@absolutejs/auth 0.54.7 → 0.54.9

package/dist/agents/index.d.ts

@@ -1,5 +1,6 @@
 export * from './config';
 export * from './types';
+export * from '../oidc/clientIdMetadata';
 export { createOidcAgentCredentialVerifier } from './oidcAdapter';
 export { agentHasScopes, resolveAgentPrincipal } from './principal';
 export { agentAuthChallenge, agentAuthPlugin } from './routes';

package/dist/agents/index.js

@@ -46,6 +46,15 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
+// src/constants.ts
+var SECONDS_IN_A_MINUTE = 60, MILLISECONDS_IN_A_SECOND = 1000, MILLISECONDS_IN_A_MINUTE, MINUTES_IN_AN_HOUR = 60, HOURS_IN_A_DAY = 24, MILLISECONDS_IN_A_DAY, MILLISECONDS_IN_AN_HOUR, COOKIE_MINUTES = 30, COOKIE_DURATION, DEFAULT_MAX_SESSIONS = 1e4;
+var init_constants = __esm(() => {
+  MILLISECONDS_IN_A_MINUTE = MILLISECONDS_IN_A_SECOND * SECONDS_IN_A_MINUTE;
+  MILLISECONDS_IN_A_DAY = MILLISECONDS_IN_A_SECOND * SECONDS_IN_A_MINUTE * MINUTES_IN_AN_HOUR * HOURS_IN_A_DAY;
+  MILLISECONDS_IN_AN_HOUR = MILLISECONDS_IN_A_MINUTE * MINUTES_IN_AN_HOUR;
+  COOKIE_DURATION = SECONDS_IN_A_MINUTE * COOKIE_MINUTES;
+});
+
 // src/agents/config.ts
 var DEFAULT_AGENT_RESOURCE_METADATA_ROUTE = "/.well-known/oauth-protected-resource";
 var agentProtectedResourceMetadata = (config) => ({
@@ -56,6 +65,91 @@ var agentProtectedResourceMetadata = (config) => ({
   resource: config.resource,
   scopes_supported: config.scopes
 });
+// src/oidc/clientIdMetadata.ts
+var secureUrl = (value) => {
+  try {
+    return new URL(value).protocol === "https:";
+  } catch {
+    return false;
+  }
+};
+var validateClientIdMetadataDocument = (document, expectedClientId) => {
+  const errors = [];
+  if (document.client_id !== expectedClientId)
+    errors.push("client_id does not match the metadata document URL");
+  if (!secureUrl(document.client_id))
+    errors.push("client_id must use HTTPS");
+  if (!Array.isArray(document.redirect_uris) || document.redirect_uris.length === 0)
+    errors.push("redirect_uris is required");
+  for (const uri of document.redirect_uris ?? []) {
+    try {
+      const parsed = new URL(uri);
+      if (parsed.protocol !== "https:" && parsed.hostname !== "localhost")
+        errors.push("redirect URIs must use HTTPS or localhost");
+    } catch {
+      errors.push("redirect URI is invalid");
+    }
+  }
+  for (const [name, value] of [
+    ["client_uri", document.client_uri],
+    ["logo_uri", document.logo_uri],
+    ["policy_uri", document.policy_uri],
+    ["tos_uri", document.tos_uri],
+    ["jwks_uri", document.jwks_uri]
+  ]) {
+    if (value !== undefined && !secureUrl(value))
+      errors.push(`${name} must use HTTPS`);
+  }
+  return errors;
+};
+var clientIdMetadataToOAuthClient = (document) => ({
+  clientId: document.client_id,
+  grantTypes: document.grant_types ?? ["authorization_code", "refresh_token"],
+  ...document.jwks === undefined ? {} : { jwks: document.jwks.keys },
+  ...document.jwks_uri === undefined ? {} : { jwksUri: document.jwks_uri },
+  name: document.client_name ?? new URL(document.client_id).hostname,
+  redirectUris: [...document.redirect_uris],
+  scopes: document.scope?.split(" ").filter(Boolean) ?? []
+});
+var createClientIdMetadataResolver = ({
+  fetch: fetcher,
+  allow = async () => true,
+  cacheTtlMs = 5 * 60 * 1000,
+  maxBytes = 5 * 1024,
+  now = Date.now
+}) => {
+  const cache = new Map;
+  return async (clientId) => {
+    if (!secureUrl(clientId) || !await allow(clientId))
+      return;
+    const cached = cache.get(clientId);
+    if (cached !== undefined && cached.expiresAt > now())
+      return cached.client;
+    const response = await fetcher(clientId, {
+      headers: { accept: "application/json" },
+      redirect: "error"
+    });
+    if (!response.ok)
+      return;
+    const declaredLength = Number(response.headers.get("content-length") ?? "0");
+    if (declaredLength > maxBytes)
+      return;
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (bytes.byteLength > maxBytes)
+      return;
+    let document;
+    try {
+      document = JSON.parse(new TextDecoder().decode(bytes));
+    } catch {
+      return;
+    }
+    if (validateClientIdMetadataDocument(document, clientId).length > 0)
+      return;
+    const client = clientIdMetadataToOAuthClient(document);
+    cache.set(clientId, { client, expiresAt: now() + cacheTtlMs });
+    return client;
+  };
+};
 // src/oidc/keys.ts
 var ENCODER = new TextEncoder;
 var ES256 = { hash: "SHA-256", name: "ECDSA" };
@@ -112,6 +206,96 @@ var verifyJwt = async (token, publicJwk) => {
   };
 };
 
