@absolutejs/auth 0.35.0 → 0.36.0

package/dist/index.js

@@ -4492,6 +4492,7 @@ var RESERVED_ACCESS_CLAIMS = new Set([
 var buildAccessClaims = ({
   act,
   audience,
+  clientCertThumbprint,
   clientId,
   dpopJkt,
   extraClaims,
@@ -4516,8 +4517,15 @@ var buildAccessClaims = ({
   };
   if (act !== undefined)
     claims.act = act;
-  if (dpopJkt !== undefined)
-    claims.cnf = { jkt: dpopJkt };
+  if (dpopJkt !== undefined || clientCertThumbprint !== undefined) {
+    const cnf = {};
+    if (dpopJkt !== undefined)
+      cnf.jkt = dpopJkt;
+    if (clientCertThumbprint !== undefined) {
+      cnf["x5t#S256"] = clientCertThumbprint;
+    }
+    claims.cnf = cnf;
+  }
   return claims;
 };
 var exchangeToken = async ({
@@ -4567,6 +4575,7 @@ var exchangeToken = async ({
 var issueTokenSet = async ({
   acr,
   claims,
+  clientCertThumbprint,
   clientId,
   config,
   dpopJkt,
@@ -4584,6 +4593,7 @@ var issueTokenSet = async ({
     sub
   });
   const accessPayload = buildAccessClaims({
+    clientCertThumbprint,
     clientId,
     dpopJkt,
     extraClaims: { ...accessExtra, ...acr === undefined ? {} : { acr } },
@@ -4790,6 +4800,128 @@ var exchangeDeviceCode = async ({
   });
   return { ...tokenSet, ok: true };
 };
+var AUTH_REQ_ID_BYTES = 32;
+var DEFAULT_BACKCHANNEL_TTL_MINUTES = 10;
+var DEFAULT_BACKCHANNEL_TTL_MS = MILLISECONDS_IN_A_MINUTE * DEFAULT_BACKCHANNEL_TTL_MINUTES;
+var DEFAULT_BACKCHANNEL_POLL_INTERVAL_SECONDS = 5;
+var CIBA_GRANT_TYPE = "urn:openid:params:grant-type:ciba";
+var issueBackchannelAuth = async ({
+  clientId,
+  config,
+  loginHint,
+  bindingMessage,
+  now = Date.now(),
+  requestedScopes
+}) => {
+  if (!config.backchannelAuthStore || !config.resolveBackchannelUser) {
+    return { error: "invalid_request", ok: false };
+  }
+  const client = await config.clientStore.findClient(clientId);
+  if (!client)
+    return { error: "invalid_client", ok: false };
+  const resolved = await config.resolveBackchannelUser({
+    client,
+    loginHint
+  });
+  if (!resolved)
+    return { error: "unknown_user_id", ok: false };
+  const authReqId = generateSecureToken(AUTH_REQ_ID_BYTES);
+  const ttl = config.backchannelAuthTtlMs ?? DEFAULT_BACKCHANNEL_TTL_MS;
+  const interval = config.backchannelPollIntervalSeconds ?? DEFAULT_BACKCHANNEL_POLL_INTERVAL_SECONDS;
+  await config.backchannelAuthStore.saveBackchannelAuth({
+    authReqId,
+    bindingMessage,
+    clientId,
+    createdAt: now,
+    expiresAt: now + ttl,
+    intervalSeconds: interval,
+    scopes: requestedScopes,
+    status: "pending",
+    userSub: resolved.sub
+  });
+  await config.onBackchannelAuthRequest?.({
+    authReqId,
+    bindingMessage,
+    clientId,
+    scopes: requestedScopes,
+    userSub: resolved.sub
+  });
+  return {
+    auth_req_id: authReqId,
+    expires_in: Math.floor(ttl / MS_PER_SECOND),
+    interval,
+    ok: true
+  };
+};
+var decideBackchannel = async (config, authReqId, approval) => {
+  if (!config.backchannelAuthStore) {
+    return { error: "not_configured", ok: false };
+  }
+  const record = await config.backchannelAuthStore.findByAuthReqId(authReqId);
+  if (!record)
+    return { error: "invalid_auth_req_id", ok: false };
+  if (record.expiresAt < Date.now()) {
+    return { error: "expired_token", ok: false };
+  }
+  if (record.status !== "pending") {
+    return { error: "already_decided", ok: false };
+  }
