@absolutejs/auth 0.38.0 → 0.40.0-beta.1

package/dist/oidc/config.d.ts

@@ -1,6 +1,7 @@
 import type { RouteString } from '../types';
 import { type SigningKey } from './keys';
 import type { OnClientRegistration } from './registration';
+import type { VciConfig } from './vci';
 import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
 export declare const DEFAULT_OIDC_ROUTE: RouteString;
 export type OidcProviderConfig<UserType> = {
@@ -66,6 +67,7 @@ export type OidcProviderConfig<UserType> = {
     refreshTokenStore: OidcRefreshTokenStore;
     refreshTokenTtlMs?: number;
     signingKey: SigningKey;
+    vciConfig?: VciConfig;
 };
 export type TokenExchangeResult = {
     error: 'invalid_grant' | 'invalid_scope';

package/dist/oidc/inMemoryVciStores.d.ts

@@ -0,0 +1,3 @@
+import type { CredentialNonceStore, CredentialOfferStore } from './vci';
+export declare const createInMemoryCredentialNonceStore: () => CredentialNonceStore;
+export declare const createInMemoryCredentialOfferStore: () => CredentialOfferStore;

package/dist/oidc/routes.d.ts

@@ -76,6 +76,7 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
                 client_assertion?: string | undefined;
                 client_assertion_type?: string | undefined;
                 code_verifier?: string | undefined;
+                'pre-authorized_code'?: string | undefined;
                 subject_token?: string | undefined;
                 subject_token_type?: string | undefined;
             };

