@absolutejs/auth 0.36.0-beta.0 → 0.36.0

package/dist/index.d.ts

@@ -15154,6 +15154,7 @@ export type { DpopResult } from './oidc/dpop';
 export { CLIENT_ASSERTION_TYPE, verifyClientAssertion, verifyJwtSignedByClient } from './oidc/clientAuth';
 export { parseSignedRequestObject } from './oidc/jar';
 export type { JarParseResult } from './oidc/jar';
+export { computeCertThumbprint, extractRfc9440ClientCert, resolveClientCert, verifyCertificateBoundToken } from './oidc/mtls';
 export { createInMemoryAuthorizationCodeStore, createInMemoryBackchannelAuthStore, createInMemoryClientAssertionJtiStore, createInMemoryClientRegistrationTokenStore, createInMemoryDeviceAuthorizationStore, createInMemoryInitialAccessTokenStore, createInMemoryLogoutDeliveryStore, createInMemoryOAuthClientStore, createInMemoryOidcRefreshTokenStore, createInMemoryPushedAuthorizationRequestStore } from './oidc/inMemoryStores';
 export { consumePushedRequest, pushAuthorizationRequest, DEFAULT_PAR_TTL_MS, REQUEST_URI_PREFIX } from './oidc/par';
 export { fetchUserInfo, readUserInfoBearer, userInfoChallengeHeader } from './oidc/userinfo';

package/dist/index.js

@@ -4492,6 +4492,7 @@ var RESERVED_ACCESS_CLAIMS = new Set([
 var buildAccessClaims = ({
   act,
   audience,
+  clientCertThumbprint,
   clientId,
   dpopJkt,
   extraClaims,
@@ -4516,8 +4517,15 @@ var buildAccessClaims = ({
   };
   if (act !== undefined)
     claims.act = act;
-  if (dpopJkt !== undefined)
-    claims.cnf = { jkt: dpopJkt };
+  if (dpopJkt !== undefined || clientCertThumbprint !== undefined) {
+    const cnf = {};
+    if (dpopJkt !== undefined)
+      cnf.jkt = dpopJkt;
+    if (clientCertThumbprint !== undefined) {
+      cnf["x5t#S256"] = clientCertThumbprint;
+    }
+    claims.cnf = cnf;
+  }
   return claims;
 };
 var exchangeToken = async ({
@@ -4567,6 +4575,7 @@ var exchangeToken = async ({
 var issueTokenSet = async ({
   acr,
   claims,
+  clientCertThumbprint,
   clientId,
   config,
   dpopJkt,
@@ -4584,6 +4593,7 @@ var issueTokenSet = async ({
     sub
   });
   const accessPayload = buildAccessClaims({
+    clientCertThumbprint,
     clientId,
     dpopJkt,
     extraClaims: { ...accessExtra, ...acr === undefined ? {} : { acr } },
@@ -4873,6 +4883,7 @@ var denyBackchannelAuth = async ({
 }) => decideBackchannel(config, authReqId, { status: "denied" });
 var exchangeBackchannelAuth = async ({
   authReqId,
+  clientCertThumbprint,
   clientId,
   config,
   dpopJkt,
@@ -4901,6 +4912,7 @@ var exchangeBackchannelAuth = async ({
   }
   await config.backchannelAuthStore.deleteByAuthReqId(authReqId);
   const tokenSet = await issueTokenSet({
+    clientCertThumbprint,
     clientId,
     config,
     dpopJkt,
@@ -5020,6 +5032,55 @@ var verifyJwtSignedByClient = ({
   client
 }) => verifyJwtSignedByClientImpl(client, jwt);
 