+  await config.backchannelAuthStore.updateStatus(authReqId, approval.status, approval.userSub ?? record.userSub);
+  return { ok: true };
+};
+var approveBackchannelAuth = async ({
+  authReqId,
+  config,
+  userSub
+}) => decideBackchannel(config, authReqId, {
+  status: "approved",
+  userSub
+});
+var denyBackchannelAuth = async ({
+  authReqId,
+  config
+}) => decideBackchannel(config, authReqId, { status: "denied" });
+var exchangeBackchannelAuth = async ({
+  authReqId,
+  clientCertThumbprint,
+  clientId,
+  config,
+  dpopJkt,
+  now = Date.now()
+}) => {
+  if (!config.backchannelAuthStore) {
+    return { error: "invalid_grant", ok: false };
+  }
+  const record = await config.backchannelAuthStore.findByAuthReqId(authReqId);
+  if (!record || record.clientId !== clientId) {
+    return { error: "invalid_grant", ok: false };
+  }
+  if (record.expiresAt < now) {
+    await config.backchannelAuthStore.deleteByAuthReqId(authReqId);
+    return { error: "expired_token", ok: false };
+  }
+  if (record.lastPolledAt !== undefined && now - record.lastPolledAt < record.intervalSeconds * MS_PER_SECOND) {
+    return { error: "slow_down", ok: false };
+  }
+  await config.backchannelAuthStore.recordPoll(authReqId, now);
+  if (record.status === "pending") {
+    return { error: "authorization_pending", ok: false };
+  }
+  if (record.status === "denied" || record.userSub === undefined) {
+    return { error: "access_denied", ok: false };
+  }
+  await config.backchannelAuthStore.deleteByAuthReqId(authReqId);
+  const tokenSet = await issueTokenSet({
+    clientCertThumbprint,
+    clientId,
+    config,
+    dpopJkt,
+    now,
+    scopes: record.scopes,
+    sub: record.userSub
+  });
+  return { ...tokenSet, ok: true };
+};
 
 // src/oidc/clientAuth.ts
 var CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
@@ -4900,6 +5032,55 @@ var verifyJwtSignedByClient = ({
   client
 }) => verifyJwtSignedByClientImpl(client, jwt);
 
+// src/oidc/mtls.ts
+var RFC9440_HEADER = "client-cert";
+var SF_BINARY_PREFIX = ":";
+var SF_BINARY_SUFFIX = ":";
+var base64Decode2 = (value) => Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
+var base64UrlEncode2 = (bytes) => {
+  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join("");
+  return btoa(binary).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
+};
+var computeCertThumbprint = async (derBytes) => {
+  const digest = await crypto.subtle.digest("SHA-256", derBytes);
+  return base64UrlEncode2(new Uint8Array(digest));
+};
+var extractRfc9440ClientCert = (headers) => {
+  const raw = headers.get(RFC9440_HEADER);
+  if (raw === null)
+    return;
+  const trimmed = raw.trim();
+  if (!trimmed.startsWith(SF_BINARY_PREFIX) || !trimmed.endsWith(SF_BINARY_SUFFIX) || trimmed.length <= 2) {
+    return;
+  }
+  try {
+    return base64Decode2(trimmed.slice(1, -1));
+  } catch {
+    return;
+  }
+};
+var resolveClientCert = async ({
+  extract,
+  headers
+}) => {
+  if (extract !== undefined)
+    return extract(headers);
+  return extractRfc9440ClientCert(headers);
+};
+var verifyCertificateBoundToken = async ({
+  cnfThumbprint,
+  extract,
+  headers
+}) => {
+  if (cnfThumbprint === undefined)
+    return false;
+  const cert = await resolveClientCert({ extract, headers });
+  if (cert === undefined)
+    return false;
+  const presented = await computeCertThumbprint(cert);
+  return presented === cnfThumbprint;
+};
+
 // src/oidc/dpop.ts
 var DEFAULT_MAX_AGE_MS = 60000;
 var SECONDS_TO_MS = 1000;
@@ -5517,6 +5698,7 @@ var oidcProviderRoutes = (config) => {
   const introspectRoute = `${oidcRoute}/introspect`;
   const revokeRoute = `${oidcRoute}/revoke`;
   const deviceAuthorizationRoute = `${oidcRoute}/device_authorization`;
+  const backchannelAuthorizationRoute = `${oidcRoute}/bc-authorize`;
   const deviceApproveRoute = `${oidcRoute}/device/decision`;
   const endSessionRoute = `${oidcRoute}/end_session`;
   const parRoute = `${oidcRoute}/par`;
@@ -5535,27 +5717,57 @@ var oidcProviderRoutes = (config) => {
     const matches = await constantTimeEqual(await hashToken(clientSecret), client.hashedSecret);
     return matches ? client : undefined;
   };
+  const tryMtlsAuth = async ({
+    candidate,
+    extract,
+    requestHeaders
+  }) => {
+    const registered = candidate?.tlsCertificateBoundThumbprints ?? [];
+    if (candidate === undefined || registered.length === 0)
+      return;
+    const cert = await resolveClientCert({
+      extract,
+      headers: requestHeaders
+    });
+    if (cert === undefined)
+      return;
+    const presented = await computeCertThumbprint(cert);
+    if (!registered.includes(presented))
+      return;
+    return { client: candidate, clientCertThumbprint: presented };
+  };
   const authenticateTokenClient = async ({
     basicClientId,
     basicClientSecret,
     bodyClientAssertion,
     bodyClientAssertionType,
     bodyClientId,
-    bodyClientSecret
+    bodyClientSecret,
+    requestHeaders
   }) => {
     if (bodyClientAssertion !== undefined && bodyClientAssertionType === CLIENT_ASSERTION_TYPE) {
-      return verifyClientAssertion({
+      const client2 = await verifyClientAssertion({
         assertion: bodyClientAssertion,
         expectedAudience: tokenUrl,
         jtiStore: config.clientAssertionJtiStore,
         resolveClient: clientStore.findClient
       });
+      return client2 === undefined ? undefined : { client: client2, clientCertThumbprint: undefined };
     }
     const clientId = bodyClientId ?? basicClientId;
-    const clientSecret = bodyClientSecret ?? basicClientSecret;
     if (clientId === undefined)
       return;
-    return authenticateClient(clientId, clientSecret);
+    const candidate = await clientStore.findClient(clientId);
+    const mtlsResult = await tryMtlsAuth({
+      candidate,
+      extract: config.extractTlsClientCert,
+      requestHeaders
+    });
+    if (mtlsResult !== undefined)
+      return mtlsResult;
+    const clientSecret = bodyClientSecret ?? basicClientSecret;
+    const client = await authenticateClient(clientId, clientSecret);
+    return client === undefined ? undefined : { client, clientCertThumbprint: undefined };
   };
   const dpopNonceChallenge = async (proof) => {
     if (proof === undefined || config.dpopNonce === undefined) {
@@ -5580,7 +5792,7 @@ var oidcProviderRoutes = (config) => {
       status: HTTP_UNAUTHORIZED2
     });
   };
-  const grantAuthorizationCode = async (client, body, dpop) => {
+  const grantAuthorizationCode = async (client, body, dpop, clientCertThumbprint) => {
     const {
       code,
       code_verifier: codeVerifier,
@@ -5604,6 +5816,7 @@ var oidcProviderRoutes = (config) => {
     return tokenResponse(await issueTokenSet({
       acr: record.acr,
       claims: record.claims,
+      clientCertThumbprint,
       clientId: client.clientId,
       config,
       dpopJkt: dpopResult?.jkt,
@@ -5612,7 +5825,7 @@ var oidcProviderRoutes = (config) => {
       sub: record.userId
     }));
   };
-  const grantRefreshToken = async (client, body, dpop) => {
+  const grantRefreshToken = async (client, body, dpop, clientCertThumbprint) => {
     const presented = body.refresh_token;
     if (presented === undefined) {
       return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
@@ -5634,6 +5847,7 @@ var oidcProviderRoutes = (config) => {
     return tokenResponse(await issueTokenSet({
       acr: record.acr,
       claims: record.claims,
+      clientCertThumbprint,
       clientId: client.clientId,
       config,
       dpopJkt: record.dpopJkt,
@@ -5671,6 +5885,39 @@ var oidcProviderRoutes = (config) => {
       token_type: dpopResult === undefined ? "Bearer" : "DPoP"
     }, HTTP_OK2);
   };
+  const grantBackchannel = async (client, body, dpop, clientCertThumbprint) => {
+    if (config.backchannelAuthStore === undefined) {
+      return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+    }
+    if (body.auth_req_id === undefined) {
+      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+    }
+    const dpopResult = dpop === undefined ? undefined : await verifyDpopProof({
+      htm: "POST",
+      htu: tokenUrl,
+      proof: dpop
+    });
+    if (dpop !== undefined && dpopResult === undefined) {
+      return oauthError2(HTTP_BAD_REQUEST2, "invalid_dpop_proof");
+    }
+    const result = await exchangeBackchannelAuth({
+      authReqId: body.auth_req_id,
+      clientCertThumbprint,
+      clientId: client.clientId,
+      config,
+      dpopJkt: dpopResult?.jkt
+    });
+    if (!result.ok)
+      return oauthError2(HTTP_BAD_REQUEST2, result.error);
+    return jsonResponse({
+      access_token: result.access_token,
+      expires_in: result.expires_in,
+      id_token: result.id_token,
+      refresh_token: result.refresh_token,
+      scope: result.scope,
+      token_type: dpopResult === undefined ? "Bearer" : "DPoP"
+    }, HTTP_OK2);
+  };
   const grantDeviceCode = async (client, body, dpop) => {
     if (config.deviceAuthorizationStore === undefined) {
       return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
@@ -5711,6 +5958,9 @@ var oidcProviderRoutes = (config) => {
   if (config.deviceAuthorizationStore) {
     grantTypes.push("urn:ietf:params:oauth:grant-type:device_code");
   }
+  if (config.backchannelAuthStore) {
+    grantTypes.push(CIBA_GRANT_TYPE);
+  }
   const discovery = {
     authorization_endpoint: `${issuer}${authorizeRoute}`,
     backchannel_logout_session_supported: false,
@@ -5729,12 +5979,14 @@ var oidcProviderRoutes = (config) => {
     response_types_supported: ["code"],
     revocation_endpoint: `${issuer}${revokeRoute}`,
     subject_types_supported: ["public"],
+    tls_client_certificate_bound_access_tokens: true,
     token_endpoint: tokenUrl,
     token_endpoint_auth_methods_supported: [
       "client_secret_basic",
       "client_secret_post",
       "none",
-      "private_key_jwt"
+      "private_key_jwt",
+      "self_signed_tls_client_auth"
     ],
     token_endpoint_auth_signing_alg_values_supported: ["ES256"],
     userinfo_endpoint: `${issuer}${userinfoRoute}`
@@ -5742,6 +5994,11 @@ var oidcProviderRoutes = (config) => {
   if (config.deviceAuthorizationStore) {
     discovery.device_authorization_endpoint = `${issuer}${deviceAuthorizationRoute}`;
   }
+  if (config.backchannelAuthStore) {
+    discovery.backchannel_authentication_endpoint = `${issuer}${backchannelAuthorizationRoute}`;
+    discovery.backchannel_token_delivery_modes_supported = ["poll"];
+    discovery.backchannel_user_code_parameter_supported = false;
+  }
   if (config.clientRegistrationTokenStore !== undefined) {
     discovery.registration_endpoint = registrationBaseUrl;
   }
@@ -5936,27 +6193,29 @@ var oidcProviderRoutes = (config) => {
       scope: t12.Optional(t12.String()),
       state: t12.Optional(t12.String())
     })
-  }).post(tokenRoute, async ({ body, headers }) => {
+  }).post(tokenRoute, async ({ body, headers, request }) => {
     const basic = readBasicAuth2(headers.authorization);
-    const client = await authenticateTokenClient({
+    const auth = await authenticateTokenClient({
       basicClientId: basic.clientId,
       basicClientSecret: basic.clientSecret,
       bodyClientAssertion: body.client_assertion,
       bodyClientAssertionType: body.client_assertion_type,
       bodyClientId: body.client_id,
-      bodyClientSecret: body.client_secret
+      bodyClientSecret: body.client_secret,
+      requestHeaders: request.headers
     });
-    if (client === undefined) {
+    if (auth === undefined) {
       return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
     }
+    const { client, clientCertThumbprint } = auth;
     const nonceChallenge = await dpopNonceChallenge(headers.dpop);
     if (nonceChallenge !== undefined)
       return nonceChallenge;
     if (body.grant_type === "authorization_code") {
-      return grantAuthorizationCode(client, body, headers.dpop);
+      return grantAuthorizationCode(client, body, headers.dpop, clientCertThumbprint);
     }
     if (body.grant_type === "refresh_token") {
-      return grantRefreshToken(client, body, headers.dpop);
+      return grantRefreshToken(client, body, headers.dpop, clientCertThumbprint);
     }
     if (body.grant_type === "urn:ietf:params:oauth:grant-type:token-exchange") {
       return grantTokenExchange(client, body, headers.dpop);
@@ -5964,10 +6223,14 @@ var oidcProviderRoutes = (config) => {
     if (body.grant_type === "urn:ietf:params:oauth:grant-type:device_code") {
       return grantDeviceCode(client, body, headers.dpop);
     }
+    if (body.grant_type === CIBA_GRANT_TYPE) {
+      return grantBackchannel(client, body, headers.dpop, clientCertThumbprint);
+    }
     return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
   }, {
     body: t12.Object({
       audience: t12.Optional(t12.String()),
+      auth_req_id: t12.Optional(t12.String()),
       client_assertion: t12.Optional(t12.String()),
       client_assertion_type: t12.Optional(t12.String()),
       client_id: t12.Optional(t12.String()),
@@ -5983,22 +6246,24 @@ var oidcProviderRoutes = (config) => {
       subject_token: t12.Optional(t12.String()),
       subject_token_type: t12.Optional(t12.String())
     })
-  }).post(parRoute, async ({ body, headers }) => {
+  }).post(parRoute, async ({ body, headers, request }) => {
     if (config.pushedAuthorizationRequestStore === undefined) {
       return oauthError2(HTTP_NOT_IMPLEMENTED, "unsupported_response_type");
     }
     const basic = readBasicAuth2(headers.authorization);
-    const client = await authenticateTokenClient({
+    const auth = await authenticateTokenClient({
       basicClientId: basic.clientId,
       basicClientSecret: basic.clientSecret,
       bodyClientAssertion: body.client_assertion,
       bodyClientAssertionType: body.client_assertion_type,
       bodyClientId: body.client_id,
-      bodyClientSecret: body.client_secret
+      bodyClientSecret: body.client_secret,
+      requestHeaders: request.headers
     });
-    if (client === undefined) {
+    if (auth === undefined) {
       return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
     }
+    const { client } = auth;
     const isAuthField = (key) => key === "client_assertion" || key === "client_assertion_type" || key === "client_secret";
     const params = Object.fromEntries(Object.entries(body).filter((entry) => typeof entry[1] === "string" && !isAuthField(entry[0])));
     const result = await pushAuthorizationRequest({
@@ -6082,6 +6347,50 @@ var oidcProviderRoutes = (config) => {
     headers: t12.Object({
       authorization: t12.Optional(t12.String())
     })
+  }).post(backchannelAuthorizationRoute, async ({ body, headers }) => {
+    if (config.backchannelAuthStore === undefined) {
+      return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+    }
+    const basic = readBasicAuth2(headers.authorization);
+    const clientId = body.client_id ?? basic.clientId;
+    const clientSecret = body.client_secret ?? basic.clientSecret;
+    if (clientId === undefined) {
+      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+    }
+    const client = await authenticateClient(clientId, clientSecret);
+    if (client === undefined) {
+      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+    }
+    if (body.login_hint === undefined) {
+      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+    }
+    const requested = body.scope === undefined || body.scope.length === 0 ? client.scopes : body.scope.split(" ").filter((entry) => client.scopes.includes(entry));
+    const result = await issueBackchannelAuth({
+      bindingMessage: body.binding_message,
+      clientId: client.clientId,
+      config,
+      loginHint: body.login_hint,
+      now: Date.now(),
+      requestedScopes: requested
+    });
+    if (!result.ok)
+      return oauthError2(HTTP_BAD_REQUEST2, result.error);
+    return jsonResponse({
+      auth_req_id: result.auth_req_id,
+      expires_in: result.expires_in,
+      interval: result.interval
+    }, HTTP_OK2);
+  }, {
+    body: t12.Object({
+      binding_message: t12.Optional(t12.String()),
+      client_id: t12.Optional(t12.String()),
+      client_secret: t12.Optional(t12.String()),
+      login_hint: t12.Optional(t12.String()),
+      scope: t12.Optional(t12.String())
+    }),
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    })
   }).post(deviceAuthorizationRoute, async ({ body, headers }) => {
     if (config.deviceAuthorizationStore === undefined) {
       return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
@@ -21542,6 +21851,30 @@ var createInMemoryAuthorizationCodeStore = () => {
     }
   };
 };
+var createInMemoryBackchannelAuthStore = () => {
+  const byAuthReqId = new Map;
+  return {
+    deleteByAuthReqId: async (authReqId) => {
+      byAuthReqId.delete(authReqId);
+    },
+    findByAuthReqId: async (authReqId) => byAuthReqId.get(authReqId),
+    recordPoll: async (authReqId, polledAt) => {
+      const record = byAuthReqId.get(authReqId);
+      if (!record)
+        return;
+      byAuthReqId.set(authReqId, { ...record, lastPolledAt: polledAt });
+    },
+    saveBackchannelAuth: async (request) => {
+      byAuthReqId.set(request.authReqId, { ...request });
+    },
+    updateStatus: async (authReqId, status, userSub) => {
+      const record = byAuthReqId.get(authReqId);
+      if (!record)
+        return;
+      byAuthReqId.set(authReqId, { ...record, status, userSub });
+    }
+  };
+};
 var createInMemoryClientAssertionJtiStore = () => {
   const seen = new Map;
   return {
@@ -21689,6 +22022,20 @@ var createInMemoryPushedAuthorizationRequestStore = () => {
 var URL_LENGTH = 2048;
 var DEFAULT_LIST_LIMIT2 = 100;
 var ID_LENGTH7 = 255;
+var oauthBackchannelAuthRequestsTable = pgTable("auth_oauth_backchannel_auth_requests", {
+  auth_req_id: varchar("auth_req_id", { length: ID_LENGTH7 }).primaryKey(),
+  binding_message: text("binding_message"),
+  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  interval_seconds: bigint("interval_seconds", {
+    mode: "number"
+  }).notNull(),
+  last_polled_at_ms: bigint("last_polled_at_ms", { mode: "number" }),
+  scopes: text("scopes").array().notNull(),
+  status: varchar("status", { length: 16 }).notNull(),
+  user_sub: varchar("user_sub", { length: ID_LENGTH7 })
+});
 var oauthClientAssertionJtisTable = pgTable("auth_oauth_client_assertion_jtis", {
   client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
   composite_key: varchar("composite_key", {
@@ -22054,6 +22401,48 @@ var createPostgresPushedAuthorizationRequestStore = (db) => ({
     });
   }
 });
+var toBackchannelAuth = (row) => ({
+  authReqId: row.auth_req_id,
+  bindingMessage: row.binding_message ?? undefined,
+  clientId: row.client_id,
+  createdAt: row.created_at_ms,
+  expiresAt: row.expires_at_ms,
+  intervalSeconds: row.interval_seconds,
+  lastPolledAt: row.last_polled_at_ms ?? undefined,
+  scopes: row.scopes,
+  status: row.status,
+  userSub: row.user_sub ?? undefined
+});
+var createNeonBackchannelAuthStore = (databaseUrl) => createPostgresBackchannelAuthStore(createNeonDatabase(databaseUrl));
+var createPostgresBackchannelAuthStore = (db) => ({
+  deleteByAuthReqId: async (authReqId) => {
+    await db.delete(oauthBackchannelAuthRequestsTable).where(eq(oauthBackchannelAuthRequestsTable.auth_req_id, authReqId));
+  },
+  findByAuthReqId: async (authReqId) => {
+    const [row] = await db.select().from(oauthBackchannelAuthRequestsTable).where(eq(oauthBackchannelAuthRequestsTable.auth_req_id, authReqId)).limit(1);
+    return row ? toBackchannelAuth(row) : undefined;
+  },
+  recordPoll: async (authReqId, polledAt) => {
+    await db.update(oauthBackchannelAuthRequestsTable).set({ last_polled_at_ms: polledAt }).where(eq(oauthBackchannelAuthRequestsTable.auth_req_id, authReqId));
+  },
+  saveBackchannelAuth: async (request) => {
+    await db.insert(oauthBackchannelAuthRequestsTable).values({
+      auth_req_id: request.authReqId,
+      binding_message: request.bindingMessage ?? null,
+      client_id: request.clientId,
+      created_at_ms: request.createdAt,
+      expires_at_ms: request.expiresAt,
+      interval_seconds: request.intervalSeconds,
+      last_polled_at_ms: request.lastPolledAt ?? null,
+      scopes: request.scopes,
+      status: request.status,
+      user_sub: request.userSub ?? null
+    });
+  },
+  updateStatus: async (authReqId, status, userSub) => {
+    await db.update(oauthBackchannelAuthRequestsTable).set({ status, user_sub: userSub ?? null }).where(eq(oauthBackchannelAuthRequestsTable.auth_req_id, authReqId));
+  }
+});
 // src/adaptive/config.ts
 var DEFAULT_HISTORY_LIMIT = 50;
 var DEFAULT_MAX_TRAVEL_KMH = 900;
@@ -23316,6 +23705,7 @@ var blockMigrations = {
   lockout: initMigration("lockout", [lockoutsTable]),
   mfa: initMigration("mfa", [mfaEnrollmentsTable]),
   oidc: initMigration("oidc", [
+    oauthBackchannelAuthRequestsTable,
     oauthClientAssertionJtisTable,
     oauthClientRegistrationTokensTable,
     oauthClientsTable,
@@ -23950,6 +24340,7 @@ export {
   verifyDpopNonce,
   verifyCognitoSha256,
   verifyClientAssertion,
+  verifyCertificateBoundToken,
   verifyAuth0Pbkdf2,
   verifyAuditChain,
   verifyApiKey,
@@ -23998,6 +24389,7 @@ export {
   resolveOAuthAuthorization,
   resolveCookieSecure,
   resolveClientProviderEntry,
+  resolveClientCert,
   resolveAuthHtmxRenderers,
   resolveApiPrincipal,
   removeFromSessionRing,
@@ -24034,6 +24426,7 @@ export {
   oauthClientsTable,
   oauthClientRegistrationTokensTable,
   oauthClientAssertionJtisTable,
+  oauthBackchannelAuthRequestsTable,
   mintLogoutToken,
   mintDpopNonce,
   mfaTotpRoutes,
@@ -24052,6 +24445,7 @@ export {
   jwkThumbprint,
   issueTokenSet,
   issueDeviceAuthorization,
+  issueBackchannelAuth,
   isValidUser,
   isValidProviderOption,
   isUserSessionId,
@@ -24092,17 +24486,20 @@ export {
   fingerprintDevice,
   fetchUserInfo,
   fanOutBackchannelLogout,
+  extractRfc9440ClientCert,
   extractPropFromIdentity,
   extractDpopNonceClaim,
   exportAuditCsv,
   exchangeToken,
   exchangeDeviceCode,
   exchangeClientCredentials,
+  exchangeBackchannelAuth,
   evaluatePassword,
   endImpersonation,
   encryptTotpSecret,
   encryptSecret,
   denyDeviceAuthorization,
+  denyBackchannelAuth,
   deleteWarrant,
   deleteRegisteredClient,
   defineProvidersConfiguration,
@@ -24157,6 +24554,7 @@ export {
   createPostgresCredentialStore,
   createPostgresClientRegistrationTokenStore,
   createPostgresClientAssertionJtiStore,
+  createPostgresBackchannelAuthStore,
   createPostgresAuthorizationCodeStore,
   createPostgresAuditSink,
   createPostgresApiKeyStore,
@@ -24191,6 +24589,7 @@ export {
   createNeonCredentialStore,
   createNeonClientRegistrationTokenStore,
   createNeonClientAssertionJtiStore,
+  createNeonBackchannelAuthStore,
   createNeonAuthorizationCodeStore,
   createNeonAuthSessionStore,
   createNeonAuditSink,
@@ -24227,6 +24626,7 @@ export {
   createInMemoryClientRegistrationTokenStore,
   createInMemoryClientAssertionJtiStore,
   createInMemoryCheckCache,
+  createInMemoryBackchannelAuthStore,
   createInMemoryAuthorizationCodeStore,
   createInMemoryAuthSessionStore,
   createInMemoryAuditSink,
@@ -24246,6 +24646,7 @@ export {
   consumePushedRequest,
   consumeBackupCode,
   constantTimeEqual,
+  computeCertThumbprint,
   complianceRoutes,
   check,
   buildClientProviders,
@@ -24260,6 +24661,7 @@ export {
   assessRisk,
   assessAbuse,
   approveDeviceAuthorization,
+  approveBackchannelAuth,
   apiKeysTable,
   apiKeysRoutes,
   apiClientsTable,
@@ -24297,8 +24699,9 @@ export {
   DEFAULT_CREDENTIAL_SESSION_TTL_MS,
   DEFAULT_BACKUP_CODE_COUNT,
   CLIENT_ASSERTION_TYPE,
+  CIBA_GRANT_TYPE,
   AuthIdentityConflictError
 };
 
-//# debugId=E33462A0DBAD894164756E2164756E21
+//# debugId=1069DAAF739CAF9F64756E2164756E21
 //# sourceMappingURL=index.js.map