package/dist/oidc/vci.d.ts

@@ -0,0 +1,159 @@
+import type { RouteString } from '../types';
+import { type SigningKey } from './keys';
+export declare const PRE_AUTHORIZED_CODE_GRANT = "urn:ietf:params:oauth:grant-type:pre-authorized_code";
+export type CredentialConfiguration = {
+    format: 'vc+sd-jwt';
+    id: string;
+    display?: Array<{
+        locale?: string;
+        name: string;
+    }>;
+    order?: string[];
+    claims?: Record<string, {
+        display?: Array<{
+            locale?: string;
+            name: string;
+        }>;
+    }>;
+    vct: string;
+};
+export type CredentialOffer = {
+    clientId: string;
+    configurationId: string;
+    createdAt: number;
+    expiresAt: number;
+    preAuthorizedCodeHash: string;
+    redeemed: boolean;
+    userId: string;
+};
+export type CredentialOfferStore = {
+    consumeOffer: (preAuthorizedCodeHash: string) => Promise<CredentialOffer | undefined>;
+    saveOffer: (offer: CredentialOffer) => Promise<void>;
+};
+export type CredentialNonceRecord = {
+    expiresAt: number;
+    nonceHash: string;
+};
+export type CredentialNonceStore = {
+    consumeNonce: (nonceHash: string) => Promise<CredentialNonceRecord | undefined>;
+    saveNonce: (record: CredentialNonceRecord) => Promise<void>;
+};
+export type VciConfig = {
+    accessTokenTtlMs?: number;
+    credentialConfigurations: CredentialConfiguration[];
+    credentialNonceStore?: CredentialNonceStore;
+    credentialOfferStore: CredentialOfferStore;
+    nonceTtlMs?: number;
+    offerTtlMs?: number;
+    resolveCredentialClaims: (context: {
+        configurationId: string;
+        userId: string;
+    }) => Promise<Record<string, unknown>> | Record<string, unknown>;
+    resolveProtectedClaims?: (context: {
+        configurationId: string;
+        userId: string;
+    }) => Promise<Record<string, unknown>> | Record<string, unknown>;
+    signingKey?: SigningKey;
+    vciRoute?: RouteString;
+};
+export declare const DEFAULT_VCI_ROUTE: RouteString;
+export declare const createCredentialOffer: ({ clientId, configurationId, now, store, ttlMs, userId }: {
+    clientId: string;
+    configurationId: string;
+    now?: number;
+    store: CredentialOfferStore;
+    ttlMs?: number;
+    userId: string;
+}) => Promise<{
+    offer: CredentialOffer;
+    preAuthorizedCode: string;
+}>;
+export type PreAuthExchangeResult = {
+    error: 'expired_token' | 'invalid_grant';
+    ok: false;
+} | {
+    access_token: string;
+    c_nonce?: string;
+    c_nonce_expires_in?: number;
+    expires_in: number;
+    ok: true;
+    token_type: 'Bearer';
+};
+export declare const exchangePreAuthorizedCode: ({ config, issuer, now, preAuthorizedCode, signingKey }: {
+    config: VciConfig;
+    issuer: string;
+    now?: number;
+    preAuthorizedCode: string;
+    signingKey: SigningKey;
+}) => Promise<{
+    error: "expired_token" | "invalid_grant";
+    ok: false;
+} | {
+    access_token: string;
+    c_nonce?: string;
+    c_nonce_expires_in?: number;
+    expires_in: number;
+    ok: true;
+    token_type: "Bearer";
+}>;
+export type CredentialIssueInput = {
+    accessToken: string;
+    proofJwt?: string;
+    requestedFormat?: 'vc+sd-jwt';
+};
+export type CredentialIssueResult = {
+    credential: string;
+    format: 'vc+sd-jwt';
+    ok: true;
+} | {
+    error: 'invalid_credential_request' | 'invalid_proof' | 'invalid_token' | 'unsupported_credential_format';
+    ok: false;
+};
+export declare const buildIssuerMetadata: ({ config, issuer, vciRoute }: {
+    config: VciConfig;
+    issuer: string;
+    vciRoute: RouteString;
+}) => {
+    credential_configurations_supported: {
+        [k: string]: {
+            claims: Record<string, {
+                display?: Array<{
+                    locale?: string;
+                    name: string;
+                }>;
+            }> | undefined;
+            credential_signing_alg_values_supported: string[];
+            cryptographic_binding_methods_supported: string[];
+            display: {
+                locale?: string;
+                name: string;
+            }[] | undefined;
+            format: "vc+sd-jwt";
+            order: string[] | undefined;
+            proof_types_supported: {
+                jwt: {
+                    proof_signing_alg_values_supported: string[];
+                };
+            };
+            vct: string;
+        };
+    };
+    credential_endpoint: string;
+    credential_issuer: string;
+    nonce_endpoint: string | undefined;
+    token_endpoint: string;
+};
+export declare const issueCredential: ({ config, input, issuer, now, signingKey }: {
+    config: VciConfig;
+    input: CredentialIssueInput;
+    issuer: string;
+    now?: number;
+    signingKey: SigningKey;
+}) => Promise<{
+    credential: string;
+    format: "vc+sd-jwt";
+    ok: true;
+} | {
+    error: "invalid_credential_request" | "invalid_proof" | "invalid_token" | "unsupported_credential_format";
+    ok: false;
+}>;

package/dist/oidc/vciRoutes.d.ts

@@ -0,0 +1,92 @@
+import { Elysia } from 'elysia';
+import type { SigningKey } from './keys';
+import { type VciConfig } from './vci';
+export declare const vciRoutes: ({ issuerUrl, signingKey, vciConfig }: {
+    issuerUrl: string;
+    signingKey: SigningKey;
+    vciConfig: VciConfig;
+}) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    ".well-known": {
+        "openid-credential-issuer": {
+            get: {
+                body: unknown;
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: Response;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        credential: {
+            post: {
+                body: {
+                    format?: "vc+sd-jwt" | undefined;
+                    proof?: {
+                        jwt: string;
+                        proof_type: "jwt";
+                    } | undefined;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        nonce: {
+            post: {
+                body: unknown;
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: Response;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/vc/inMemoryVpStores.d.ts

@@ -0,0 +1,2 @@
+import type { PresentationRequestStore } from './openid4vp';
+export declare const createInMemoryPresentationRequestStore: () => PresentationRequestStore;

package/dist/vc/openid4vp.d.ts

@@ -0,0 +1,82 @@
+import { type SigningKey } from '../oidc/keys';
+export type PresentationResponseInput = {
+    requestId: string;
+    vpToken: string;
+};
+export type PresentationRequest = {
+    clientId: string;
+    createdAt: number;
+    expectedIssuerPublicJwk: JsonWebKey;
+    expiresAt: number;
+    nonce: string;
+    requestedClaims: string[];
+    requestId: string;
+    responseUri: string;
+    state: string | undefined;
+};
+export type PresentationRequestStore = {
+    consumeRequest: (requestId: string) => Promise<PresentationRequest | undefined>;
+    getRequest: (requestId: string) => Promise<PresentationRequest | undefined>;
+    saveRequest: (request: PresentationRequest) => Promise<void>;
+};
+export type Vp4Config = {
+    clientSigningKey: SigningKey;
+    defaultExpectedIssuerPublicJwk: JsonWebKey;
+    getResponseUri: (requestId: string) => string;
+    requestStore: PresentationRequestStore;
+    requestTtlMs?: number;
+    statusListResolver?: (uri: string) => Promise<string | undefined>;
+    statusListPublicJwk?: JsonWebKey;
+};
+export type CreatePresentationRequestInput = {
+    clientId: string;
+    now?: number;
+    requestedClaims: string[];
+    state?: string;
+};
+export declare const createPresentationRequest: ({ config, getRequestUri, input, issuer }: {
+    config: Vp4Config;
+    getRequestUri: (requestId: string) => string;
+    input: CreatePresentationRequestInput;
+    issuer: string;
+}) => Promise<{
+    nonce: string;
+    request: PresentationRequest;
+    requestObject: string;
+    requestUri: string;
+}>;
+export type VerifiedPresentation = {
+    disclosedClaims: Record<string, unknown>;
+    holderJwk: JsonWebKey | undefined;
+    missingClaims: string[];
+    protectedClaims: Record<string, unknown>;
+    requestId: string;
+    statusValid: boolean;
+};
+export type PresentationVerifyError = 'expired_request' | 'invalid_holder_binding' | 'invalid_signature' | 'missing_claims' | 'revoked_credential' | 'unknown_request';
+export type PresentationVerifyResult = {
+    error: PresentationVerifyError;
+    ok: false;
+} | {
+    ok: true;
+    verified: VerifiedPresentation;
+};
+export declare const verifyPresentationResponse: ({ config, input, now }: {
+    config: Vp4Config;
+    input: PresentationResponseInput;
+    now?: number;
+}) => Promise<{
+    error: PresentationVerifyError;
+    ok: false;
+} | {
+    ok: true;
+    verified: VerifiedPresentation;
+}>;
+export declare const buildHolderKeyBindingJwt: ({ audience, holderKey, nonce, now, sdHash }: {
+    audience: string;
+    holderKey: SigningKey;
+    nonce: string;
+    now?: number;
+    sdHash?: string;
+}) => Promise<string>;
+export declare const parsePresentationToken: (vpToken: string) => import("./sdJwt").ParsedSdJwtVc;

package/dist/vc/sdJwt.d.ts

@@ -0,0 +1,37 @@
+import { type SigningKey } from '../oidc/keys';
+declare const toBase64Url: (bytes: ArrayBuffer | Uint8Array) => string;
+declare const fromBase64Url: (value: string) => Uint8Array<ArrayBuffer>;
+export type SdDisclosure = {
+    claimName: string;
+    claimValue: unknown;
+    encoded: string;
+    salt: string;
+};
+export type SdJwtVcIssueInput = {
+    base: Record<string, unknown>;
+    holderJwk?: JsonWebKey;
+    selective: Record<string, unknown>;
+    signingKey: SigningKey;
+};
+export declare const issueSdJwtVc: (input: SdJwtVcIssueInput) => Promise<string>;
+export type ParsedSdJwtVc = {
+    disclosures: string[];
+    jwt: string;
+    keyBindingJwt: string | undefined;
+};
+export declare const parseSdJwtVc: (token: string) => ParsedSdJwtVc;
+export declare const presentSdJwtVc: (parsed: ParsedSdJwtVc, selectedClaims: string[], keyBindingJwt?: string) => string;
+export type VerifiedSdJwtVc = {
+    cnf: {
+        jwk: JsonWebKey;
+    } | undefined;
+    disclosedClaims: Record<string, unknown>;
+    keyBindingJwt: string | undefined;
+    protectedClaims: Record<string, unknown>;
+};
+export type SdJwtVcVerifyInput = {
+    issuerPublicJwk: JsonWebKey;
+    token: string;
+};
+export declare const verifySdJwtVc: (input: SdJwtVcVerifyInput) => Promise<VerifiedSdJwtVc | undefined>;
+export { fromBase64Url, toBase64Url };

package/dist/vc/statusList.d.ts

@@ -0,0 +1,29 @@
+import { type SigningKey } from '../oidc/keys';
+declare const STATUS_LIST_TYP = "statuslist+jwt";
+declare const STATUS_LIST_SUB_TYP = "application/statuslist+jwt";
+export type StatusListBits = Uint8Array;
+export declare const createStatusList: (size?: number) => Uint8Array<ArrayBuffer>;
+export declare const getCredentialStatus: (bits: StatusListBits, idx: number) => 1 | 0 | undefined;
+export declare const setCredentialStatus: (bits: StatusListBits, idx: number, value: 0 | 1) => StatusListBits;
+export declare const buildStatusClaim: (idx: number, uri: string) => {
+    status_list: {
+        idx: number;
+        uri: string;
+    };
+};
+export declare const signStatusList: ({ bits, issuer, listUri, now, signingKey, ttlSeconds }: {
+    bits: StatusListBits;
+    issuer: string;
+    listUri: string;
+    now?: number;
+    signingKey: SigningKey;
+    ttlSeconds?: number;
+}) => Promise<string>;
+export declare const verifyStatusListJwt: ({ issuerPublicJwk, token }: {
+    issuerPublicJwk: JsonWebKey;
+    token: string;
+}) => Promise<{
+    bits: Uint8Array<ArrayBuffer>;
+    sub: string | undefined;
+} | undefined>;
+export { STATUS_LIST_SUB_TYP, STATUS_LIST_TYP };

package/dist/vc/statusListRoutes.d.ts

@@ -0,0 +1,63 @@
+import { Elysia } from 'elysia';
+import type { SigningKey } from '../oidc/keys';
+import { type StatusListBits } from './statusList';
+export declare const DEFAULT_STATUS_ROUTE = "/vc/status";
+export declare const statusListRoutes: ({ getStatusList, issuerUrl, signingKey, statusRoute, ttlSeconds }: {
+    getStatusList: (listId: string) => Promise<StatusListBits | undefined> | StatusListBits | undefined;
+    issuerUrl: string;
+    signingKey: SigningKey;
+    statusRoute?: string;
+    ttlSeconds?: number;
+}) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        ":listId": {
+            get: {
+                body: unknown;
+                params: {
+                    listId: string;
+                };
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/vc/vpRoutes.d.ts

@@ -0,0 +1,120 @@
+import { Elysia } from 'elysia';
+import { type VerifiedPresentation, type Vp4Config } from './openid4vp';
+export declare const DEFAULT_VP_ROUTE = "/vp";
+export declare const vpRoutes: ({ defaultClientId, issuerUrl, onVerifiedPresentation, vpConfig, vpRoute }: {
+    defaultClientId: string;
+    issuerUrl: string;
+    onVerifiedPresentation?: (context: {
+        verified: VerifiedPresentation;
+    }) => Promise<void> | void;
+    vpConfig: Vp4Config;
+    vpRoute?: string;
+}) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        authorize: {
+            post: {
+                body: {
+                    client_id?: string | undefined;
+                    state?: string | undefined;
+                    requested_claims: string[];
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        request: {
+            ":id": {
+                get: {
+                    body: unknown;
+                    params: {
+                        id: string;
+                    };
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        200: Response;
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        response: {
+            post: {
+                body: {
+                    state?: string | undefined;
+                    presentation_submission?: unknown;
+                    vp_token: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.38.0",
+	"version": "0.40.0-beta.1",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {