@absolutejs/auth 0.29.0-beta.4 → 0.29.0

package/dist/oidc/config.d.ts

@@ -1,10 +1,11 @@
 import type { RouteString } from '../types';
 import { type SigningKey } from './keys';
 import type { OnClientRegistration } from './registration';
-import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
 export declare const DEFAULT_OIDC_ROUTE: RouteString;
 export type OidcProviderConfig<UserType> = {
     accessTokenTtlMs?: number;
+    acrValuesSupported?: string[];
     authorizationCodeStore: AuthorizationCodeStore;
     clientAssertionJtiStore?: ClientAssertionJtiStore;
     clientRegistrationTokenStore?: ClientRegistrationTokenStore;
@@ -30,11 +31,20 @@ export type OidcProviderConfig<UserType> = {
     getUserId: (user: UserType) => string;
     idTokenTtlMs?: number;
     issuer: string;
+    dpopNonce?: {
+        secret: string;
+    };
+    getAcr?: (context: {
+        scopes: string[];
+        user: UserType;
+    }) => string | undefined;
     initialAccessTokenStore?: InitialAccessTokenStore;
     loginUrl?: string;
     logoutDeliveryStore?: LogoutDeliveryStore;
     oidcRoute?: RouteString;
     onClientRegistration?: OnClientRegistration;
+    pushedAuthorizationRequestStore?: PushedAuthorizationRequestStore;
+    pushedAuthorizationRequestTtlMs?: number;
     refreshTokenStore: OidcRefreshTokenStore;
     refreshTokenTtlMs?: number;
     signingKey: SigningKey;
@@ -57,7 +67,8 @@ export declare const exchangeToken: <UserType>({ actorClientId, audience, config
     requestedScopes?: string[];
     subjectToken: string;
 }) => Promise<TokenExchangeResult>;
-export declare const issueTokenSet: <UserType>({ claims, clientId, config, dpopJkt, nonce, now, scopes, sub }: {
+export declare const issueTokenSet: <UserType>({ acr, claims, clientId, config, dpopJkt, nonce, now, scopes, sub }: {
+    acr?: string;
     claims?: Record<string, unknown>;
     clientId: string;
     config: OidcProviderConfig<UserType>;

package/dist/oidc/dpop.d.ts

@@ -1,3 +1,13 @@
+export declare const extractDpopNonceClaim: (proof: string) => string | undefined;
+export declare const mintDpopNonce: ({ now, secret }: {
+    now?: number;
+    secret: string;
+}) => Promise<string>;
+export declare const verifyDpopNonce: ({ now, nonce, secret }: {
+    nonce: string;
+    now?: number;
+    secret: string;
+}) => Promise<boolean>;
 export type DpopResult = {
     jkt: string;
     jti?: string;

package/dist/oidc/inMemoryStores.d.ts

@@ -1,9 +1,10 @@
-import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
 export declare const createInMemoryAuthorizationCodeStore: () => AuthorizationCodeStore;
 export declare const createInMemoryClientAssertionJtiStore: () => ClientAssertionJtiStore;
-export declare const createInMemoryDeviceAuthorizationStore: () => DeviceAuthorizationStore;
-export declare const createInMemoryLogoutDeliveryStore: () => LogoutDeliveryStore;
 export declare const createInMemoryClientRegistrationTokenStore: () => ClientRegistrationTokenStore;
+export declare const createInMemoryDeviceAuthorizationStore: () => DeviceAuthorizationStore;
 export declare const createInMemoryInitialAccessTokenStore: (initialHashes?: string[]) => InitialAccessTokenStore;
+export declare const createInMemoryLogoutDeliveryStore: () => LogoutDeliveryStore;
 export declare const createInMemoryOAuthClientStore: (clients: OAuthClient[]) => OAuthClientStore;
 export declare const createInMemoryOidcRefreshTokenStore: () => OidcRefreshTokenStore;
+export declare const createInMemoryPushedAuthorizationRequestStore: () => PushedAuthorizationRequestStore;

package/dist/oidc/par.d.ts

@@ -0,0 +1,28 @@
+import type { OAuthClient, PushedAuthorizationRequestStore } from './types';
+export declare const DEFAULT_PAR_TTL_MS: number;
+export declare const REQUEST_URI_PREFIX = "urn:ietf:params:oauth:request_uri:";
+export type PushAuthorizationResult = {
+    body: {
+        expires_in: number;
+        request_uri: string;
+    };
+    ok: true;
+} | {
+    body: {
+        error: string;
+    };
+    ok: false;
+    status: 400 | 401;
+};
+export declare const consumePushedRequest: ({ clientId, requestUri, store }: {
+    clientId: string;
+    requestUri: string;
+    store: PushedAuthorizationRequestStore;
+}) => Promise<Record<string, string> | undefined>;
+export declare const pushAuthorizationRequest: ({ client, now, params, store, ttlMs }: {
+    client: OAuthClient;
+    now?: number;
+    params: Record<string, string>;
+    store: PushedAuthorizationRequestStore;
+    ttlMs?: number;
+}) => Promise<PushAuthorizationResult>;

package/dist/oidc/postgresStores.d.ts

@@ -1,5 +1,5 @@
 import { type AnyPgDatabase } from '../stores/postgres';
-import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
 export declare const oauthClientAssertionJtisTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_oauth_client_assertion_jtis";
     schema: undefined;
@@ -397,6 +397,25 @@ export declare const oauthCodesTable: import("drizzle-orm/pg-core").PgTableWithC
     name: "auth_oauth_codes";
     schema: undefined;
     columns: {
+        acr: import("drizzle-orm/pg-core").PgColumn<{
+            name: "acr";
+            tableName: "auth_oauth_codes";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
         claims_json: import("drizzle-orm/pg-core").PgColumn<{
             name: "claims_json";
             tableName: "auth_oauth_codes";
@@ -1019,10 +1038,127 @@ export declare const oauthLogoutDeliveriesTable: import("drizzle-orm/pg-core").P
     };
     dialect: "pg";
 }>;
+export declare const oauthPushedAuthorizationRequestsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_oauth_pushed_authorization_requests";
+    schema: undefined;
+    columns: {
+        client_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "client_id";
+            tableName: "auth_oauth_pushed_authorization_requests";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at_ms";
+            tableName: "auth_oauth_pushed_authorization_requests";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at_ms";
+            tableName: "auth_oauth_pushed_authorization_requests";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        params_json: import("drizzle-orm/pg-core").PgColumn<{
+            name: "params_json";
+            tableName: "auth_oauth_pushed_authorization_requests";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, string>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, string>;
+        }>;
+        request_uri_hash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "request_uri_hash";
+            tableName: "auth_oauth_pushed_authorization_requests";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+    };
+    dialect: "pg";
+}>;
 export declare const oauthRefreshTokensTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_oauth_refresh_tokens";
     schema: undefined;
     columns: {
+        acr: import("drizzle-orm/pg-core").PgColumn<{
+            name: "acr";
+            tableName: "auth_oauth_refresh_tokens";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
         claims_json: import("drizzle-orm/pg-core").PgColumn<{
             name: "claims_json";
             tableName: "auth_oauth_refresh_tokens";
@@ -1206,6 +1342,7 @@ export declare const createNeonInitialAccessTokenStore: (databaseUrl: string) =>
 export declare const createNeonLogoutDeliveryStore: (databaseUrl: string) => LogoutDeliveryStore;
 export declare const createNeonOAuthClientStore: (databaseUrl: string) => OAuthClientStore;
 export declare const createNeonOidcRefreshTokenStore: (databaseUrl: string) => OidcRefreshTokenStore;
+export declare const createNeonPushedAuthorizationRequestStore: (databaseUrl: string) => PushedAuthorizationRequestStore;
 export declare const createPostgresAuthorizationCodeStore: (db: AnyPgDatabase) => AuthorizationCodeStore;
 export declare const createPostgresClientAssertionJtiStore: (db: AnyPgDatabase) => ClientAssertionJtiStore;
 export declare const createPostgresClientRegistrationTokenStore: (db: AnyPgDatabase) => ClientRegistrationTokenStore;
@@ -1214,3 +1351,4 @@ export declare const createPostgresInitialAccessTokenStore: (db: AnyPgDatabase)
 export declare const createPostgresLogoutDeliveryStore: (db: AnyPgDatabase) => LogoutDeliveryStore;
 export declare const createPostgresOAuthClientStore: (db: AnyPgDatabase) => OAuthClientStore;
 export declare const createPostgresOidcRefreshTokenStore: (db: AnyPgDatabase) => OidcRefreshTokenStore;
+export declare const createPostgresPushedAuthorizationRequestStore: (db: AnyPgDatabase) => PushedAuthorizationRequestStore;

package/dist/oidc/routes.d.ts

@@ -29,10 +29,13 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
             query: {
                 client_id?: string | undefined;
                 scope?: string | undefined;
+                claims?: string | undefined;
                 nonce?: string | undefined;
+                redirect_uri?: string | undefined;
+                acr_values?: string | undefined;
                 code_challenge?: string | undefined;
                 code_challenge_method?: string | undefined;
-                redirect_uri?: string | undefined;
+                request_uri?: string | undefined;
                 response_type?: string | undefined;
                 state?: string | undefined;
             };
@@ -88,6 +91,45 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
             };
         };
     };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                client_id?: string | undefined;
+                scope?: string | undefined;
+                audience?: string | undefined;
+                claims?: string | undefined;
+                nonce?: string | undefined;
+                resource?: string | undefined;
+                client_secret?: string | undefined;
+                redirect_uri?: string | undefined;
+                acr_values?: string | undefined;
+                code_challenge?: string | undefined;
+                code_challenge_method?: string | undefined;
+                response_type?: string | undefined;
+                state?: string | undefined;
+                client_assertion?: string | undefined;
+                client_assertion_type?: string | undefined;
+            };
+            params: {};
+            query: unknown;
+            headers: {
+                authorization?: string | undefined;
+            };
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
 } & {
     [x: string]: {
         post: {

package/dist/oidc/types.d.ts

@@ -7,11 +7,23 @@ export type OAuthClient = {
     name: string;
     postLogoutRedirectUris?: string[];
     redirectUris: string[];
+    requirePushedAuthorizationRequests?: boolean;
     scopes: string[];
 };
 export type ClientAssertionJtiStore = {
     recordIfFresh: (clientId: string, jti: string, expiresAt: number) => Promise<boolean>;
 };
+export type PushedAuthorizationRequest = {
+    clientId: string;
+    createdAt: number;
+    expiresAt: number;
+    params: Record<string, string>;
+    requestUriHash: string;
+};
+export type PushedAuthorizationRequestStore = {
+    consumeRequest: (requestUriHash: string) => Promise<PushedAuthorizationRequest | undefined>;
+    saveRequest: (request: PushedAuthorizationRequest) => Promise<void>;
+};
 export type OAuthClientStore = {
     deleteClient?: (clientId: string) => Promise<void>;
     findClient: (clientId: string) => Promise<OAuthClient | undefined>;
@@ -32,6 +44,7 @@ export type InitialAccessTokenStore = {
     consumeToken: (tokenHash: string) => Promise<boolean>;
 };
 export type AuthorizationCode = {
+    acr?: string;
     claims?: Record<string, unknown>;
     clientId: string;
     codeChallenge: string;
@@ -49,6 +62,7 @@ export type AuthorizationCodeStore = {
     saveCode: (code: AuthorizationCode) => Promise<void>;
 };
 export type OidcRefreshToken = {
+    acr?: string;
     claims?: Record<string, unknown>;
     clientId: string;
     createdAt: number;

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.29.0-beta.4",
+	"version": "0.29.0",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {