@absolutejs/auth 0.30.0-beta.3 → 0.30.0-beta.5

package/dist/fingerprint-client/index.d.ts

@@ -0,0 +1,26 @@
+export type FingerprintSignals = {
+    audio?: number;
+    canvas?: string;
+    deviceMemory?: number;
+    fonts?: string[];
+    hardwareConcurrency?: number;
+    languages?: readonly string[];
+    pixelRatio?: number;
+    platform?: string;
+    screen?: {
+        colorDepth: number;
+        height: number;
+        width: number;
+    };
+    timezone?: string;
+    userAgent?: string;
+    webgl?: {
+        renderer?: string;
+        vendor?: string;
+    };
+};
+export type DeviceFingerprint = {
+    deviceId: string;
+    signals: FingerprintSignals;
+};
+export declare const collectDeviceFingerprint: () => Promise<DeviceFingerprint>;

package/dist/fingerprint-client/index.js

@@ -0,0 +1,183 @@
+// src/fingerprint-client/index.ts
+var CANVAS_TEXT = "absoluteAuth-fp \uD83D\uDD10";
+var CANVAS_WIDTH = 280;
+var CANVAS_HEIGHT = 60;
+var AUDIO_SAMPLES_COUNT = 4500;
+var AUDIO_OSC_FREQ = 1e4;
+var AUDIO_COMPRESSOR_THRESHOLD = -50;
+var AUDIO_COMPRESSOR_KNEE = 40;
+var AUDIO_COMPRESSOR_RATIO = 12;
+var AUDIO_COMPRESSOR_ATTACK = 0;
+var AUDIO_COMPRESSOR_RELEASE = 0.25;
+var AUDIO_SAMPLE_RATE = 44100;
+var FONT_PROBE = "mmmmmmmmmlli";
+var FONT_PROBE_PX = "72px";
+var FONT_PROBE_OFFSCREEN_PX = -9999;
+var FONT_BASE_FAMILIES = ["monospace", "sans-serif", "serif"];
+var POPULAR_FONTS = [
+  "Arial",
+  "Arial Black",
+  "Comic Sans MS",
+  "Courier New",
+  "Georgia",
+  "Helvetica",
+  "Impact",
+  "Lucida Console",
+  "Times New Roman",
+  "Trebuchet MS",
+  "Verdana",
+  "monospace",
+  "sans-serif",
+  "serif"
+];
+var readCanvas = () => {
+  try {
+    const canvas = document.createElement("canvas");
+    canvas.width = CANVAS_WIDTH;
+    canvas.height = CANVAS_HEIGHT;
+    const context = canvas.getContext("2d");
+    if (context === null)
+      return;
+    context.textBaseline = "top";
+    context.font = "14px Arial";
+    context.fillStyle = "#f60";
+    context.fillRect(125, 1, 62, 20);
+    context.fillStyle = "#069";
+    context.fillText(CANVAS_TEXT, 2, 15);
+    context.fillStyle = "rgba(102, 204, 0, 0.7)";
+    context.fillText(CANVAS_TEXT, 4, 17);
+    return canvas.toDataURL();
+  } catch {
+    return;
+  }
+};
+var resolveOfflineAudioContextCtor = () => {
+  if (typeof OfflineAudioContext !== "undefined")
+    return OfflineAudioContext;
+  const legacy = globalThis;
+  return legacy.webkitOfflineAudioContext;
+};
+var sumAbs = (samples) => {
+  let total = 0;
+  for (const sample of samples)
+    total += Math.abs(sample);
+  return total;
+};
+var readAudio = async () => {
+  try {
+    const ContextCtor = resolveOfflineAudioContextCtor();
+    if (ContextCtor === undefined)
+      return;
+    const context = new ContextCtor(1, AUDIO_SAMPLES_COUNT, AUDIO_SAMPLE_RATE);
+    const oscillator = context.createOscillator();
+    oscillator.type = "triangle";
+    oscillator.frequency.value = AUDIO_OSC_FREQ;
+    const compressor = context.createDynamicsCompressor();
+    compressor.threshold.value = AUDIO_COMPRESSOR_THRESHOLD;
+    compressor.knee.value = AUDIO_COMPRESSOR_KNEE;
+    compressor.ratio.value = AUDIO_COMPRESSOR_RATIO;
+    compressor.attack.value = AUDIO_COMPRESSOR_ATTACK;
+    compressor.release.value = AUDIO_COMPRESSOR_RELEASE;
+    oscillator.connect(compressor);
+    compressor.connect(context.destination);
+    oscillator.start(0);
+    const buffer = await context.startRendering();
+    return sumAbs(buffer.getChannelData(0));
+  } catch {
+    return;
+  }
+};
+var readWebgl = () => {
+  try {
+    const canvas = document.createElement("canvas");
+    const context = canvas.getContext("webgl") ?? canvas.getContext("experimental-webgl");
+    if (context === null || !("getExtension" in context) || !("getParameter" in context)) {
+      return;
+    }
+    const debug = context.getExtension("WEBGL_debug_renderer_info");
+    if (debug === null)
+      return;
+    return {
+      renderer: String(context.getParameter(debug.UNMASKED_RENDERER_WEBGL) ?? ""),
+      vendor: String(context.getParameter(debug.UNMASKED_VENDOR_WEBGL) ?? "")
+    };
+  } catch {
+    return;
+  }
+};
+var measureFamily = (span, family) => {
+  span.style.fontFamily = family;
+  return span.offsetWidth;
+};
+var detectFontPresent = (span, font, baseline) => FONT_BASE_FAMILIES.some((family) => measureFamily(span, `'${font}', ${family}`) !== baseline[family]);
+var readFonts = () => {
+  try {
+    const span = document.createElement("span");
+    span.style.position = "absolute";
+    span.style.left = `${FONT_PROBE_OFFSCREEN_PX}px`;
+    span.style.fontSize = FONT_PROBE_PX;
+    span.textContent = FONT_PROBE;
+    document.body.appendChild(span);
+    const baseline = Object.fromEntries(FONT_BASE_FAMILIES.map((family) => [family, measureFamily(span, family)]));
+    const present = POPULAR_FONTS.filter((font) => detectFontPresent(span, font, baseline));
+    document.body.removeChild(span);
+    return present;
+  } catch {
+    return;
+  }
+};
+var readScreen = () => {
+  if (typeof screen === "undefined")
+    return;
+  return {
+    colorDepth: screen.colorDepth,
+    height: screen.height,
+    width: screen.width
+  };
+};
+var readTimezone = () => {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone;
+  } catch {
+    return;
+  }
+};
+var canonical = (signals) => JSON.stringify(signals, (_key, value) => value === null || typeof value !== "object" || Array.isArray(value) ? value : Object.fromEntries(Object.entries(value).sort((left, right) => left[0].localeCompare(right[0]))));
+var sha256Base64Url = async (input) => {
+  const bytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+  const binary = String.fromCharCode(...new Uint8Array(bytes));
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+var collectDeviceFingerprint = async () => {
+  if (typeof window === "undefined" || typeof document === "undefined") {
+    throw new Error("collectDeviceFingerprint must run in a browser — server-side use the @absolutejs/auth fingerprintDevice helper instead");
+  }
+  const [canvas, audio, webgl, fonts] = await Promise.all([
+    Promise.resolve(readCanvas()),
+    readAudio(),
+    Promise.resolve(readWebgl()),
+    Promise.resolve(readFonts())
+  ]);
+  const deviceMemory = "deviceMemory" in navigator ? Reflect.get(navigator, "deviceMemory") : undefined;
+  const signals = {
+    audio,
+    canvas,
+    deviceMemory: typeof deviceMemory === "number" ? deviceMemory : undefined,
+    fonts,
+    hardwareConcurrency: navigator.hardwareConcurrency,
+    languages: navigator.languages,
+    pixelRatio: window.devicePixelRatio,
+    platform: navigator.platform,
+    screen: readScreen(),
+    timezone: readTimezone(),
+    userAgent: navigator.userAgent,
+    webgl
+  };
+  return { deviceId: await sha256Base64Url(canonical(signals)), signals };
+};
+export {
+  collectDeviceFingerprint
+};
+
+//# debugId=0B8B6C4FD47EEDE764756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/fingerprint-client/index.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../../src/fingerprint-client/index.ts"],
+  "sourcesContent": [
+    "// Browser-side device fingerprint collector.\n//\n// `collectDeviceFingerprint()` reads ~10 signals from the browser (canvas render,\n// AudioContext, WebGL renderer, font enumeration, screen geometry, navigator.languages,\n// timezone, hardware concurrency, device memory, pixel ratio), normalizes them, and\n// hashes the canonical JSON into a stable base64url SHA-256 `deviceId`.\n//\n// Self-hosted equivalent of FingerprintJS's open-source library. Each individual signal\n// is weak on its own — but their combination is highly stable across sessions for the\n// same browser+device, and varies sharply across different browsers/devices. The same\n// algorithms underpin every commercial fingerprinter; only the proprietary data network\n// (cross-customer reputation) is what SaaS vendors charge for, and that's a non-goal here.\n//\n// Imported via `@absolutejs/auth/fingerprint-client` — server bundle does NOT pull this in\n// (browser globals like `window` would explode there). The client SDK + your sign-in form\n// call this, send the result as `x-client-fingerprint`, and the server (riskConfig / adaptive)\n// uses it as the deviceId instead of the weak UA+IP fallback.\n\nconst CANVAS_TEXT = 'absoluteAuth-fp 🔐';\nconst CANVAS_WIDTH = 280;\nconst CANVAS_HEIGHT = 60;\nconst AUDIO_SAMPLES_COUNT = 4500;\nconst AUDIO_OSC_FREQ = 10_000;\nconst AUDIO_COMPRESSOR_THRESHOLD = -50;\nconst AUDIO_COMPRESSOR_KNEE = 40;\nconst AUDIO_COMPRESSOR_RATIO = 12;\nconst AUDIO_COMPRESSOR_ATTACK = 0;\nconst AUDIO_COMPRESSOR_RELEASE = 0.25;\nconst AUDIO_SAMPLE_RATE = 44_100;\nconst FONT_PROBE = 'mmmmmmmmmlli';\nconst FONT_PROBE_PX = '72px';\nconst FONT_PROBE_OFFSCREEN_PX = -9999;\nconst FONT_BASE_FAMILIES = ['monospace', 'sans-serif', 'serif'] as const;\nconst POPULAR_FONTS = [\n\t'Arial',\n\t'Arial Black',\n\t'Comic Sans MS',\n\t'Courier New',\n\t'Georgia',\n\t'Helvetica',\n\t'Impact',\n\t'Lucida Console',\n\t'Times New Roman',\n\t'Trebuchet MS',\n\t'Verdana',\n\t'monospace',\n\t'sans-serif',\n\t'serif'\n];\n\nexport type FingerprintSignals = {\n\taudio?: number;\n\tcanvas?: string;\n\tdeviceMemory?: number;\n\tfonts?: string[];\n\thardwareConcurrency?: number;\n\tlanguages?: readonly string[];\n\tpixelRatio?: number;\n\tplatform?: string;\n\tscreen?: { colorDepth: number; height: number; width: number };\n\ttimezone?: string;\n\tuserAgent?: string;\n\twebgl?: { renderer?: string; vendor?: string };\n};\n\nexport type DeviceFingerprint = {\n\tdeviceId: string;\n\tsignals: FingerprintSignals;\n};\n\n// Canvas hash: render text + a curve + a couple of rectangles + return the data URL\n// (its pixel content hashes differently across GPUs, drivers, browser versions, font\n// renderers). Wrapped in try/catch because privacy-mode browsers throw on getContext.\nconst readCanvas = () => {\n\ttry {\n\t\tconst canvas = document.createElement('canvas');\n\t\tcanvas.width = CANVAS_WIDTH;\n\t\tcanvas.height = CANVAS_HEIGHT;\n\t\tconst context = canvas.getContext('2d');\n\t\tif (context === null) return undefined;\n\t\tcontext.textBaseline = 'top';\n\t\tcontext.font = '14px Arial';\n\t\tcontext.fillStyle = '#f60';\n\t\tcontext.fillRect(125, 1, 62, 20);\n\t\tcontext.fillStyle = '#069';\n\t\tcontext.fillText(CANVAS_TEXT, 2, 15);\n\t\tcontext.fillStyle = 'rgba(102, 204, 0, 0.7)';\n\t\tcontext.fillText(CANVAS_TEXT, 4, 17);\n\n\t\treturn canvas.toDataURL();\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\ntype LegacyOfflineCtxGlobal = {\n\twebkitOfflineAudioContext?: typeof OfflineAudioContext;\n};\n\nconst resolveOfflineAudioContextCtor = () => {\n\tif (typeof OfflineAudioContext !== 'undefined') return OfflineAudioContext;\n\t// eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- vendor-prefixed legacy API; no TS type ships for it\n\tconst legacy = globalThis as LegacyOfflineCtxGlobal;\n\n\treturn legacy.webkitOfflineAudioContext;\n};\n\nconst sumAbs = (samples: Float32Array) => {\n\tlet total = 0;\n\tfor (const sample of samples) total += Math.abs(sample);\n\n\treturn total;\n};\n\n// Audio hash: instantiate an offline audio context, push a brief oscillator + dynamics\n// compressor through it, read back the rendered buffer's sum. Different audio stacks\n// produce subtly different floating-point outputs.\nconst readAudio = async () => {\n\ttry {\n\t\tconst ContextCtor = resolveOfflineAudioContextCtor();\n\t\tif (ContextCtor === undefined) return undefined;\n\t\tconst context = new ContextCtor(1, AUDIO_SAMPLES_COUNT, AUDIO_SAMPLE_RATE);\n\t\tconst oscillator = context.createOscillator();\n\t\toscillator.type = 'triangle';\n\t\toscillator.frequency.value = AUDIO_OSC_FREQ;\n\t\tconst compressor = context.createDynamicsCompressor();\n\t\tcompressor.threshold.value = AUDIO_COMPRESSOR_THRESHOLD;\n\t\tcompressor.knee.value = AUDIO_COMPRESSOR_KNEE;\n\t\tcompressor.ratio.value = AUDIO_COMPRESSOR_RATIO;\n\t\t// `reduction` is read-only on the modern spec (the constant exists for the\n\t\t// outdated browsers that originally exposed it as a writable AudioParam;\n\t\t// we don't bother setting it — the fingerprint is plenty stable without).\n\t\tcompressor.attack.value = AUDIO_COMPRESSOR_ATTACK;\n\t\tcompressor.release.value = AUDIO_COMPRESSOR_RELEASE;\n\t\toscillator.connect(compressor);\n\t\tcompressor.connect(context.destination);\n\t\toscillator.start(0);\n\t\tconst buffer = await context.startRendering();\n\n\t\treturn sumAbs(buffer.getChannelData(0));\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// WebGL hash: the renderer + vendor strings include GPU model + driver — highly stable,\n// highly distinctive. Behind the WEBGL_debug_renderer_info extension on most browsers.\nconst readWebgl = () => {\n\ttry {\n\t\tconst canvas = document.createElement('canvas');\n\t\tconst context =\n\t\t\tcanvas.getContext('webgl') ?? canvas.getContext('experimental-webgl');\n\t\tif (\n\t\t\tcontext === null ||\n\t\t\t!('getExtension' in context) ||\n\t\t\t!('getParameter' in context)\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\t\tconst debug = context.getExtension('WEBGL_debug_renderer_info');\n\t\tif (debug === null) return undefined;\n\n\t\treturn {\n\t\t\trenderer: String(\n\t\t\t\tcontext.getParameter(debug.UNMASKED_RENDERER_WEBGL) ?? ''\n\t\t\t),\n\t\t\tvendor: String(context.getParameter(debug.UNMASKED_VENDOR_WEBGL) ?? '')\n\t\t};\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// Width of `probe` rendered in `family` on the given span — used to detect installed\n// fonts (different widths than the fallback ⇒ font is present).\nconst measureFamily = (span: HTMLSpanElement, family: string) => {\n\tspan.style.fontFamily = family;\n\n\treturn span.offsetWidth;\n};\n\nconst detectFontPresent = (\n\tspan: HTMLSpanElement,\n\tfont: string,\n\tbaseline: Record<string, number>\n) =>\n\tFONT_BASE_FAMILIES.some(\n\t\t(family) =>\n\t\t\tmeasureFamily(span, `'${font}', ${family}`) !== baseline[family]\n\t);\n\n// Font enumeration: a font is \"installed\" if the rendered width of a probe string differs\n// from the same string in a known fallback. Compares against monospace + sans-serif +\n// serif and counts a match if any of them produce a different width.\nconst readFonts = () => {\n\ttry {\n\t\tconst span = document.createElement('span');\n\t\tspan.style.position = 'absolute';\n\t\tspan.style.left = `${FONT_PROBE_OFFSCREEN_PX}px`;\n\t\tspan.style.fontSize = FONT_PROBE_PX;\n\t\tspan.textContent = FONT_PROBE;\n\t\tdocument.body.appendChild(span);\n\n\t\tconst baseline: Record<string, number> = Object.fromEntries(\n\t\t\tFONT_BASE_FAMILIES.map((family) => [family, measureFamily(span, family)])\n\t\t);\n\t\tconst present = POPULAR_FONTS.filter((font) =>\n\t\t\tdetectFontPresent(span, font, baseline)\n\t\t);\n\n\t\tdocument.body.removeChild(span);\n\n\t\treturn present;\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\nconst readScreen = () => {\n\tif (typeof screen === 'undefined') return undefined;\n\n\treturn {\n\t\tcolorDepth: screen.colorDepth,\n\t\theight: screen.height,\n\t\twidth: screen.width\n\t};\n};\n\nconst readTimezone = () => {\n\ttry {\n\t\treturn Intl.DateTimeFormat().resolvedOptions().timeZone;\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// Canonical JSON identical to the server-side `fingerprintDevice` canonicalizer: keys\n// sorted at every depth so identical signals produce identical hashes regardless of\n// insertion order. Inlined here to keep the client bundle free of server-side imports.\nconst canonical = (signals: FingerprintSignals) =>\n\tJSON.stringify(signals, (_key, value) =>\n\t\tvalue === null || typeof value !== 'object' || Array.isArray(value)\n\t\t\t? value\n\t\t\t: Object.fromEntries(\n\t\t\t\t\tObject.entries(value).sort((left, right) =>\n\t\t\t\t\t\tleft[0].localeCompare(right[0])\n\t\t\t\t\t)\n\t\t\t\t)\n\t);\n\nconst sha256Base64Url = async (input: string) => {\n\tconst bytes = await crypto.subtle.digest(\n\t\t'SHA-256',\n\t\tnew TextEncoder().encode(input)\n\t);\n\tconst binary = String.fromCharCode(...new Uint8Array(bytes));\n\n\treturn btoa(binary)\n\t\t.replace(/\\+/g, '-')\n\t\t.replace(/\\//g, '_')\n\t\t.replace(/=+$/, '');\n};\n\n// Collect every signal we can, hash them, return both so the caller can persist the raw\n// signals (for debugging / drift detection) while sending just the deviceId on the wire.\nexport const collectDeviceFingerprint = async (): Promise<DeviceFingerprint> => {\n\tif (typeof window === 'undefined' || typeof document === 'undefined') {\n\t\tthrow new Error(\n\t\t\t'collectDeviceFingerprint must run in a browser — server-side use the @absolutejs/auth fingerprintDevice helper instead'\n\t\t);\n\t}\n\tconst [canvas, audio, webgl, fonts] = await Promise.all([\n\t\tPromise.resolve(readCanvas()),\n\t\treadAudio(),\n\t\tPromise.resolve(readWebgl()),\n\t\tPromise.resolve(readFonts())\n\t]);\n\n\tconst deviceMemory =\n\t\t'deviceMemory' in navigator\n\t\t\t? Reflect.get(navigator, 'deviceMemory')\n\t\t\t: undefined;\n\tconst signals: FingerprintSignals = {\n\t\taudio,\n\t\tcanvas,\n\t\tdeviceMemory: typeof deviceMemory === 'number' ? deviceMemory : undefined,\n\t\tfonts,\n\t\thardwareConcurrency: navigator.hardwareConcurrency,\n\t\tlanguages: navigator.languages,\n\t\tpixelRatio: window.devicePixelRatio,\n\t\tplatform: navigator.platform,\n\t\tscreen: readScreen(),\n\t\ttimezone: readTimezone(),\n\t\tuserAgent: navigator.userAgent,\n\t\twebgl\n\t};\n\n\treturn { deviceId: await sha256Base64Url(canonical(signals)), signals };\n};\n"
+  ],
+  "mappings": ";AAkBA,IAAM,cAAc;AACpB,IAAM,eAAe;AACrB,IAAM,gBAAgB;AACtB,IAAM,sBAAsB;AAC5B,IAAM,iBAAiB;AACvB,IAAM,6BAA6B;AACnC,IAAM,wBAAwB;AAC9B,IAAM,yBAAyB;AAC/B,IAAM,0BAA0B;AAChC,IAAM,2BAA2B;AACjC,IAAM,oBAAoB;AAC1B,IAAM,aAAa;AACnB,IAAM,gBAAgB;AACtB,IAAM,0BAA0B;AAChC,IAAM,qBAAqB,CAAC,aAAa,cAAc,OAAO;AAC9D,IAAM,gBAAgB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAyBA,IAAM,aAAa,MAAM;AAAA,EACxB,IAAI;AAAA,IACH,MAAM,SAAS,SAAS,cAAc,QAAQ;AAAA,IAC9C,OAAO,QAAQ;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,MAAM,UAAU,OAAO,WAAW,IAAI;AAAA,IACtC,IAAI,YAAY;AAAA,MAAM;AAAA,IACtB,QAAQ,eAAe;AAAA,IACvB,QAAQ,OAAO;AAAA,IACf,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,KAAK,GAAG,IAAI,EAAE;AAAA,IAC/B,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,aAAa,GAAG,EAAE;AAAA,IACnC,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,aAAa,GAAG,EAAE;AAAA,IAEnC,OAAO,OAAO,UAAU;AAAA,IACvB,MAAM;AAAA,IACP;AAAA;AAAA;AAQF,IAAM,iCAAiC,MAAM;AAAA,EAC5C,IAAI,OAAO,wBAAwB;AAAA,IAAa,OAAO;AAAA,EAEvD,MAAM,SAAS;AAAA,EAEf,OAAO,OAAO;AAAA;AAGf,IAAM,SAAS,CAAC,YAA0B;AAAA,EACzC,IAAI,QAAQ;AAAA,EACZ,WAAW,UAAU;AAAA,IAAS,SAAS,KAAK,IAAI,MAAM;AAAA,EAEtD,OAAO;AAAA;AAMR,IAAM,YAAY,YAAY;AAAA,EAC7B,IAAI;AAAA,IACH,MAAM,cAAc,+BAA+B;AAAA,IACnD,IAAI,gBAAgB;AAAA,MAAW;AAAA,IAC/B,MAAM,UAAU,IAAI,YAAY,GAAG,qBAAqB,iBAAiB;AAAA,IACzE,MAAM,aAAa,QAAQ,iBAAiB;AAAA,IAC5C,WAAW,OAAO;AAAA,IAClB,WAAW,UAAU,QAAQ;AAAA,IAC7B,MAAM,aAAa,QAAQ,yBAAyB;AAAA,IACpD,WAAW,UAAU,QAAQ;AAAA,IAC7B,WAAW,KAAK,QAAQ;AAAA,IACxB,WAAW,MAAM,QAAQ;AAAA,IAIzB,WAAW,OAAO,QAAQ;AAAA,IAC1B,WAAW,QAAQ,QAAQ;AAAA,IAC3B,WAAW,QAAQ,UAAU;AAAA,IAC7B,WAAW,QAAQ,QAAQ,WAAW;AAAA,IACtC,WAAW,MAAM,CAAC;AAAA,IAClB,MAAM,SAAS,MAAM,QAAQ,eAAe;AAAA,IAE5C,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC;AAAA,IACrC,MAAM;AAAA,IACP;AAAA;AAAA;AAMF,IAAM,YAAY,MAAM;AAAA,EACvB,IAAI;AAAA,IACH,MAAM,SAAS,SAAS,cAAc,QAAQ;AAAA,IAC9C,MAAM,UACL,OAAO,WAAW,OAAO,KAAK,OAAO,WAAW,oBAAoB;AAAA,IACrE,IACC,YAAY,QACZ,EAAE,kBAAkB,YACpB,EAAE,kBAAkB,UACnB;AAAA,MACD;AAAA,IACD;AAAA,IACA,MAAM,QAAQ,QAAQ,aAAa,2BAA2B;AAAA,IAC9D,IAAI,UAAU;AAAA,MAAM;AAAA,IAEpB,OAAO;AAAA,MACN,UAAU,OACT,QAAQ,aAAa,MAAM,uBAAuB,KAAK,EACxD;AAAA,MACA,QAAQ,OAAO,QAAQ,aAAa,MAAM,qBAAqB,KAAK,EAAE;AAAA,IACvE;AAAA,IACC,MAAM;AAAA,IACP;AAAA;AAAA;AAMF,IAAM,gBAAgB,CAAC,MAAuB,WAAmB;AAAA,EAChE,KAAK,MAAM,aAAa;AAAA,EAExB,OAAO,KAAK;AAAA;AAGb,IAAM,oBAAoB,CACzB,MACA,MACA,aAEA,mBAAmB,KAClB,CAAC,WACA,cAAc,MAAM,IAAI,UAAU,QAAQ,MAAM,SAAS,OAC3D;AAKD,IAAM,YAAY,MAAM;AAAA,EACvB,IAAI;AAAA,IACH,MAAM,OAAO,SAAS,cAAc,MAAM;AAAA,IAC1C,KAAK,MAAM,WAAW;AAAA,IACtB,KAAK,MAAM,OAAO,GAAG;AAAA,IACrB,KAAK,MAAM,WAAW;AAAA,IACtB,KAAK,cAAc;AAAA,IACnB,SAAS,KAAK,YAAY,IAAI;AAAA,IAE9B,MAAM,WAAmC,OAAO,YAC/C,mBAAmB,IAAI,CAAC,WAAW,CAAC,QAAQ,cAAc,MAAM,MAAM,CAAC,CAAC,CACzE;AAAA,IACA,MAAM,UAAU,cAAc,OAAO,CAAC,SACrC,kBAAkB,MAAM,MAAM,QAAQ,CACvC;AAAA,IAEA,SAAS,KAAK,YAAY,IAAI;AAAA,IAE9B,OAAO;AAAA,IACN,MAAM;AAAA,IACP;AAAA;AAAA;AAIF,IAAM,aAAa,MAAM;AAAA,EACxB,IAAI,OAAO,WAAW;AAAA,IAAa;AAAA,EAEnC,OAAO;AAAA,IACN,YAAY,OAAO;AAAA,IACnB,QAAQ,OAAO;AAAA,IACf,OAAO,OAAO;AAAA,EACf;AAAA;AAGD,IAAM,eAAe,MAAM;AAAA,EAC1B,IAAI;AAAA,IACH,OAAO,KAAK,eAAe,EAAE,gBAAgB,EAAE;AAAA,IAC9C,MAAM;AAAA,IACP;AAAA;AAAA;AAOF,IAAM,YAAY,CAAC,YAClB,KAAK,UAAU,SAAS,CAAC,MAAM,UAC9B,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,IAC/D,QACA,OAAO,YACP,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,MAAM,UACjC,KAAK,GAAG,cAAc,MAAM,EAAE,CAC/B,CACD,CACH;AAED,IAAM,kBAAkB,OAAO,UAAkB;AAAA,EAChD,MAAM,QAAQ,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,YAAY,EAAE,OAAO,KAAK,CAC/B;AAAA,EACA,MAAM,SAAS,OAAO,aAAa,GAAG,IAAI,WAAW,KAAK,CAAC;AAAA,EAE3D,OAAO,KAAK,MAAM,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AAAA;AAKb,IAAM,2BAA2B,YAAwC;AAAA,EAC/E,IAAI,OAAO,WAAW,eAAe,OAAO,aAAa,aAAa;AAAA,IACrE,MAAM,IAAI,MACT,wHACD;AAAA,EACD;AAAA,EACA,OAAO,QAAQ,OAAO,OAAO,SAAS,MAAM,QAAQ,IAAI;AAAA,IACvD,QAAQ,QAAQ,WAAW,CAAC;AAAA,IAC5B,UAAU;AAAA,IACV,QAAQ,QAAQ,UAAU,CAAC;AAAA,IAC3B,QAAQ,QAAQ,UAAU,CAAC;AAAA,EAC5B,CAAC;AAAA,EAED,MAAM,eACL,kBAAkB,YACf,QAAQ,IAAI,WAAW,cAAc,IACrC;AAAA,EACJ,MAAM,UAA8B;AAAA,IACnC;AAAA,IACA;AAAA,IACA,cAAc,OAAO,iBAAiB,WAAW,eAAe;AAAA,IAChE;AAAA,IACA,qBAAqB,UAAU;AAAA,IAC/B,WAAW,UAAU;AAAA,IACrB,YAAY,OAAO;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,QAAQ,WAAW;AAAA,IACnB,UAAU,aAAa;AAAA,IACvB,WAAW,UAAU;AAAA,IACrB;AAAA,EACD;AAAA,EAEA,OAAO,EAAE,UAAU,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,QAAQ;AAAA;",
+  "debugId": "0B8B6C4FD47EEDE764756E2164756E21",
+  "names": []
+}

package/dist/index.d.ts

@@ -13454,6 +13454,7 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
                 scope?: string | undefined;
                 claims?: string | undefined;
                 nonce?: string | undefined;
+                request?: string | undefined;
                 redirect_uri?: string | undefined;
                 acr_values?: string | undefined;
                 code_challenge?: string | undefined;
@@ -15120,7 +15121,9 @@ export { generateSigningKey, jwkThumbprint, signJwt, toPublicJwk, verifyJwt } fr
 export type { SigningKey } from './oidc/keys';
 export { extractDpopNonceClaim, mintDpopNonce, verifyDpopNonce, verifyDpopProof } from './oidc/dpop';
 export type { DpopResult } from './oidc/dpop';
-export { CLIENT_ASSERTION_TYPE, verifyClientAssertion } from './oidc/clientAuth';
+export { CLIENT_ASSERTION_TYPE, verifyClientAssertion, verifyJwtSignedByClient } from './oidc/clientAuth';
+export { parseSignedRequestObject } from './oidc/jar';
+export type { JarParseResult } from './oidc/jar';
 export { createInMemoryAuthorizationCodeStore, createInMemoryClientAssertionJtiStore, createInMemoryClientRegistrationTokenStore, createInMemoryDeviceAuthorizationStore, createInMemoryInitialAccessTokenStore, createInMemoryLogoutDeliveryStore, createInMemoryOAuthClientStore, createInMemoryOidcRefreshTokenStore, createInMemoryPushedAuthorizationRequestStore } from './oidc/inMemoryStores';
 export { consumePushedRequest, pushAuthorizationRequest, DEFAULT_PAR_TTL_MS, REQUEST_URI_PREFIX } from './oidc/par';
 export { fetchUserInfo, readUserInfoBearer, userInfoChallengeHeader } from './oidc/userinfo';

package/dist/index.js

@@ -4623,6 +4623,12 @@ var verifyAgainstAny = async (assertion, candidates) => {
   }
   return;
 };
+var verifyJwtSignedByClientImpl = async (client, jwt) => {
+  const candidates = await resolveClientJwks(client);
+  if (candidates === undefined || candidates.length === 0)
+    return;
+  return verifyAgainstAny(jwt, candidates);
+};
 var verifyClientAssertion = async ({
   assertion,
   expectedAudience,
@@ -4677,6 +4683,10 @@ var verifyClientAssertion = async ({
   }
   return client;
 };
+var verifyJwtSignedByClient = ({
+  jwt,
+  client
+}) => verifyJwtSignedByClientImpl(client, jwt);
 
 // src/oidc/dpop.ts
 var DEFAULT_MAX_AGE_MS = 60000;
@@ -4893,6 +4903,40 @@ var fanOutBackchannelLogout = async ({
   return reachable.map(({ client }) => client.clientId);
 };
 
+// src/oidc/jar.ts
+var MS_PER_SECOND2 = 1000;
+var numberClaim = (value) => typeof value === "number" ? value : undefined;
+var stringClaim = (value) => typeof value === "string" ? value : undefined;
+var arrayClaim = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : undefined;
+var parseSignedRequestObject = async ({
+  client,
+  expectedIssuer,
+  jwt,
+  now = Date.now()
+}) => {
+  const verified = await verifyJwtSignedByClient({ client, jwt });
+  if (verified === undefined) {
+    return { error: "invalid_request_object", ok: false };
+  }
+  const { payload } = verified;
+  const { aud } = payload;
+  const iss = stringClaim(payload.iss);
+  const exp = numberClaim(payload.exp);
+  if (iss !== client.clientId) {
+    return { error: "invalid_request_object", ok: false };
+  }
+  const audMatches = typeof aud === "string" && aud === expectedIssuer || (arrayClaim(aud)?.includes(expectedIssuer) ?? false);
+  if (!audMatches) {
+    return { error: "invalid_request_object", ok: false };
+  }
+  if (exp !== undefined && exp * MS_PER_SECOND2 <= now) {
+    return { error: "invalid_request_object", ok: false };
+  }
+  const envelope = new Set(["aud", "exp", "iat", "iss", "jti", "nbf"]);
+  const params = Object.fromEntries(Object.entries(payload).filter((entry) => typeof entry[1] === "string" && !envelope.has(entry[0])));
+  return { ok: true, params };
+};
+
 // src/oidc/par.ts
 var REQUEST_URI_BYTES = 32;
 var DEFAULT_PAR_TTL_SECONDS = 90;
@@ -5467,6 +5511,9 @@ var oidcProviderRoutes = (config) => {
     introspection_endpoint: `${issuer}${introspectRoute}`,
     issuer,
     jwks_uri: `${issuer}${jwksRoute}`,
+    request_object_signing_alg_values_supported: ["ES256"],
+    request_parameter_supported: true,
+    require_signed_request_object_supported: true,
     response_types_supported: ["code"],
     revocation_endpoint: `${issuer}${revokeRoute}`,
     subject_types_supported: ["public"],
@@ -5549,6 +5596,22 @@ var oidcProviderRoutes = (config) => {
     } else if (query.request_uri !== undefined && query.request_uri.startsWith(REQUEST_URI_PREFIX)) {
       return jsonResponse({ error: "invalid_request_uri" }, HTTP_BAD_REQUEST2);
     }
+    const initialClientId = effectiveQuery.client_id;
+    const initialClient = initialClientId === undefined ? undefined : await clientStore.findClient(initialClientId);
+    if (effectiveQuery.request !== undefined && initialClient !== undefined) {
+      const parsed = await parseSignedRequestObject({
+        client: initialClient,
+        expectedIssuer: issuer,
+        jwt: effectiveQuery.request
+      });
+      if (!parsed.ok) {
+        return jsonResponse({ error: parsed.error }, HTTP_BAD_REQUEST2);
+      }
+      effectiveQuery = {
+        ...parsed.params,
+        client_id: initialClientId
+      };
+    }
     const {
       client_id: clientId,
       code_challenge: codeChallenge,
@@ -5559,8 +5622,8 @@ var oidcProviderRoutes = (config) => {
       scope,
       state
     } = effectiveQuery;
-    const client = clientId === undefined ? undefined : await clientStore.findClient(clientId);
-    if (client === undefined || redirectUri === undefined || !client.redirectUris.includes(redirectUri)) {
+    const client = initialClient;
+    if (client === undefined || clientId !== client.clientId || redirectUri === undefined || !client.redirectUris.includes(redirectUri)) {
       return jsonResponse({ error: "invalid_client" }, HTTP_BAD_REQUEST2);
     }
     const errorRedirect = (error) => {
@@ -5572,6 +5635,9 @@ var oidcProviderRoutes = (config) => {
     if (client.requirePushedAuthorizationRequests === true && query.request_uri === undefined) {
       return errorRedirect("invalid_request");
     }
+    if (client.requireSignedRequestObject === true && query.request === undefined && query.request_uri === undefined) {
+      return errorRedirect("invalid_request_object");
+    }
     if (responseType !== "code") {
       return errorRedirect("unsupported_response_type");
     }
@@ -5652,6 +5718,7 @@ var oidcProviderRoutes = (config) => {
       nonce: t12.Optional(t12.String()),
       prompt: t12.Optional(t12.String()),
       redirect_uri: t12.Optional(t12.String()),
+      request: t12.Optional(t12.String()),
       request_uri: t12.Optional(t12.String()),
       response_type: t12.Optional(t12.String()),
       scope: t12.Optional(t12.String()),
@@ -21415,6 +21482,8 @@ var oauthClientsTable = pgTable("auth_oauth_clients", {
   name: varchar("name", { length: ID_LENGTH7 }).notNull(),
   post_logout_redirect_uris: text("post_logout_redirect_uris").array(),
   redirect_uris: text("redirect_uris").array().notNull(),
+  require_pushed_authorization_requests: boolean("require_pushed_authorization_requests"),
+  require_signed_request_object: boolean("require_signed_request_object"),
   scopes: text("scopes").array().notNull()
 });
 var oauthCodesTable = pgTable("auth_oauth_codes", {
@@ -21487,6 +21556,8 @@ var toClient2 = (row) => ({
   name: row.name,
   postLogoutRedirectUris: row.post_logout_redirect_uris ?? undefined,
   redirectUris: row.redirect_uris,
+  requirePushedAuthorizationRequests: row.require_pushed_authorization_requests ?? undefined,
+  requireSignedRequestObject: row.require_signed_request_object ?? undefined,
   scopes: row.scopes
 });
 var toLogoutDelivery = (row) => ({
@@ -21686,6 +21757,8 @@ var toClientValues2 = (client) => ({
   name: client.name,
   post_logout_redirect_uris: client.postLogoutRedirectUris ?? null,
   redirect_uris: client.redirectUris,
+  require_pushed_authorization_requests: client.requirePushedAuthorizationRequests ?? null,
+  require_signed_request_object: client.requireSignedRequestObject ?? null,
   scopes: client.scopes
 });
 var createPostgresOAuthClientStore = (db) => ({
@@ -23169,6 +23242,7 @@ export {
   verifyRecaptcha,
   verifyPkce,
   verifyPassword,
+  verifyJwtSignedByClient,
   verifyJwt,
   verifyIdTokenHint,
   verifyHcaptcha,
@@ -23238,6 +23312,7 @@ export {
   pkceProviderOptions,
   passwordlessTokensTable,
   passwordlessRoutes,
+  parseSignedRequestObject,
   parseSchema,
   organizationsTable,
   organizationRoutes,
@@ -23515,5 +23590,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=2099933871462CB064756E2164756E21
+//# debugId=36AE5503DAE3C8E864756E2164756E21
 //# sourceMappingURL=index.js.map