@absolutejs/auth 0.35.0 → 0.36.0

package/dist/oidc/config.d.ts

@@ -1,7 +1,7 @@
 import type { RouteString } from '../types';
 import { type SigningKey } from './keys';
 import type { OnClientRegistration } from './registration';
-import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
+import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
 export declare const DEFAULT_OIDC_ROUTE: RouteString;
 export type OidcProviderConfig<UserType> = {
     accessTokenTtlMs?: number;
@@ -13,6 +13,22 @@ export type OidcProviderConfig<UserType> = {
     deviceAuthorizationStore?: DeviceAuthorizationStore;
     deviceCodeTtlMs?: number;
     devicePollIntervalSeconds?: number;
+    backchannelAuthStore?: BackchannelAuthStore;
+    backchannelAuthTtlMs?: number;
+    backchannelPollIntervalSeconds?: number;
+    resolveBackchannelUser?: (hint: {
+        client: OAuthClient;
+        loginHint: string;
+    }) => Promise<{
+        sub: string;
+    } | undefined>;
+    onBackchannelAuthRequest?: (context: {
+        authReqId: string;
+        bindingMessage: string | undefined;
+        clientId: string;
+        scopes: string[];
+        userSub: string;
+    }) => Promise<void> | void;
     getAccessTokenClaims?: (context: {
         audience?: string;
         clientId: string;
@@ -35,6 +51,7 @@ export type OidcProviderConfig<UserType> = {
     dpopNonce?: {
         secret: string;
     };
+    extractTlsClientCert?: (headers: Headers) => Promise<Uint8Array | undefined> | Uint8Array | undefined;
     getAcr?: (context: {
         scopes: string[];
         user: UserType;
@@ -68,9 +85,10 @@ export declare const exchangeToken: <UserType>({ actorClientId, audience, config
     requestedScopes?: string[];
     subjectToken: string;
 }) => Promise<TokenExchangeResult>;
-export declare const issueTokenSet: <UserType>({ acr, claims, clientId, config, dpopJkt, nonce, now, scopes, sub }: {
+export declare const issueTokenSet: <UserType>({ acr, claims, clientCertThumbprint, clientId, config, dpopJkt, nonce, now, scopes, sub }: {
     acr?: string;
     claims?: Record<string, unknown>;
+    clientCertThumbprint?: string;
     clientId: string;
     config: OidcProviderConfig<UserType>;
     dpopJkt?: string;
@@ -182,3 +200,59 @@ export declare const exchangeDeviceCode: <UserType>({ clientId, config, deviceCo
     dpopJkt?: string;
     now?: number;
 }) => Promise<DeviceCodeExchangeResult>;
+export declare const CIBA_GRANT_TYPE = "urn:openid:params:grant-type:ciba";
+export type BackchannelAuthResponse = {
+    auth_req_id: string;
+    expires_in: number;
+    interval: number;
+};
+export type BackchannelAuthError = 'expired_login_hint_token' | 'invalid_client' | 'invalid_request' | 'unknown_user_id';
+export declare const issueBackchannelAuth: <UserType>({ clientId, config, loginHint, bindingMessage, now, requestedScopes }: {
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    loginHint: string;
+    bindingMessage?: string;
+    now?: number;
+    requestedScopes: string[];
+}) => Promise<{
+    error: BackchannelAuthError;
+    ok: false;
+} | ({
+    ok: true;
+} & BackchannelAuthResponse)>;
+export type BackchannelDecisionResult = {
+    error: 'already_decided' | 'expired_token' | 'invalid_auth_req_id' | 'not_configured';
+    ok: false;
+} | {
+    ok: true;
+};
+export declare const approveBackchannelAuth: <UserType>({ authReqId, config, userSub }: {
+    authReqId: string;
+    config: OidcProviderConfig<UserType>;
+    userSub?: string;
+}) => Promise<BackchannelDecisionResult>;
+export declare const denyBackchannelAuth: <UserType>({ authReqId, config }: {
+    authReqId: string;
+    config: OidcProviderConfig<UserType>;
+}) => Promise<BackchannelDecisionResult>;
+export type BackchannelExchangeError = 'access_denied' | 'authorization_pending' | 'expired_token' | 'invalid_grant' | 'slow_down';
+export type BackchannelExchangeResult = {
+    access_token: string;
+    expires_in: number;
+    id_token: string;
+    ok: true;
+    refresh_token: string;
+    scope: string;
+    token_type: 'Bearer' | 'DPoP';
+} | {
+    error: BackchannelExchangeError;
+    ok: false;
+};
+export declare const exchangeBackchannelAuth: <UserType>({ authReqId, clientCertThumbprint, clientId, config, dpopJkt, now }: {
+    authReqId: string;
+    clientCertThumbprint?: string;
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    dpopJkt?: string;
+    now?: number;
+}) => Promise<BackchannelExchangeResult>;

package/dist/oidc/inMemoryStores.d.ts

@@ -1,5 +1,6 @@
-import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
+import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
 export declare const createInMemoryAuthorizationCodeStore: () => AuthorizationCodeStore;
+export declare const createInMemoryBackchannelAuthStore: () => BackchannelAuthStore;
 export declare const createInMemoryClientAssertionJtiStore: () => ClientAssertionJtiStore;
 export declare const createInMemoryClientRegistrationTokenStore: () => ClientRegistrationTokenStore;
 export declare const createInMemoryDeviceAuthorizationStore: () => DeviceAuthorizationStore;

package/dist/oidc/mtls.d.ts

@@ -0,0 +1,11 @@
+export declare const computeCertThumbprint: (derBytes: Uint8Array) => Promise<string>;
+export declare const extractRfc9440ClientCert: (headers: Headers) => Uint8Array<ArrayBuffer> | undefined;
+export declare const resolveClientCert: ({ extract, headers }: {
+    extract: ((headers: Headers) => Promise<Uint8Array | undefined> | Uint8Array | undefined) | undefined;
+    headers: Headers;
+}) => Promise<Uint8Array<ArrayBufferLike> | undefined>;
+export declare const verifyCertificateBoundToken: ({ cnfThumbprint, extract, headers }: {
+    cnfThumbprint: string | undefined;
+    extract: ((headers: Headers) => Promise<Uint8Array | undefined> | Uint8Array | undefined) | undefined;
+    headers: Headers;
+}) => Promise<boolean>;

package/dist/oidc/postgresStores.d.ts

@@ -1,5 +1,216 @@
 import { type AnyPgDatabase } from '../stores/postgres';
-import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
+import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
+export declare const oauthBackchannelAuthRequestsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_oauth_backchannel_auth_requests";
+    schema: undefined;
+    columns: {
+        auth_req_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "auth_req_id";
+            tableName: "auth_oauth_backchannel_auth_requests";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        binding_message: import("drizzle-orm/pg-core").PgColumn<{
+            name: "binding_message";
+            tableName: "auth_oauth_backchannel_auth_requests";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        client_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "client_id";
+            tableName: "auth_oauth_backchannel_auth_requests";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at_ms";
+            tableName: "auth_oauth_backchannel_auth_requests";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at_ms";
+            tableName: "auth_oauth_backchannel_auth_requests";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        interval_seconds: import("drizzle-orm/pg-core").PgColumn<{
+            name: "interval_seconds";
+            tableName: "auth_oauth_backchannel_auth_requests";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        last_polled_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_polled_at_ms";
+            tableName: "auth_oauth_backchannel_auth_requests";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        scopes: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scopes";
+            tableName: "auth_oauth_backchannel_auth_requests";
+            dataType: "array";
+            columnType: "PgArray";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: import("drizzle-orm").Column<{
+                name: "scopes";
+                tableName: "auth_oauth_backchannel_auth_requests";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            baseBuilder: import("drizzle-orm/pg-core").PgColumnBuilder<{
+                name: "scopes";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                enumValues: [string, ...string[]];
+                driverParam: string;
+            }, {}, {}, import("drizzle-orm").ColumnBuilderExtraConfig>;
+            size: undefined;
+        }>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "auth_oauth_backchannel_auth_requests";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 16;
+        }>;
+        user_sub: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_sub";
+            tableName: "auth_oauth_backchannel_auth_requests";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+    };
+    dialect: "pg";
+}>;
 export declare const oauthClientAssertionJtisTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_oauth_client_assertion_jtis";
     schema: undefined;
@@ -1386,3 +1597,5 @@ export declare const createPostgresLogoutDeliveryStore: (db: AnyPgDatabase) => L
 export declare const createPostgresOAuthClientStore: (db: AnyPgDatabase) => OAuthClientStore;
 export declare const createPostgresOidcRefreshTokenStore: (db: AnyPgDatabase) => OidcRefreshTokenStore;
 export declare const createPostgresPushedAuthorizationRequestStore: (db: AnyPgDatabase) => PushedAuthorizationRequestStore;
+export declare const createNeonBackchannelAuthStore: (databaseUrl: string) => BackchannelAuthStore;
+export declare const createPostgresBackchannelAuthStore: (db: AnyPgDatabase) => BackchannelAuthStore;

package/dist/oidc/routes.d.ts

@@ -68,6 +68,7 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
                 resource?: string | undefined;
                 refresh_token?: string | undefined;
                 device_code?: string | undefined;
+                auth_req_id?: string | undefined;
                 client_secret?: string | undefined;
                 grant_type?: string | undefined;
                 code?: string | undefined;
@@ -190,6 +191,35 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
             };
         };
     };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                client_id?: string | undefined;
+                scope?: string | undefined;
+                client_secret?: string | undefined;
+                binding_message?: string | undefined;
+                login_hint?: string | undefined;
+            };
+            params: {};
+            query: unknown;
+            headers: {
+                authorization?: string | undefined;
+            };
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
 } & {
     [x: string]: {
         post: {

package/dist/oidc/types.d.ts

@@ -10,6 +10,7 @@ export type OAuthClient = {
     requirePushedAuthorizationRequests?: boolean;
     requireSignedRequestObject?: boolean;
     scopes: string[];
+    tlsCertificateBoundThumbprints?: string[];
 };
 export type ClientAssertionJtiStore = {
     recordIfFresh: (clientId: string, jti: string, expiresAt: number) => Promise<boolean>;
@@ -115,3 +116,25 @@ export type DeviceAuthorizationStore = {
     saveDeviceAuthorization: (deviceAuthorization: DeviceAuthorization) => Promise<void>;
     updateStatus: (deviceCodeHash: string, status: DeviceAuthorizationStatus, userSub?: string) => Promise<void>;
 };
+export type BackchannelAuthStatus = 'approved' | 'denied' | 'pending';
+export type BackchannelAuthRequest = {
+    authReqId: string;
+    bindingMessage?: string;
+    clientId: string;
+    createdAt: number;
+    expiresAt: number;
+    /** Poll-mode interval seconds. Bumped by 5 each time the client polls faster than
+     *  allowed (returns `slow_down` until the new interval has elapsed). */
+    intervalSeconds: number;
+    lastPolledAt?: number;
+    scopes: string[];
+    status: BackchannelAuthStatus;
+    userSub?: string;
+};
+export type BackchannelAuthStore = {
+    deleteByAuthReqId: (authReqId: string) => Promise<void>;
+    findByAuthReqId: (authReqId: string) => Promise<BackchannelAuthRequest | undefined>;
+    recordPoll: (authReqId: string, at: number) => Promise<void>;
+    saveBackchannelAuth: (request: BackchannelAuthRequest) => Promise<void>;
+    updateStatus: (authReqId: string, status: BackchannelAuthStatus, userSub?: string) => Promise<void>;
+};

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.35.0",
+	"version": "0.36.0",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {