@absolutejs/auth 0.30.0-beta.4 → 0.30.0-beta.5

package/dist/index.d.ts

@@ -13454,6 +13454,7 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
                 scope?: string | undefined;
                 claims?: string | undefined;
                 nonce?: string | undefined;
+                request?: string | undefined;
                 redirect_uri?: string | undefined;
                 acr_values?: string | undefined;
                 code_challenge?: string | undefined;
@@ -15120,7 +15121,9 @@ export { generateSigningKey, jwkThumbprint, signJwt, toPublicJwk, verifyJwt } fr
 export type { SigningKey } from './oidc/keys';
 export { extractDpopNonceClaim, mintDpopNonce, verifyDpopNonce, verifyDpopProof } from './oidc/dpop';
 export type { DpopResult } from './oidc/dpop';
-export { CLIENT_ASSERTION_TYPE, verifyClientAssertion } from './oidc/clientAuth';
+export { CLIENT_ASSERTION_TYPE, verifyClientAssertion, verifyJwtSignedByClient } from './oidc/clientAuth';
+export { parseSignedRequestObject } from './oidc/jar';
+export type { JarParseResult } from './oidc/jar';
 export { createInMemoryAuthorizationCodeStore, createInMemoryClientAssertionJtiStore, createInMemoryClientRegistrationTokenStore, createInMemoryDeviceAuthorizationStore, createInMemoryInitialAccessTokenStore, createInMemoryLogoutDeliveryStore, createInMemoryOAuthClientStore, createInMemoryOidcRefreshTokenStore, createInMemoryPushedAuthorizationRequestStore } from './oidc/inMemoryStores';
 export { consumePushedRequest, pushAuthorizationRequest, DEFAULT_PAR_TTL_MS, REQUEST_URI_PREFIX } from './oidc/par';
 export { fetchUserInfo, readUserInfoBearer, userInfoChallengeHeader } from './oidc/userinfo';

package/dist/index.js

@@ -4623,6 +4623,12 @@ var verifyAgainstAny = async (assertion, candidates) => {
   }
   return;
 };
+var verifyJwtSignedByClientImpl = async (client, jwt) => {
+  const candidates = await resolveClientJwks(client);
+  if (candidates === undefined || candidates.length === 0)
+    return;
+  return verifyAgainstAny(jwt, candidates);
+};
 var verifyClientAssertion = async ({
   assertion,
   expectedAudience,
@@ -4677,6 +4683,10 @@ var verifyClientAssertion = async ({
   }
   return client;
 };
+var verifyJwtSignedByClient = ({
+  jwt,
+  client
+}) => verifyJwtSignedByClientImpl(client, jwt);
 
 // src/oidc/dpop.ts
 var DEFAULT_MAX_AGE_MS = 60000;
@@ -4893,6 +4903,40 @@ var fanOutBackchannelLogout = async ({
   return reachable.map(({ client }) => client.clientId);
 };
 
+// src/oidc/jar.ts
+var MS_PER_SECOND2 = 1000;
+var numberClaim = (value) => typeof value === "number" ? value : undefined;
+var stringClaim = (value) => typeof value === "string" ? value : undefined;
+var arrayClaim = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : undefined;
+var parseSignedRequestObject = async ({
+  client,
+  expectedIssuer,
+  jwt,
+  now = Date.now()
+}) => {
+  const verified = await verifyJwtSignedByClient({ client, jwt });
+  if (verified === undefined) {
+    return { error: "invalid_request_object", ok: false };
+  }
+  const { payload } = verified;
+  const { aud } = payload;
+  const iss = stringClaim(payload.iss);
+  const exp = numberClaim(payload.exp);
+  if (iss !== client.clientId) {
+    return { error: "invalid_request_object", ok: false };
+  }
+  const audMatches = typeof aud === "string" && aud === expectedIssuer || (arrayClaim(aud)?.includes(expectedIssuer) ?? false);
+  if (!audMatches) {
+    return { error: "invalid_request_object", ok: false };
+  }
+  if (exp !== undefined && exp * MS_PER_SECOND2 <= now) {
+    return { error: "invalid_request_object", ok: false };
+  }
+  const envelope = new Set(["aud", "exp", "iat", "iss", "jti", "nbf"]);
+  const params = Object.fromEntries(Object.entries(payload).filter((entry) => typeof entry[1] === "string" && !envelope.has(entry[0])));
+  return { ok: true, params };
+};
+
 // src/oidc/par.ts
 var REQUEST_URI_BYTES = 32;
 var DEFAULT_PAR_TTL_SECONDS = 90;
@@ -5467,6 +5511,9 @@ var oidcProviderRoutes = (config) => {
     introspection_endpoint: `${issuer}${introspectRoute}`,
     issuer,
     jwks_uri: `${issuer}${jwksRoute}`,
+    request_object_signing_alg_values_supported: ["ES256"],
+    request_parameter_supported: true,
+    require_signed_request_object_supported: true,
     response_types_supported: ["code"],
     revocation_endpoint: `${issuer}${revokeRoute}`,
     subject_types_supported: ["public"],
@@ -5549,6 +5596,22 @@ var oidcProviderRoutes = (config) => {
     } else if (query.request_uri !== undefined && query.request_uri.startsWith(REQUEST_URI_PREFIX)) {
       return jsonResponse({ error: "invalid_request_uri" }, HTTP_BAD_REQUEST2);
     }
+    const initialClientId = effectiveQuery.client_id;
+    const initialClient = initialClientId === undefined ? undefined : await clientStore.findClient(initialClientId);
+    if (effectiveQuery.request !== undefined && initialClient !== undefined) {
+      const parsed = await parseSignedRequestObject({
+        client: initialClient,
+        expectedIssuer: issuer,
+        jwt: effectiveQuery.request
+      });
+      if (!parsed.ok) {
+        return jsonResponse({ error: parsed.error }, HTTP_BAD_REQUEST2);
+      }
+      effectiveQuery = {
+        ...parsed.params,
+        client_id: initialClientId
+      };
+    }
     const {
       client_id: clientId,
       code_challenge: codeChallenge,
@@ -5559,8 +5622,8 @@ var oidcProviderRoutes = (config) => {
       scope,
       state
     } = effectiveQuery;
-    const client = clientId === undefined ? undefined : await clientStore.findClient(clientId);
-    if (client === undefined || redirectUri === undefined || !client.redirectUris.includes(redirectUri)) {
+    const client = initialClient;
+    if (client === undefined || clientId !== client.clientId || redirectUri === undefined || !client.redirectUris.includes(redirectUri)) {
       return jsonResponse({ error: "invalid_client" }, HTTP_BAD_REQUEST2);
     }
     const errorRedirect = (error) => {
@@ -5572,6 +5635,9 @@ var oidcProviderRoutes = (config) => {
     if (client.requirePushedAuthorizationRequests === true && query.request_uri === undefined) {
       return errorRedirect("invalid_request");
     }
+    if (client.requireSignedRequestObject === true && query.request === undefined && query.request_uri === undefined) {
+      return errorRedirect("invalid_request_object");
+    }
     if (responseType !== "code") {
       return errorRedirect("unsupported_response_type");
     }
@@ -5652,6 +5718,7 @@ var oidcProviderRoutes = (config) => {
       nonce: t12.Optional(t12.String()),
       prompt: t12.Optional(t12.String()),
       redirect_uri: t12.Optional(t12.String()),
+      request: t12.Optional(t12.String()),
       request_uri: t12.Optional(t12.String()),
       response_type: t12.Optional(t12.String()),
       scope: t12.Optional(t12.String()),
@@ -21415,6 +21482,8 @@ var oauthClientsTable = pgTable("auth_oauth_clients", {
   name: varchar("name", { length: ID_LENGTH7 }).notNull(),
   post_logout_redirect_uris: text("post_logout_redirect_uris").array(),
   redirect_uris: text("redirect_uris").array().notNull(),
+  require_pushed_authorization_requests: boolean("require_pushed_authorization_requests"),
+  require_signed_request_object: boolean("require_signed_request_object"),
   scopes: text("scopes").array().notNull()
 });
 var oauthCodesTable = pgTable("auth_oauth_codes", {
@@ -21487,6 +21556,8 @@ var toClient2 = (row) => ({
   name: row.name,
   postLogoutRedirectUris: row.post_logout_redirect_uris ?? undefined,
   redirectUris: row.redirect_uris,
+  requirePushedAuthorizationRequests: row.require_pushed_authorization_requests ?? undefined,
+  requireSignedRequestObject: row.require_signed_request_object ?? undefined,
   scopes: row.scopes
 });
 var toLogoutDelivery = (row) => ({
@@ -21686,6 +21757,8 @@ var toClientValues2 = (client) => ({
   name: client.name,
   post_logout_redirect_uris: client.postLogoutRedirectUris ?? null,
   redirect_uris: client.redirectUris,
+  require_pushed_authorization_requests: client.requirePushedAuthorizationRequests ?? null,
+  require_signed_request_object: client.requireSignedRequestObject ?? null,
   scopes: client.scopes
 });
 var createPostgresOAuthClientStore = (db) => ({
@@ -23169,6 +23242,7 @@ export {
   verifyRecaptcha,
   verifyPkce,
   verifyPassword,
+  verifyJwtSignedByClient,
   verifyJwt,
   verifyIdTokenHint,
   verifyHcaptcha,
@@ -23238,6 +23312,7 @@ export {
   pkceProviderOptions,
   passwordlessTokensTable,
   passwordlessRoutes,
+  parseSignedRequestObject,
   parseSchema,
   organizationsTable,
   organizationRoutes,
@@ -23515,5 +23590,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=2099933871462CB064756E2164756E21
+//# debugId=36AE5503DAE3C8E864756E2164756E21
 //# sourceMappingURL=index.js.map