@absolutejs/auth 0.54.7 → 0.54.8

package/dist/agents/oidcAdapter.d.ts

@@ -2,8 +2,11 @@ import type { AgentCredentialVerifier } from './types';
 /** Adapter for Absolute Auth's RFC 9068-style JWT access tokens. It validates
  * signature, issuer, audience, expiry, and extracts the OAuth client as the
  * agent identity while retaining `sub` as the authorizing user. */
-export declare const createOidcAgentCredentialVerifier: ({ issuer, publicJwk, resource }: {
+export declare const createOidcAgentCredentialVerifier: ({ issuer, isUsedDpopJti, maxDpopAgeMs, publicJwk, requireDpop, resource }: {
     issuer: string;
+    isUsedDpopJti?: (jti: string) => boolean | Promise<boolean>;
+    maxDpopAgeMs?: number;
     publicJwk: JsonWebKey;
+    requireDpop?: boolean;
     resource: string;
 }) => AgentCredentialVerifier;

package/dist/index.d.ts

@@ -363,6 +363,7 @@ export { agentDelegationsTable, agentRegistrationsTable, createNeonAgentDelegati
 export { createInMemoryAccessTokenStore, createInMemoryApiClientStore, createInMemoryApiKeyStore } from './apikeys/inMemoryStores';
 export { accessTokensTable, apiClientsTable, apiKeysTable, createNeonAccessTokenStore, createNeonApiClientStore, createNeonApiKeyStore, createPostgresAccessTokenStore, createPostgresApiClientStore, createPostgresApiKeyStore } from './apikeys/postgresStores';
 export * from './oidc/config';
+export * from './oidc/clientIdMetadata';
 export * from './oidc/types';
 export { oidcProviderRoutes } from './oidc/routes';
 export { generateSigningKey, jwkThumbprint, signJwt, toPublicJwk, verifyJwt } from './oidc/keys';

package/dist/index.js

@@ -5488,7 +5488,7 @@ var issueBackchannelAuth = async ({
   if (!config.backchannelAuthStore || !config.resolveBackchannelUser) {
     return { error: "invalid_request", ok: false };
   }
-  const client = await config.clientStore.findClient(clientId);
+  const client = await config.clientStore.findClient(clientId) ?? await config.resolveClientIdMetadata?.(clientId);
   if (!client)
     return { error: "invalid_client", ok: false };
   const resolved = await config.resolveBackchannelUser({
@@ -6169,6 +6169,7 @@ var normalizeHtu = (value) => {
   }
 };
 var verifyDpopProof = async ({
+  accessToken,
   htm,
   htu,
   isUsedJti,
@@ -6189,6 +6190,11 @@ var verifyDpopProof = async ({
   if (verified === undefined)
     return;
   const { payload } = verified;
+  if (accessToken !== undefined) {
+    const expectedAth = Buffer.from(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(accessToken))).toString("base64url");
+    if (payload.ath !== expectedAth)
+      return;
+  }
   const iatMs = typeof payload.iat === "number" ? payload.iat * SECONDS_TO_MS : 0;
   if (payload.htm !== htm || normalizeHtu(payload.htu) !== normalizeHtu(htu) || iatMs === 0 || Math.abs(now - iatMs) > maxAgeMs) {
     return;
@@ -6791,8 +6797,9 @@ var oidcProviderRoutes = (config) => {
   const userinfoRoute = `${oidcRoute}/userinfo`;
   const registrationBaseUrl = `${issuer}${registrationRoute}`;
   const tokenUrl = `${issuer}${oidcRoute}/token`;
+  const resolveClient = async (clientId) => await clientStore.findClient(clientId) ?? await config.resolveClientIdMetadata?.(clientId);
   const authenticateClient = async (clientId, clientSecret) => {
-    const client = await clientStore.findClient(clientId);
+    const client = await resolveClient(clientId);
     if (client === undefined)
       return;
     if (client.hashedSecret === undefined)
@@ -6835,14 +6842,14 @@ var oidcProviderRoutes = (config) => {
         assertion: bodyClientAssertion,
         expectedAudience: tokenUrl,
         jtiStore: config.clientAssertionJtiStore,
-        resolveClient: clientStore.findClient
+        resolveClient
       });
       return client2 === undefined ? undefined : { client: client2, clientCertThumbprint: undefined };
     }
     const clientId = bodyClientId ?? basicClientId;
     if (clientId === undefined)
       return;
-    const candidate = await clientStore.findClient(clientId);
+    const candidate = await resolveClient(clientId);
     const mtlsResult = await tryMtlsAuth({
       candidate,
       extract: config.extractTlsClientCert,
@@ -7058,6 +7065,7 @@ var oidcProviderRoutes = (config) => {
     backchannel_logout_session_supported: false,
     backchannel_logout_supported: true,
     code_challenge_methods_supported: ["S256"],
+    client_id_metadata_document_supported: config.resolveClientIdMetadata !== undefined,
     dpop_signing_alg_values_supported: ["ES256"],
     end_session_endpoint: `${issuer}${endSessionRoute}`,
     grant_types_supported: grantTypes,
@@ -7115,7 +7123,7 @@ var oidcProviderRoutes = (config) => {
       idTokenHint: query.id_token_hint
     });
     const clientId = hint?.audClientId ?? query.client_id;
-    const client = clientId === undefined ? undefined : await config.clientStore.findClient(clientId);
+    const client = clientId === undefined ? undefined : await resolveClient(clientId);
     const userSession = await loadSessionFromSource({
       authSessionStore,
       session: inMemorySession,
@@ -7167,7 +7175,7 @@ var oidcProviderRoutes = (config) => {
       return jsonResponse({ error: "invalid_request_uri" }, HTTP_BAD_REQUEST2);
     }
     const initialClientId = effectiveQuery.client_id;
-    const initialClient = initialClientId === undefined ? undefined : await clientStore.findClient(initialClientId);
+    const initialClient = initialClientId === undefined ? undefined : await resolveClient(initialClientId);
     if (effectiveQuery.request !== undefined && initialClient !== undefined) {
       const parsed = await parseSignedRequestObject({
         client: initialClient,
@@ -24971,15 +24979,18 @@ var readAudience = (audience) => {
 };
 var createOidcAgentCredentialVerifier = ({
   issuer,
+  isUsedDpopJti,
+  maxDpopAgeMs,
   publicJwk,
+  requireDpop = false,
   resource
 }) => {
   const verifier = async (request) => {
     const authorization = request.headers.get("authorization");
-    if (authorization === null || !authorization.startsWith(BEARER_PREFIX6)) {
+    if (authorization === null || !authorization.startsWith(BEARER_PREFIX6) && !authorization.startsWith("DPoP ")) {
       return;
     }
-    const token = authorization.slice(BEARER_PREFIX6.length).trim();
+    const token = authorization.slice(authorization.indexOf(" ") + 1).trim();
     if (token.length === 0)
       return;
     const verified = await verifyJwt(token, publicJwk);
@@ -24987,6 +24998,22 @@ var createOidcAgentCredentialVerifier = ({
     if (payload === undefined || payload.iss !== issuer || typeof payload.exp !== "number" || payload.exp <= Math.floor(Date.now() / MS_PER_SECOND7) || !readAudience(payload.aud).includes(resource) || typeof payload.client_id !== "string") {
       return;
     }
+    const confirmation = payload.cnf;
+    const boundJkt = typeof confirmation === "object" && confirmation !== null && typeof confirmation.jkt === "string" ? confirmation.jkt : undefined;
+    if (boundJkt !== undefined || requireDpop) {
+      if (!authorization.startsWith("DPoP "))
+        return;
+      const proof = await verifyDpopProof({
+        accessToken: token,
+        htm: request.method,
+        htu: request.url,
+        isUsedJti: isUsedDpopJti,
+        ...maxDpopAgeMs === undefined ? {} : { maxAgeMs: maxDpopAgeMs },
+        proof: request.headers.get("dpop") ?? undefined
+      });
+      if (proof === undefined || boundJkt === undefined || proof.jkt !== boundJkt)
+        return;
+    }
     return {
       agentId: payload.client_id,
       claims: payload,
@@ -25374,6 +25401,91 @@ var createPostgresApiKeyStore = (db) => ({
     await db.update(apiKeysTable).set({ last_used_at_ms: lastUsedAt }).where(eq(apiKeysTable.key_id, keyId));
   }
 });
+// src/oidc/clientIdMetadata.ts
+var secureUrl = (value) => {
+  try {
+    return new URL(value).protocol === "https:";
+  } catch {
+    return false;
+  }
+};
+var validateClientIdMetadataDocument = (document, expectedClientId) => {
+  const errors = [];
+  if (document.client_id !== expectedClientId)
+    errors.push("client_id does not match the metadata document URL");
+  if (!secureUrl(document.client_id))
+    errors.push("client_id must use HTTPS");
+  if (!Array.isArray(document.redirect_uris) || document.redirect_uris.length === 0)
+    errors.push("redirect_uris is required");
+  for (const uri of document.redirect_uris ?? []) {
+    try {
+      const parsed = new URL(uri);
+      if (parsed.protocol !== "https:" && parsed.hostname !== "localhost")
+        errors.push("redirect URIs must use HTTPS or localhost");
+    } catch {
+      errors.push("redirect URI is invalid");
+    }
+  }
+  for (const [name2, value] of [
+    ["client_uri", document.client_uri],
+    ["logo_uri", document.logo_uri],
+    ["policy_uri", document.policy_uri],
+    ["tos_uri", document.tos_uri],
+    ["jwks_uri", document.jwks_uri]
+  ]) {
+    if (value !== undefined && !secureUrl(value))
+      errors.push(`${name2} must use HTTPS`);
+  }
+  return errors;
+};
+var clientIdMetadataToOAuthClient = (document) => ({
+  clientId: document.client_id,
+  grantTypes: document.grant_types ?? ["authorization_code", "refresh_token"],
+  ...document.jwks === undefined ? {} : { jwks: document.jwks.keys },
+  ...document.jwks_uri === undefined ? {} : { jwksUri: document.jwks_uri },
+  name: document.client_name ?? new URL(document.client_id).hostname,
+  redirectUris: [...document.redirect_uris],
+  scopes: document.scope?.split(" ").filter(Boolean) ?? []
+});
+var createClientIdMetadataResolver = ({
+  fetch: fetcher,
+  allow = async () => true,
+  cacheTtlMs = 5 * 60 * 1000,
+  maxBytes = 5 * 1024,
+  now = Date.now
+}) => {
+  const cache = new Map;
+  return async (clientId) => {
+    if (!secureUrl(clientId) || !await allow(clientId))
+      return;
+    const cached = cache.get(clientId);
+    if (cached !== undefined && cached.expiresAt > now())
+      return cached.client;
+    const response = await fetcher(clientId, {
+      headers: { accept: "application/json" },
+      redirect: "error"
+    });
+    if (!response.ok)
+      return;
+    const declaredLength = Number(response.headers.get("content-length") ?? "0");
+    if (declaredLength > maxBytes)
+      return;
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (bytes.byteLength > maxBytes)
+      return;
+    let document;
+    try {
+      document = JSON.parse(new TextDecoder().decode(bytes));
+    } catch {
+      return;
+    }
+    if (validateClientIdMetadataDocument(document, clientId).length > 0)
+      return;
+    const client = clientIdMetadataToOAuthClient(document);
+    cache.set(clientId, { client, expiresAt: now() + cacheTtlMs });
+    return client;
+  };
+};
 // src/oidc/inMemoryStores.ts
 var DEFAULT_LIST_LIMIT = 100;
 var createInMemoryAuthorizationCodeStore = () => {
@@ -27995,6 +28107,7 @@ export {
   vaultEntriesTable,
   validateSession,
   validateEmailDeliverability,
+  validateClientIdMetadataDocument,
   userSessionIdTypebox,
   userInfoChallengeHeader,
   updateRegisteredClient,
@@ -28326,6 +28439,7 @@ export {
   createFederatedTokenStore,
   createCustomOAuth2Client,
   createCredentialOffer,
+  createClientIdMetadataResolver,
   createAuthHtmxRoutes,
   createAuditRedactor,
   createAuditEmitter,
@@ -28339,6 +28453,7 @@ export {
   constantTimeEqual,
   computeCertThumbprint,
   complianceRoutes,
+  clientIdMetadataToOAuthClient,
   check2 as check,
   buildStatusClaim,
   buildIssuerMetadata,
@@ -28414,5 +28529,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=5F5850B4C390793864756E2164756E21
+//# debugId=D8A79A996B677FF164756E2164756E21
 //# sourceMappingURL=index.js.map