@absolutejs/auth 0.41.0 → 0.42.0

package/dist/index.js

@@ -6170,6 +6170,9 @@ var oidcProviderRoutes = (config) => {
     if (mtlsResult !== undefined)
       return mtlsResult;
     const clientSecret = bodyClientSecret ?? basicClientSecret;
+    if (config.strictFapi === true && clientSecret !== undefined) {
+      return;
+    }
     const client = await authenticateClient(clientId, clientSecret);
     return client === undefined ? undefined : { client, clientCertThumbprint: undefined };
   };
@@ -6390,7 +6393,7 @@ var oidcProviderRoutes = (config) => {
     subject_types_supported: ["public"],
     tls_client_certificate_bound_access_tokens: true,
     token_endpoint: tokenUrl,
-    token_endpoint_auth_methods_supported: [
+    token_endpoint_auth_methods_supported: config.strictFapi === true ? ["private_key_jwt", "self_signed_tls_client_auth"] : [
       "client_secret_basic",
       "client_secret_post",
       "none",
@@ -6403,6 +6406,9 @@ var oidcProviderRoutes = (config) => {
   if (config.deviceAuthorizationStore) {
     discovery.device_authorization_endpoint = `${issuer}${deviceAuthorizationRoute}`;
   }
+  if (config.strictFapi === true) {
+    discovery.require_pushed_authorization_requests = true;
+  }
   if (config.backchannelAuthStore) {
     discovery.backchannel_authentication_endpoint = `${issuer}${backchannelAuthorizationRoute}`;
     discovery.backchannel_token_delivery_modes_supported = ["poll"];
@@ -6515,7 +6521,8 @@ var oidcProviderRoutes = (config) => {
         params2.state = state;
       return respondToClient(redirectUri, responseMode, params2);
     };
-    if (client.requirePushedAuthorizationRequests === true && query.request_uri === undefined) {
+    const requirePar = client.requirePushedAuthorizationRequests === true || config.strictFapi === true;
+    if (requirePar && query.request_uri === undefined) {
       return errorRedirect("invalid_request");
     }
     if (client.requireSignedRequestObject === true && query.request === undefined && query.request_uri === undefined) {
@@ -26180,5 +26187,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=3861326B7894F72964756E2164756E21
+//# debugId=02ED8EE4D0AFE4F564756E2164756E21
 //# sourceMappingURL=index.js.map