [] : metadata.scope.split(" ").filter((entry) => entry.length > 0);
+  const base = {
+    backchannelLogoutUri: metadata.backchannel_logout_uri,
+    clientId,
+    jwks: metadata.jwks,
+    jwksUri: metadata.jwks_uri,
+    name: metadata.client_name ?? clientId,
+    postLogoutRedirectUris: metadata.post_logout_redirect_uris,
+    redirectUris: metadata.redirect_uris ?? [],
+    scopes: requestedScopes
+  };
+  return { ...base, ...transform, clientId };
+};
+var clientToMetadata = (client) => ({
+  backchannel_logout_uri: client.backchannelLogoutUri,
+  client_id: client.clientId,
+  client_name: client.name,
+  jwks: client.jwks,
+  jwks_uri: client.jwksUri,
+  post_logout_redirect_uris: client.postLogoutRedirectUris,
+  redirect_uris: client.redirectUris,
+  scope: client.scopes.join(" ")
+});
+var readRegistrationAccessToken = (authorization) => {
+  const prefix = "Bearer ";
+  if (authorization === undefined || !authorization.startsWith(prefix)) {
+    return;
+  }
+  return authorization.slice(prefix.length).trim();
+};
+var authorizeManagement = async ({
+  authorization,
+  clientId,
+  registrationTokenStore
+}) => {
+  const presented = readRegistrationAccessToken(authorization);
+  if (presented === undefined)
+    return false;
+  const record = await registrationTokenStore.findByTokenHash(await hashToken(presented));
+  return record?.clientId === clientId;
+};
+var deleteRegisteredClient = async ({
+  authorization,
+  clientId,
+  clientStore,
+  registrationTokenStore
+}) => {
+  if (clientStore.deleteClient === undefined) {
+    return {
+      body: { error: "unsupported_response_type" },
+      status: 501
+    };
+  }
+  const authed = await authorizeManagement({
+    authorization,
+    clientId,
+    registrationTokenStore
+  });
+  if (!authed)
+    return { body: { error: "invalid_token" }, status: 401 };
+  await clientStore.deleteClient(clientId);
+  await registrationTokenStore.deleteByClientId(clientId);
+  return { status: 204 };
+};
+var getRegisteredClient = async ({
+  authorization,
+  clientId,
+  clientStore,
+  registrationTokenStore
+}) => {
+  const authed = await authorizeManagement({
+    authorization,
+    clientId,
+    registrationTokenStore
+  });
+  if (!authed)
+    return { body: { error: "invalid_token" }, status: 401 };
+  const client = await clientStore.findClient(clientId);
+  if (client === undefined) {
+    return { body: { error: "invalid_client" }, status: 404 };
+  }
+  return { body: clientToMetadata(client), status: 200 };
+};
+var registerClient = async ({
+  clientStore,
+  initialAccessTokenStore,
+  metadata,
+  onClientRegistration,
+  presentedInitialAccessToken,
+  registrationBaseUrl,
+  registrationTokenStore
+}) => {
+  if (clientStore.saveClient === undefined || clientStore.findClient === undefined) {
+    return {
+      body: { error: "unsupported_response_type" },
+      ok: false,
+      status: 501
+    };
+  }
+  if (initialAccessTokenStore !== undefined) {
+    if (presentedInitialAccessToken === undefined) {
+      return { body: { error: "invalid_token" }, ok: false, status: 401 };
+    }
+    const consumed = await initialAccessTokenStore.consumeToken(await hashToken(presentedInitialAccessToken));
+    if (!consumed) {
+      return { body: { error: "invalid_token" }, ok: false, status: 401 };
+    }
+  }
+  if (!Array.isArray(metadata.redirect_uris) || metadata.redirect_uris.length === 0) {
+    return {
+      body: { error: "invalid_redirect_uri" },
+      ok: false,
+      status: 400
+    };
+  }
+  const decision = await onClientRegistration?.({ metadata }) ?? { allow: true };
+  if (!decision.allow) {
+    return {
+      body: {
+        error: "invalid_client_metadata",
+        error_description: decision.denyReason
+      },
+      ok: false,
+      status: 403
+    };
+  }
+  const clientId = generateSecureToken(CLIENT_ID_BYTES);
+  const client = metadataToClient(clientId, metadata, decision.transform);
+  await clientStore.saveClient(client);
+  const regToken = await mintRegistrationToken(clientId);
+  await registrationTokenStore.saveToken(regToken.record);
+  return {
+    body: {