+// src/oidc/dpop.ts
+init_constants();
+var DEFAULT_MAX_AGE_MS = 60000;
+var SECONDS_TO_MS = 1000;
+var NONCE_WINDOW_SECONDS = 120;
+var NONCE_WINDOW_MS = NONCE_WINDOW_SECONDS * MILLISECONDS_IN_A_SECOND;
+var NONCE_PREVIOUS_WINDOWS_ACCEPTED = 1;
+var hmacSha256 = async (secret, message) => {
+  const encoder = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
+  return Buffer.from(new Uint8Array(signature)).toString("base64url");
+};
+var extractDpopNonceClaim = (proof) => {
+  const [, payloadSegment] = proof.split(".");
+  if (payloadSegment === undefined)
+    return;
+  try {
+    const payload = JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf8"));
+    if (typeof payload !== "object" || payload === null)
+      return;
+    const value = payload.nonce;
+    return typeof value === "string" ? value : undefined;
+  } catch {
+    return;
+  }
+};
+var mintDpopNonce = async ({
+  now = Date.now(),
+  secret
+}) => {
+  const window = Math.floor(now / NONCE_WINDOW_MS);
+  return hmacSha256(secret, String(window));
+};
+var verifyDpopNonce = async ({
+  now = Date.now(),
+  nonce,
+  secret
+}) => {
+  const currentWindow = Math.floor(now / NONCE_WINDOW_MS);
+  const candidates = await Promise.all(Array.from({ length: NONCE_PREVIOUS_WINDOWS_ACCEPTED + 1 }, (_, offset) => hmacSha256(secret, String(currentWindow - offset))));
+  return candidates.some((expected) => expected === nonce);
+};
+var decodeHeader = (segment) => JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+var normalizeHtu = (value) => {
+  try {
+    const url = new URL(String(value));
+    return `${url.origin}${url.pathname}`;
+  } catch {
+    return "";
+  }
+};
+var verifyDpopProof = async ({
+  accessToken,
+  htm,
+  htu,
+  isUsedJti,
+  maxAgeMs = DEFAULT_MAX_AGE_MS,
+  now = Date.now(),
+  proof
+}) => {
+  if (proof === undefined)
+    return;
+  const [headerSegment] = proof.split(".");
+  if (headerSegment === undefined)
+    return;
+  const header = decodeHeader(headerSegment);
+  if (header?.typ !== "dpop+jwt" || header.alg !== "ES256" || header.jwk === undefined) {
+    return;
+  }
+  const verified = await verifyJwt(proof, header.jwk);
+  if (verified === undefined)
+    return;
+  const { payload } = verified;
+  if (accessToken !== undefined) {
+    const expectedAth = Buffer.from(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(accessToken))).toString("base64url");
+    if (payload.ath !== expectedAth)
+      return;
+  }
+  const iatMs = typeof payload.iat === "number" ? payload.iat * SECONDS_TO_MS : 0;
+  if (payload.htm !== htm || normalizeHtu(payload.htu) !== normalizeHtu(htu) || iatMs === 0 || Math.abs(now - iatMs) > maxAgeMs) {
+    return;
+  }
+  const jti = typeof payload.jti === "string" ? payload.jti : undefined;
+  if (jti !== undefined && isUsedJti !== undefined && await isUsedJti(jti)) {
+    return;
+  }
+  return { jkt: await jwkThumbprint(header.jwk), jti };
+};
+
 // src/agents/oidcAdapter.ts
 var BEARER_PREFIX = "Bearer ";
 var MS_PER_SECOND = 1000;
@@ -125,15 +309,18 @@ var readAudience = (audience) => {
 };
 var createOidcAgentCredentialVerifier = ({
   issuer,
+  isUsedDpopJti,
+  maxDpopAgeMs,
   publicJwk,
+  requireDpop = false,
   resource
 }) => {
   const verifier = async (request) => {
     const authorization = request.headers.get("authorization");
-    if (authorization === null || !authorization.startsWith(BEARER_PREFIX)) {
+    if (authorization === null || !authorization.startsWith(BEARER_PREFIX) && !authorization.startsWith("DPoP ")) {
       return;
     }
-    const token = authorization.slice(BEARER_PREFIX.length).trim();
+    const token = authorization.slice(authorization.indexOf(" ") + 1).trim();
     if (token.length === 0)
       return;
     const verified = await verifyJwt(token, publicJwk);
@@ -141,6 +328,22 @@ var createOidcAgentCredentialVerifier = ({
     if (payload === undefined || payload.iss !== issuer || typeof payload.exp !== "number" || payload.exp <= Math.floor(Date.now() / MS_PER_SECOND) || !readAudience(payload.aud).includes(resource) || typeof payload.client_id !== "string") {
       return;
     }
+    const confirmation = payload.cnf;
+    const boundJkt = typeof confirmation === "object" && confirmation !== null && typeof confirmation.jkt === "string" ? confirmation.jkt : undefined;
+    if (boundJkt !== undefined || requireDpop) {
+      if (!authorization.startsWith("DPoP "))
+        return;
+      const proof = await verifyDpopProof({
+        accessToken: token,
+        htm: request.method,
+        htu: request.url,
+        isUsedJti: isUsedDpopJti,
+        ...maxDpopAgeMs === undefined ? {} : { maxAgeMs: maxDpopAgeMs },
+        proof: request.headers.get("dpop") ?? undefined
+      });
+      if (proof === undefined || boundJkt === undefined || proof.jkt !== boundJkt)
+        return;
+    }
     return {
       agentId: payload.client_id,
       claims: payload,
@@ -11278,6 +11481,7 @@ var createPostgresAgentRegistrationStore = (db) => ({
   }
 });
 export {
+  validateClientIdMetadataDocument,
   resolveAgentPrincipal,
   createPostgresAgentRegistrationStore,
   createPostgresAgentDelegationStore,
@@ -11286,6 +11490,8 @@ export {
   createNeonAgentDelegationStore,
   createInMemoryAgentRegistrationStore,
   createInMemoryAgentDelegationStore,
+  createClientIdMetadataResolver,
+  clientIdMetadataToOAuthClient,
   agentRegistrationsTable,
   agentProtectedResourceMetadata,
   agentHasScopes,
@@ -11295,5 +11501,5 @@ export {
   DEFAULT_AGENT_RESOURCE_METADATA_ROUTE
 };
 
-//# debugId=F730056D05217ECB64756E2164756E21
+//# debugId=BF8C5C40CCB4AFB564756E2164756E21
 //# sourceMappingURL=index.js.map