+// src/oidc/mtls.ts
+var RFC9440_HEADER = "client-cert";
+var SF_BINARY_PREFIX = ":";
+var SF_BINARY_SUFFIX = ":";
+var base64Decode2 = (value) => Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
+var base64UrlEncode2 = (bytes) => {
+  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join("");
+  return btoa(binary).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
+};
+var computeCertThumbprint = async (derBytes) => {
+  const digest = await crypto.subtle.digest("SHA-256", derBytes);
+  return base64UrlEncode2(new Uint8Array(digest));
+};
+var extractRfc9440ClientCert = (headers) => {
+  const raw = headers.get(RFC9440_HEADER);
+  if (raw === null)
+    return;
+  const trimmed = raw.trim();
+  if (!trimmed.startsWith(SF_BINARY_PREFIX) || !trimmed.endsWith(SF_BINARY_SUFFIX) || trimmed.length <= 2) {
+    return;
+  }
+  try {
+    return base64Decode2(trimmed.slice(1, -1));
+  } catch {
+    return;
+  }
+};
+var resolveClientCert = async ({
+  extract,
+  headers
+}) => {
+  if (extract !== undefined)
+    return extract(headers);
+  return extractRfc9440ClientCert(headers);
+};
+var verifyCertificateBoundToken = async ({
+  cnfThumbprint,
+  extract,
+  headers
+}) => {
+  if (cnfThumbprint === undefined)
+    return false;
+  const cert = await resolveClientCert({ extract, headers });
+  if (cert === undefined)
+    return false;
+  const presented = await computeCertThumbprint(cert);
+  return presented === cnfThumbprint;
+};
+
 // src/oidc/dpop.ts
 var DEFAULT_MAX_AGE_MS = 60000;
 var SECONDS_TO_MS = 1000;
@@ -5656,27 +5717,57 @@ var oidcProviderRoutes = (config) => {
     const matches = await constantTimeEqual(await hashToken(clientSecret), client.hashedSecret);
     return matches ? client : undefined;
   };
+  const tryMtlsAuth = async ({
+    candidate,
+    extract,
+    requestHeaders
+  }) => {
+    const registered = candidate?.tlsCertificateBoundThumbprints ?? [];
+    if (candidate === undefined || registered.length === 0)
+      return;
+    const cert = await resolveClientCert({
+      extract,
+      headers: requestHeaders
+    });
+    if (cert === undefined)
+      return;
+    const presented = await computeCertThumbprint(cert);
+    if (!registered.includes(presented))
+      return;
+    return { client: candidate, clientCertThumbprint: presented };
+  };
   const authenticateTokenClient = async ({
     basicClientId,
     basicClientSecret,
     bodyClientAssertion,
     bodyClientAssertionType,
     bodyClientId,
-    bodyClientSecret
+    bodyClientSecret,
+    requestHeaders
   }) => {
     if (bodyClientAssertion !== undefined && bodyClientAssertionType === CLIENT_ASSERTION_TYPE) {
-      return verifyClientAssertion({
+      const client2 = await verifyClientAssertion({
         assertion: bodyClientAssertion,
         expectedAudience: tokenUrl,
         jtiStore: config.clientAssertionJtiStore,
         resolveClient: clientStore.findClient
       });
+      return client2 === undefined ? undefined : { client: client2, clientCertThumbprint: undefined };
     }
     const clientId = bodyClientId ?? basicClientId;
-    const clientSecret = bodyClientSecret ?? basicClientSecret;
     if (clientId === undefined)
       return;
-    return authenticateClient(clientId, clientSecret);
+    const candidate = await clientStore.findClient(clientId);
+    const mtlsResult = await tryMtlsAuth({
+      candidate,
+      extract: config.extractTlsClientCert,
+      requestHeaders
+    });
+    if (mtlsResult !== undefined)
+      return mtlsResult;
+    const clientSecret = bodyClientSecret ?? basicClientSecret;
+    const client = await authenticateClient(clientId, clientSecret);
+    return client === undefined ? undefined : { client, clientCertThumbprint: undefined };
   };
   const dpopNonceChallenge = async (proof) => {
     if (proof === undefined || config.dpopNonce === undefined) {
@@ -5701,7 +5792,7 @@ var oidcProviderRoutes = (config) => {
       status: HTTP_UNAUTHORIZED2
     });
   };
-  const grantAuthorizationCode = async (client, body, dpop) => {
+  const grantAuthorizationCode = async (client, body, dpop, clientCertThumbprint) => {
     const {
       code,
       code_verifier: codeVerifier,
@@ -5725,6 +5816,7 @@ var oidcProviderRoutes = (config) => {
     return tokenResponse(await issueTokenSet({
       acr: record.acr,
       claims: record.claims,
+      clientCertThumbprint,
       clientId: client.clientId,
       config,
       dpopJkt: dpopResult?.jkt,
@@ -5733,7 +5825,7 @@ var oidcProviderRoutes = (config) => {
       sub: record.userId
     }));
   };
-  const grantRefreshToken = async (client, body, dpop) => {
+  const grantRefreshToken = async (client, body, dpop, clientCertThumbprint) => {
     const presented = body.refresh_token;
     if (presented === undefined) {
       return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
@@ -5755,6 +5847,7 @@ var oidcProviderRoutes = (config) => {
     return tokenResponse(await issueTokenSet({
       acr: record.acr,
       claims: record.claims,
+      clientCertThumbprint,
       clientId: client.clientId,
       config,
       dpopJkt: record.dpopJkt,
@@ -5792,7 +5885,7 @@ var oidcProviderRoutes = (config) => {
       token_type: dpopResult === undefined ? "Bearer" : "DPoP"
     }, HTTP_OK2);
   };
-  const grantBackchannel = async (client, body, dpop) => {
+  const grantBackchannel = async (client, body, dpop, clientCertThumbprint) => {
     if (config.backchannelAuthStore === undefined) {
       return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
     }
@@ -5809,6 +5902,7 @@ var oidcProviderRoutes = (config) => {
     }
     const result = await exchangeBackchannelAuth({
       authReqId: body.auth_req_id,
+      clientCertThumbprint,
       clientId: client.clientId,
       config,
       dpopJkt: dpopResult?.jkt
@@ -5885,12 +5979,14 @@ var oidcProviderRoutes = (config) => {
     response_types_supported: ["code"],
     revocation_endpoint: `${issuer}${revokeRoute}`,
     subject_types_supported: ["public"],
+    tls_client_certificate_bound_access_tokens: true,
     token_endpoint: tokenUrl,
     token_endpoint_auth_methods_supported: [
       "client_secret_basic",
       "client_secret_post",
       "none",
-      "private_key_jwt"
+      "private_key_jwt",
+      "self_signed_tls_client_auth"
     ],
     token_endpoint_auth_signing_alg_values_supported: ["ES256"],
     userinfo_endpoint: `${issuer}${userinfoRoute}`
@@ -6097,27 +6193,29 @@ var oidcProviderRoutes = (config) => {
       scope: t12.Optional(t12.String()),
       state: t12.Optional(t12.String())
     })
-  }).post(tokenRoute, async ({ body, headers }) => {
+  }).post(tokenRoute, async ({ body, headers, request }) => {
     const basic = readBasicAuth2(headers.authorization);
-    const client = await authenticateTokenClient({
+    const auth = await authenticateTokenClient({
       basicClientId: basic.clientId,
       basicClientSecret: basic.clientSecret,
       bodyClientAssertion: body.client_assertion,
       bodyClientAssertionType: body.client_assertion_type,
       bodyClientId: body.client_id,
-      bodyClientSecret: body.client_secret
+      bodyClientSecret: body.client_secret,
+      requestHeaders: request.headers
     });
-    if (client === undefined) {
+    if (auth === undefined) {
       return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
     }
+    const { client, clientCertThumbprint } = auth;
     const nonceChallenge = await dpopNonceChallenge(headers.dpop);
     if (nonceChallenge !== undefined)
       return nonceChallenge;
     if (body.grant_type === "authorization_code") {
-      return grantAuthorizationCode(client, body, headers.dpop);
+      return grantAuthorizationCode(client, body, headers.dpop, clientCertThumbprint);
     }
     if (body.grant_type === "refresh_token") {
-      return grantRefreshToken(client, body, headers.dpop);
+      return grantRefreshToken(client, body, headers.dpop, clientCertThumbprint);
     }
     if (body.grant_type === "urn:ietf:params:oauth:grant-type:token-exchange") {
       return grantTokenExchange(client, body, headers.dpop);
@@ -6126,7 +6224,7 @@ var oidcProviderRoutes = (config) => {
       return grantDeviceCode(client, body, headers.dpop);
     }
     if (body.grant_type === CIBA_GRANT_TYPE) {
-      return grantBackchannel(client, body, headers.dpop);
+      return grantBackchannel(client, body, headers.dpop, clientCertThumbprint);
     }
     return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
   }, {
@@ -6148,22 +6246,24 @@ var oidcProviderRoutes = (config) => {
       subject_token: t12.Optional(t12.String()),
       subject_token_type: t12.Optional(t12.String())
     })
-  }).post(parRoute, async ({ body, headers }) => {
+  }).post(parRoute, async ({ body, headers, request }) => {
     if (config.pushedAuthorizationRequestStore === undefined) {
       return oauthError2(HTTP_NOT_IMPLEMENTED, "unsupported_response_type");
     }
     const basic = readBasicAuth2(headers.authorization);
-    const client = await authenticateTokenClient({
+    const auth = await authenticateTokenClient({
       basicClientId: basic.clientId,
       basicClientSecret: basic.clientSecret,
       bodyClientAssertion: body.client_assertion,
       bodyClientAssertionType: body.client_assertion_type,
       bodyClientId: body.client_id,
-      bodyClientSecret: body.client_secret
+      bodyClientSecret: body.client_secret,
+      requestHeaders: request.headers
     });
-    if (client === undefined) {
+    if (auth === undefined) {
       return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
     }
+    const { client } = auth;
     const isAuthField = (key) => key === "client_assertion" || key === "client_assertion_type" || key === "client_secret";
     const params = Object.fromEntries(Object.entries(body).filter((entry) => typeof entry[1] === "string" && !isAuthField(entry[0])));
     const result = await pushAuthorizationRequest({
@@ -24240,6 +24340,7 @@ export {
   verifyDpopNonce,
   verifyCognitoSha256,
   verifyClientAssertion,
+  verifyCertificateBoundToken,
   verifyAuth0Pbkdf2,
   verifyAuditChain,
   verifyApiKey,
@@ -24288,6 +24389,7 @@ export {
   resolveOAuthAuthorization,
   resolveCookieSecure,
   resolveClientProviderEntry,
+  resolveClientCert,
   resolveAuthHtmxRenderers,
   resolveApiPrincipal,
   removeFromSessionRing,
@@ -24384,6 +24486,7 @@ export {
   fingerprintDevice,
   fetchUserInfo,
   fanOutBackchannelLogout,
+  extractRfc9440ClientCert,
   extractPropFromIdentity,
   extractDpopNonceClaim,
   exportAuditCsv,
@@ -24543,6 +24646,7 @@ export {
   consumePushedRequest,
   consumeBackupCode,
   constantTimeEqual,
+  computeCertThumbprint,
   complianceRoutes,
   check,
   buildClientProviders,
@@ -24599,5 +24703,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=6F90E4F856A11E4B64756E2164756E21
+//# debugId=1069DAAF739CAF9F64756E2164756E21
 //# sourceMappingURL=index.js.map