+      ...clientToMetadata(client),
+      registration_access_token: regToken.plain,
+      registration_client_uri: `${registrationBaseUrl}/${clientId}`
+    },
+    ok: true
+  };
+};
+var updateRegisteredClient = async ({
+  authorization,
+  clientId,
+  clientStore,
+  metadata,
+  onClientRegistration,
+  registrationTokenStore
+}) => {
+  if (clientStore.updateClient === undefined) {
+    return {
+      body: { error: "unsupported_response_type" },
+      status: 501
+    };
+  }
+  const authed = await authorizeManagement({
+    authorization,
+    clientId,
+    registrationTokenStore
+  });
+  if (!authed)
+    return { body: { error: "invalid_token" }, status: 401 };
+  const decision = await onClientRegistration?.({ metadata }) ?? { allow: true };
+  if (!decision.allow) {
+    return {
+      body: {
+        error: "invalid_client_metadata",
+        error_description: decision.denyReason
+      },
+      status: 403
+    };
+  }
+  if (!Array.isArray(metadata.redirect_uris) || metadata.redirect_uris.length === 0) {
+    return {
+      body: { error: "invalid_redirect_uri" },
+      status: 400
+    };
+  }
+  const updated = metadataToClient(clientId, metadata, decision.transform);
+  await clientStore.updateClient(clientId, updated);
+  const rotated = await mintRegistrationToken(clientId);
+  await registrationTokenStore.saveToken(rotated.record);
+  return {
+    body: {
+      ...clientToMetadata(updated),
+      registration_access_token: rotated.plain
+    },
+    status: 200
+  };
+};
+
 // src/oidc/routes.ts
 var HTTP_OK2 = 200;
+var HTTP_NO_CONTENT = 204;
+var HTTP_FOUND = 302;
 var HTTP_BAD_REQUEST2 = 400;
 var HTTP_UNAUTHORIZED2 = 401;
-var HTTP_FOUND = 302;
+var HTTP_NOT_IMPLEMENTED = 501;
 var CODE_TTL_MINUTES = 10;
 var CODE_TTL_MS = MILLISECONDS_IN_A_MINUTE * CODE_TTL_MINUTES;
 var TOKEN_BYTES3 = 32;
@@ -4781,6 +4988,8 @@ var oidcProviderRoutes = (config) => {
   const deviceAuthorizationRoute = `${oidcRoute}/device_authorization`;
   const deviceApproveRoute = `${oidcRoute}/device/decision`;
   const endSessionRoute = `${oidcRoute}/end_session`;
+  const registrationRoute = `${oidcRoute}/register`;
+  const registrationBaseUrl = `${issuer}${registrationRoute}`;
   const tokenUrl = `${issuer}${oidcRoute}/token`;
   const authenticateClient = async (clientId, clientSecret) => {
     const client = await clientStore.findClient(clientId);
@@ -4971,6 +5180,9 @@ var oidcProviderRoutes = (config) => {
   if (config.deviceAuthorizationStore) {
     discovery.device_authorization_endpoint = `${issuer}${deviceAuthorizationRoute}`;
   }
+  if (config.clientRegistrationTokenStore !== undefined) {
+    discovery.registration_endpoint = registrationBaseUrl;
+  }
   const handleEndSession = async ({
     cookie,
     inMemorySession,
@@ -5284,6 +5496,96 @@ var oidcProviderRoutes = (config) => {
     cookie: t12.Cookie({
       user_session_id: t12.Optional(userSessionIdTypebox)
     })
+  }).post(registrationRoute, async ({ body, headers }) => {
+    if (config.clientRegistrationTokenStore === undefined) {
+      return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
+    }
+    const presented = headers.authorization?.startsWith("Bearer ") ? headers.authorization.slice("Bearer ".length).trim() : undefined;
+    const result = await registerClient({
+      clientStore,
+      initialAccessTokenStore: config.initialAccessTokenStore,
+      metadata: body,
+      onClientRegistration: config.onClientRegistration,
+      presentedInitialAccessToken: presented,
+      registrationBaseUrl,
+      registrationTokenStore: config.clientRegistrationTokenStore
+    });
+    return jsonResponse(result.body, result.ok ? HTTP_OK2 : result.status);
+  }, {
+    body: t12.Object({
+      backchannel_logout_uri: t12.Optional(t12.String()),
+      client_name: t12.Optional(t12.String()),
+      jwks: t12.Optional(t12.Any()),
+      jwks_uri: t12.Optional(t12.String()),
+      post_logout_redirect_uris: t12.Optional(t12.Array(t12.String())),
+      redirect_uris: t12.Optional(t12.Array(t12.String())),
+      scope: t12.Optional(t12.String())
+    }),
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    })
+  }).get(`${registrationRoute}/:clientId`, async ({ headers, params: { clientId } }) => {
+    if (config.clientRegistrationTokenStore === undefined) {
+      return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
+    }
+    const result = await getRegisteredClient({
+      authorization: headers.authorization,
+      clientId,
+      clientStore,
+      registrationTokenStore: config.clientRegistrationTokenStore
+    });
+    return jsonResponse(result.body, result.status);
+  }, {
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    }),
+    params: t12.Object({ clientId: t12.String() })
+  }).put(`${registrationRoute}/:clientId`, async ({ body, headers, params: { clientId } }) => {
+    if (config.clientRegistrationTokenStore === undefined) {
+      return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
+    }
+    const result = await updateRegisteredClient({
+      authorization: headers.authorization,
+      clientId,
+      clientStore,
+      metadata: body,
+      onClientRegistration: config.onClientRegistration,
+      registrationTokenStore: config.clientRegistrationTokenStore
+    });
+    return jsonResponse(result.body, result.status);
+  }, {
+    body: t12.Object({
+      backchannel_logout_uri: t12.Optional(t12.String()),
+      client_name: t12.Optional(t12.String()),
+      jwks: t12.Optional(t12.Any()),
+      jwks_uri: t12.Optional(t12.String()),
+      post_logout_redirect_uris: t12.Optional(t12.Array(t12.String())),
+      redirect_uris: t12.Optional(t12.Array(t12.String())),
+      scope: t12.Optional(t12.String())
+    }),
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    }),
+    params: t12.Object({ clientId: t12.String() })
+  }).delete(`${registrationRoute}/:clientId`, async ({ headers, params: { clientId } }) => {
+    if (config.clientRegistrationTokenStore === undefined) {
+      return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
+    }
+    const result = await deleteRegisteredClient({
+      authorization: headers.authorization,
+      clientId,
+      clientStore,
+      registrationTokenStore: config.clientRegistrationTokenStore
+    });
+    if (result.status === HTTP_NO_CONTENT) {
+      return new Response(null, { status: HTTP_NO_CONTENT });
+    }
+    return jsonResponse(result.body, result.status);
+  }, {
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    }),
+    params: t12.Object({ clientId: t12.String() })
   }).get(jwksRoute, () => ({ keys: [toPublicJwk(signingKey)] })).get("/.well-known/openid-configuration", () => discovery);
 };
 
@@ -20493,10 +20795,49 @@ var createInMemoryLogoutDeliveryStore = () => {
     }
   };
 };
+var createInMemoryClientRegistrationTokenStore = () => {
+  const byHash = new Map;
+  return {
+    deleteByClientId: async (clientId) => {
+      for (const [hash, token] of byHash) {
+        if (token.clientId === clientId)
+          byHash.delete(hash);
+      }
+    },
+    findByTokenHash: async (tokenHash) => byHash.get(tokenHash),
+    saveToken: async (token) => {
+      for (const [hash, existing] of byHash) {
+        if (existing.clientId === token.clientId)
+          byHash.delete(hash);
+      }
+      byHash.set(token.tokenHash, { ...token });
+    }
+  };
+};
+var createInMemoryInitialAccessTokenStore = (initialHashes = []) => {
+  const remaining = new Set(initialHashes);
+  return {
+    consumeToken: async (tokenHash) => {
+      if (!remaining.has(tokenHash))
+        return false;
+      remaining.delete(tokenHash);
+      return true;
+    }
+  };
+};
 var createInMemoryOAuthClientStore = (clients) => {
   const registry = new Map(clients.map((client) => [client.clientId, client]));
   return {
-    findClient: async (clientId) => registry.get(clientId)
+    deleteClient: async (clientId) => {
+      registry.delete(clientId);
+    },
+    findClient: async (clientId) => registry.get(clientId),
+    saveClient: async (client) => {
+      registry.set(client.clientId, { ...client });
+    },
+    updateClient: async (clientId, client) => {
+      registry.set(clientId, { ...client });
+    }
   };
 };
 var createInMemoryOidcRefreshTokenStore = () => {
@@ -20536,6 +20877,11 @@ var oauthClientAssertionJtisTable = pgTable("auth_oauth_client_assertion_jtis",
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   jti: varchar("jti", { length: ID_LENGTH7 }).notNull()
 });
+var oauthClientRegistrationTokensTable = pgTable("auth_oauth_client_registration_tokens", {
+  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  token_hash: varchar("token_hash", { length: ID_LENGTH7 }).primaryKey()
+});
 var oauthClientsTable = pgTable("auth_oauth_clients", {
   backchannel_logout_uri: varchar("backchannel_logout_uri", {
     length: URL_LENGTH
@@ -20575,6 +20921,9 @@ var oauthDeviceAuthorizationsTable = pgTable("auth_oauth_device_authorizations",
   user_code: varchar("user_code", { length: 16 }).notNull().unique(),
   user_sub: varchar("user_sub", { length: ID_LENGTH7 })
 });
+var oauthInitialAccessTokensTable = pgTable("auth_oauth_initial_access_tokens", {
+  token_hash: varchar("token_hash", { length: ID_LENGTH7 }).primaryKey()
+});
 var oauthLogoutDeliveriesTable = pgTable("auth_oauth_logout_deliveries", {
   attempts: bigint("attempts", { mode: "number" }).notNull(),
   client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
@@ -20677,7 +21026,9 @@ var toRefreshValues = (token) => ({
 });
 var createNeonAuthorizationCodeStore = (databaseUrl) => createPostgresAuthorizationCodeStore(createNeonDatabase(databaseUrl));
 var createNeonClientAssertionJtiStore = (databaseUrl) => createPostgresClientAssertionJtiStore(createNeonDatabase(databaseUrl));
+var createNeonClientRegistrationTokenStore = (databaseUrl) => createPostgresClientRegistrationTokenStore(createNeonDatabase(databaseUrl));
 var createNeonDeviceAuthorizationStore = (databaseUrl) => createPostgresDeviceAuthorizationStore(createNeonDatabase(databaseUrl));
+var createNeonInitialAccessTokenStore = (databaseUrl) => createPostgresInitialAccessTokenStore(createNeonDatabase(databaseUrl));
 var createNeonLogoutDeliveryStore = (databaseUrl) => createPostgresLogoutDeliveryStore(createNeonDatabase(databaseUrl));
 var createNeonOAuthClientStore = (databaseUrl) => createPostgresOAuthClientStore(createNeonDatabase(databaseUrl));
 var createNeonOidcRefreshTokenStore = (databaseUrl) => createPostgresOidcRefreshTokenStore(createNeonDatabase(databaseUrl));
@@ -20707,6 +21058,30 @@ var createPostgresClientAssertionJtiStore = (db) => ({
     }
   }
 });
+var createPostgresClientRegistrationTokenStore = (db) => ({
+  deleteByClientId: async (clientId) => {
+    await db.delete(oauthClientRegistrationTokensTable).where(eq(oauthClientRegistrationTokensTable.client_id, clientId));
+  },
+  findByTokenHash: async (tokenHash) => {
+    const [row] = await db.select().from(oauthClientRegistrationTokensTable).where(eq(oauthClientRegistrationTokensTable.token_hash, tokenHash)).limit(1);
+    if (!row)
+      return;
+    const token = {
+      clientId: row.client_id,
+      createdAt: row.created_at_ms,
+      tokenHash: row.token_hash
+    };
+    return token;
+  },
+  saveToken: async (token) => {
+    await db.delete(oauthClientRegistrationTokensTable).where(eq(oauthClientRegistrationTokensTable.client_id, token.clientId));
+    await db.insert(oauthClientRegistrationTokensTable).values({
+      client_id: token.clientId,
+      created_at_ms: token.createdAt,
+      token_hash: token.tokenHash
+    });
+  }
+});
 var createPostgresDeviceAuthorizationStore = (db) => ({
   deleteByDeviceCodeHash: async (deviceCodeHash) => {
     await db.delete(oauthDeviceAuthorizationsTable).where(eq(oauthDeviceAuthorizationsTable.device_code_hash, deviceCodeHash));
@@ -20736,6 +21111,12 @@ var createPostgresDeviceAuthorizationStore = (db) => ({
     await db.update(oauthDeviceAuthorizationsTable).set({ status, user_sub: userSub ?? null }).where(eq(oauthDeviceAuthorizationsTable.device_code_hash, deviceCodeHash));
   }
 });
+var createPostgresInitialAccessTokenStore = (db) => ({
+  consumeToken: async (tokenHash) => {
+    const deleted = await db.delete(oauthInitialAccessTokensTable).where(eq(oauthInitialAccessTokensTable.token_hash, tokenHash)).returning({ token_hash: oauthInitialAccessTokensTable.token_hash });
+    return deleted.length > 0;
+  }
+});
 var createPostgresLogoutDeliveryStore = (db) => ({
   listFailed: async (limit = DEFAULT_LIST_LIMIT2) => {
     const rows = await db.select().from(oauthLogoutDeliveriesTable).orderBy(desc(oauthLogoutDeliveriesTable.created_at_ms)).limit(limit);
@@ -20758,10 +21139,30 @@ var createPostgresLogoutDeliveryStore = (db) => ({
     await db.delete(oauthLogoutDeliveriesTable).where(eq(oauthLogoutDeliveriesTable.id, deliveryId));
   }
 });
+var toClientValues2 = (client) => ({
+  backchannel_logout_uri: client.backchannelLogoutUri ?? null,
+  client_id: client.clientId,
+  hashed_secret: client.hashedSecret ?? null,
+  jwks_json: client.jwks ?? null,
+  jwks_uri: client.jwksUri ?? null,
+  name: client.name,
+  post_logout_redirect_uris: client.postLogoutRedirectUris ?? null,
+  redirect_uris: client.redirectUris,
+  scopes: client.scopes
+});
 var createPostgresOAuthClientStore = (db) => ({
+  deleteClient: async (clientId) => {
+    await db.delete(oauthClientsTable).where(eq(oauthClientsTable.client_id, clientId));
+  },
   findClient: async (clientId) => {
     const [row] = await db.select().from(oauthClientsTable).where(eq(oauthClientsTable.client_id, clientId)).limit(1);
     return row ? toClient2(row) : undefined;
+  },
+  saveClient: async (client) => {
+    await db.insert(oauthClientsTable).values(toClientValues2(client));
+  },
+  updateClient: async (clientId, client) => {
+    await db.update(oauthClientsTable).set(toClientValues2(client)).where(eq(oauthClientsTable.client_id, clientId));
   }
 });
 var createPostgresOidcRefreshTokenStore = (db) => ({
@@ -22215,6 +22616,7 @@ export {
   validateSession,
   validateEmailDeliverability,
   userSessionIdTypebox,
+  updateRegisteredClient,
   trustDevice,
   toPublicJwk,
   switchActiveSession,
@@ -22252,6 +22654,7 @@ export {
   resolveAuthHtmxRenderers,
   resolveApiPrincipal,
   removeFromSessionRing,
+  registerClient,
   refreshableProviderOptions,
   recordLoginAttempt,
   readSessionRing,
@@ -22273,9 +22676,11 @@ export {
   oidcProviderOptions,
   oauthRefreshTokensTable,
   oauthLogoutDeliveriesTable,
+  oauthInitialAccessTokensTable,
   oauthDeviceAuthorizationsTable,
   oauthCodesTable,
   oauthClientsTable,
+  oauthClientRegistrationTokensTable,
   oauthClientAssertionJtisTable,
   mintLogoutToken,
   mfaTotpRoutes,
@@ -22319,6 +22724,7 @@ export {
   hasOrganizationScope,
   getUserSessionId,
   getStatus,
+  getRegisteredClient,
   generateTotpSecret,
   generateTotp,
   generateSigningKey,
@@ -22338,6 +22744,7 @@ export {
   encryptSecret,
   denyDeviceAuthorization,
   deleteWarrant,
+  deleteRegisteredClient,
   defineProvidersConfiguration,
   defineAuthSettings,
   defineAuthHtmxConfig,
@@ -22382,8 +22789,10 @@ export {
   createPostgresLoginHistoryStore,
   createPostgresLockoutStore,
   createPostgresKnownDeviceStore,
+  createPostgresInitialAccessTokenStore,
   createPostgresDeviceAuthorizationStore,
   createPostgresCredentialStore,
+  createPostgresClientRegistrationTokenStore,
   createPostgresClientAssertionJtiStore,
   createPostgresAuthorizationCodeStore,
   createPostgresAuditSink,
@@ -22411,9 +22820,11 @@ export {
   createNeonLockoutStore,
   createNeonLinkedProviderStores,
   createNeonKnownDeviceStore,
+  createNeonInitialAccessTokenStore,
   createNeonDeviceAuthorizationStore,
   createNeonDatabase,
   createNeonCredentialStore,
+  createNeonClientRegistrationTokenStore,
   createNeonClientAssertionJtiStore,
   createNeonAuthorizationCodeStore,
   createNeonAuthSessionStore,
@@ -22443,8 +22854,10 @@ export {
   createInMemoryLockoutStore,
   createInMemoryLinkedProviderStores,
   createInMemoryKnownDeviceStore,
+  createInMemoryInitialAccessTokenStore,
   createInMemoryDeviceAuthorizationStore,
   createInMemoryCredentialStore,
+  createInMemoryClientRegistrationTokenStore,
   createInMemoryClientAssertionJtiStore,
   createInMemoryCheckCache,
   createInMemoryAuthorizationCodeStore,
@@ -22515,5 +22928,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=A9BAB004D30595D664756E2164756E21
+//# debugId=670CF7C3F8CEA35064756E2164756E21
 //# sourceMappingURL=index.js.map