@absolutejs/auth 0.55.5 → 0.55.7

package/dist/oidc/config.d.ts

@@ -1,295 +0,0 @@
-import type { RouteString } from '../types';
-import { type SigningKey } from './keys';
-import type { OnClientRegistered, OnClientRegistration } from './registration';
-import type { VciConfig } from './vci';
-import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
-export declare const DEFAULT_OIDC_ROUTE: RouteString;
-export type PublicTokenGrantResult = {
-    body: Record<string, unknown>;
-    status: number;
-};
-export type OidcProviderConfig<UserType> = {
-    /** Additional non-conflicting RFC 8414 metadata. Reserved core OAuth keys
-     * cannot be replaced. Used by profiles such as open agent registration. */
-    additionalDiscoveryMetadata?: Record<string, unknown>;
-    /** Public extension grants whose bearer material is carried in their body
-     * (for example an agent claim_token). They run before OAuth client auth. */
-    publicTokenGrantTypes?: string[];
-    handlePublicTokenGrant?: (context: {
-        body: Record<string, string | undefined>;
-        request: Request;
-    }) => Promise<PublicTokenGrantResult | undefined>;
-    accessTokenTtlMs?: number | ((context: {
-        scopes: string[];
-    }) => number);
-    acrValuesSupported?: string[];
-    authorizationCodeStore: AuthorizationCodeStore;
-    clientAssertionJtiStore?: ClientAssertionJtiStore;
-    clientRegistrationTokenStore?: ClientRegistrationTokenStore;
-    clientStore: OAuthClientStore;
-    resolveClientIdMetadata?: (clientId: string) => Promise<OAuthClient | undefined>;
-    deviceAuthorizationStore?: DeviceAuthorizationStore;
-    deviceCodeTtlMs?: number;
-    devicePollIntervalSeconds?: number;
-    backchannelAuthStore?: BackchannelAuthStore;
-    backchannelAuthTtlMs?: number;
-    backchannelPollIntervalSeconds?: number;
-    resolveBackchannelUser?: (hint: {
-        client: OAuthClient;
-        loginHint: string;
-    }) => Promise<{
-        sub: string;
-    } | undefined>;
-    onBackchannelAuthRequest?: (context: {
-        authReqId: string;
-        bindingMessage: string | undefined;
-        clientId: string;
-        scopes: string[];
-        userSub: string;
-    }) => Promise<void> | void;
-    getAccessTokenClaims?: (context: {
-        audience?: string;
-        clientId: string;
-        scopes: string[];
-        sub: string;
-    }) => Record<string, unknown> | Promise<Record<string, unknown>>;
-    getClaims?: (user: UserType) => Record<string, unknown>;
-    consentUrl?: string;
-    needsConsent?: (context: {
-        client: {
-            clientId: string;
-            name: string;
-        };
-        requestedScopes: string[];
-        user: UserType;
-    }) => boolean | Promise<boolean>;
-    getGrantedScopes?: (context: {
-        client: {
-            clientId: string;
-            name: string;
-        };
-        requestedScopes: string[];
-        user: UserType;
-    }) => string[] | undefined | Promise<string[] | undefined>;
-    getUserId: (user: UserType) => string;
-    getUserInfo?: (sub: string) => Promise<Record<string, unknown> | undefined>;
-    idTokenTtlMs?: number;
-    issuer: string;
-    dpopNonce?: {
-        secret: string;
-    };
-    extractTlsClientCert?: (headers: Headers) => Promise<Uint8Array | undefined> | Uint8Array | undefined;
-    getAcr?: (context: {
-        scopes: string[];
-        user: UserType;
-    }) => string | undefined;
-    initialAccessTokenStore?: InitialAccessTokenStore;
-    loginUrl?: string;
-    logoutDeliveryStore?: LogoutDeliveryStore;
-    oidcRoute?: RouteString;
-    onClientRegistration?: OnClientRegistration;
-    /** Fires after RFC 7591 registration has been persisted and has a generated client id. */
-    onClientRegistered?: OnClientRegistered;
-    /** Fires after the authenticated user approves an RFC 8628 device request. */
-    onDeviceAuthorizationApproved?: (context: {
-        clientId: string;
-        scopes: string[];
-        userSub: string;
-    }) => void | Promise<void>;
-    pushedAuthorizationRequestStore?: PushedAuthorizationRequestStore;
-    pushedAuthorizationRequestTtlMs?: number;
-    refreshTokenStore: OidcRefreshTokenStore;
-    refreshTokenTtlMs?: number;
-    signingKey: SigningKey;
-    strictFapi?: boolean;
-    vciConfig?: VciConfig;
-};
-export type TokenExchangeResult = {
-    error: 'invalid_grant' | 'invalid_scope';
-    ok: false;
-} | {
-    accessToken: string;
-    expiresIn: number;
-    ok: true;
-    scope: string;
-};
-export declare const exchangeToken: <UserType>({ actorClientId, audience, config, dpopJkt, now, requestedScopes, subjectToken }: {
-    actorClientId: string;
-    audience?: string;
-    config: OidcProviderConfig<UserType>;
-    dpopJkt?: string;
-    now?: number;
-    requestedScopes?: string[];
-    subjectToken: string;
-}) => Promise<TokenExchangeResult>;
-export declare const issueTokenSet: <UserType>({ acr, claims, clientCertThumbprint, clientId, config, dpopJkt, nonce, now, scopes, sub }: {
-    acr?: string;
-    claims?: Record<string, unknown>;
-    clientCertThumbprint?: string;
-    clientId: string;
-    config: OidcProviderConfig<UserType>;
-    dpopJkt?: string;
-    nonce?: string;
-    now?: number;
-    scopes: string[];
-    sub: string;
-}) => Promise<{
-    access_token: string;
-    expires_in: number;
-    id_token: string;
-    refresh_token: string;
-    scope: string;
-    token_type: "Bearer" | "DPoP";
-}>;
-export declare const mcpProtectedResourceMetadata: ({ issuer, resource, scopes }: {
-    issuer: string;
-    resource: string;
-    scopes?: string[];
-}) => {
-    authorization_servers: string[];
-    resource: string;
-    scopes_supported: string[];
-};
-export declare const verifyPkce: (codeVerifier: string, codeChallenge: string) => Promise<boolean>;
-export type TokenIntrospection = {
-    active: false;
-} | {
-    active: true;
-    client_id: string;
-    exp: number;
-    iat: number;
-    scope: string;
-    sub: string;
-    token_type: 'access_token' | 'refresh_token';
-};
-export type TokenTypeHint = 'access_token' | 'refresh_token';
-export declare const introspectToken: <UserType>({ config, hint, now, token }: {
-    config: OidcProviderConfig<UserType>;
-    hint?: TokenTypeHint;
-    now?: number;
-    token: string;
-}) => Promise<{
-    active: false;
-} | {
-    active: true;
-    client_id: string;
-    exp: number;
-    iat: number;
-    scope: string;
-    sub: string;
-    token_type: "access_token";
-} | {
-    active: true;
-    client_id: string;
-    exp: number;
-    iat: number;
-    scope: string;
-    sub: string;
-    token_type: "refresh_token";
-}>;
-export declare const revokeRefreshToken: <UserType>(config: OidcProviderConfig<UserType>, token: string) => Promise<boolean>;
-export type DeviceAuthorizationResponse = {
-    device_code: string;
-    expires_in: number;
-    interval: number;
-    user_code: string;
-    verification_uri: string;
-    verification_uri_complete: string;
-};
-export declare const issueDeviceAuthorization: <UserType>({ clientId, config, now, requestedScopes }: {
-    clientId: string;
-    config: OidcProviderConfig<UserType>;
-    now?: number;
-    requestedScopes: string[];
-}) => Promise<DeviceAuthorizationResponse>;
-export type DeviceDecisionResult = {
-    error: 'already_decided' | 'expired_token' | 'invalid_user_code' | 'not_configured';
-    ok: false;
-} | {
-    ok: true;
-};
-export declare const approveDeviceAuthorization: <UserType>({ config, userCode, userSub }: {
-    config: OidcProviderConfig<UserType>;
-    userCode: string;
-    userSub: string;
-}) => Promise<DeviceDecisionResult>;
-export declare const denyDeviceAuthorization: <UserType>({ config, userCode }: {
-    config: OidcProviderConfig<UserType>;
-    userCode: string;
-}) => Promise<DeviceDecisionResult>;
-export type DeviceCodeExchangeError = 'access_denied' | 'authorization_pending' | 'expired_token' | 'invalid_grant' | 'slow_down';
-export type DeviceCodeExchangeResult = {
-    access_token: string;
-    expires_in: number;
-    id_token: string;
-    ok: true;
-    refresh_token: string;
-    scope: string;
-    token_type: 'Bearer' | 'DPoP';
-} | {
-    error: DeviceCodeExchangeError;
-    ok: false;
-};
-export declare const exchangeDeviceCode: <UserType>({ clientId, config, deviceCode, dpopJkt, now }: {
-    clientId: string;
-    config: OidcProviderConfig<UserType>;
-    deviceCode: string;
-    dpopJkt?: string;
-    now?: number;
-}) => Promise<DeviceCodeExchangeResult>;
-export declare const CIBA_GRANT_TYPE = "urn:openid:params:grant-type:ciba";
-export type BackchannelAuthResponse = {
-    auth_req_id: string;
-    expires_in: number;
-    interval: number;
-};
-export type BackchannelAuthError = 'expired_login_hint_token' | 'invalid_client' | 'invalid_request' | 'unknown_user_id';
-export declare const issueBackchannelAuth: <UserType>({ clientId, config, loginHint, bindingMessage, now, requestedScopes }: {
-    clientId: string;
-    config: OidcProviderConfig<UserType>;
-    loginHint: string;
-    bindingMessage?: string;
-    now?: number;
-    requestedScopes: string[];
-}) => Promise<{
-    error: BackchannelAuthError;
-    ok: false;
-} | ({
-    ok: true;
-} & BackchannelAuthResponse)>;
-export type BackchannelDecisionResult = {
-    error: 'already_decided' | 'expired_token' | 'invalid_auth_req_id' | 'not_configured';
-    ok: false;
-} | {
-    ok: true;
-};
-export declare const approveBackchannelAuth: <UserType>({ authReqId, config, userSub }: {
-    authReqId: string;
-    config: OidcProviderConfig<UserType>;
-    userSub?: string;
-}) => Promise<BackchannelDecisionResult>;
-export declare const denyBackchannelAuth: <UserType>({ authReqId, config }: {
-    authReqId: string;
-    config: OidcProviderConfig<UserType>;
-}) => Promise<BackchannelDecisionResult>;
-export type BackchannelExchangeError = 'access_denied' | 'authorization_pending' | 'expired_token' | 'invalid_grant' | 'slow_down';
-export type BackchannelExchangeResult = {
-    access_token: string;
-    expires_in: number;
-    id_token: string;
-    ok: true;
-    refresh_token: string;
-    scope: string;
-    token_type: 'Bearer' | 'DPoP';
-} | {
-    error: BackchannelExchangeError;
-    ok: false;
-};
-export declare const exchangeBackchannelAuth: <UserType>({ authReqId, clientCertThumbprint, clientId, config, dpopJkt, now }: {
-    authReqId: string;
-    clientCertThumbprint?: string;
-    clientId: string;
-    config: OidcProviderConfig<UserType>;
-    dpopJkt?: string;
-    now?: number;
-}) => Promise<BackchannelExchangeResult>;

package/dist/oidc/dpop.d.ts

@@ -1,23 +0,0 @@
-export declare const extractDpopNonceClaim: (proof: string) => string | undefined;
-export declare const mintDpopNonce: ({ now, secret }: {
-    now?: number;
-    secret: string;
-}) => Promise<string>;
-export declare const verifyDpopNonce: ({ now, nonce, secret }: {
-    nonce: string;
-    now?: number;
-    secret: string;
-}) => Promise<boolean>;
-export type DpopResult = {
-    jkt: string;
-    jti?: string;
-};
-export declare const verifyDpopProof: ({ accessToken, htm, htu, isUsedJti, maxAgeMs, now, proof }: {
-    accessToken?: string;
-    htm: string;
-    htu: string;
-    isUsedJti?: (jti: string) => boolean | Promise<boolean>;
-    maxAgeMs?: number;
-    now?: number;
-    proof: string | undefined;
-}) => Promise<DpopResult | undefined>;

package/dist/oidc/inMemoryStores.d.ts

@@ -1,11 +0,0 @@
-import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
-export declare const createInMemoryAuthorizationCodeStore: () => AuthorizationCodeStore;
-export declare const createInMemoryBackchannelAuthStore: () => BackchannelAuthStore;
-export declare const createInMemoryClientAssertionJtiStore: () => ClientAssertionJtiStore;
-export declare const createInMemoryClientRegistrationTokenStore: () => ClientRegistrationTokenStore;
-export declare const createInMemoryDeviceAuthorizationStore: () => DeviceAuthorizationStore;
-export declare const createInMemoryInitialAccessTokenStore: (initialHashes?: string[]) => InitialAccessTokenStore;
-export declare const createInMemoryLogoutDeliveryStore: () => LogoutDeliveryStore;
-export declare const createInMemoryOAuthClientStore: (clients: OAuthClient[]) => OAuthClientStore;
-export declare const createInMemoryOidcRefreshTokenStore: () => OidcRefreshTokenStore;
-export declare const createInMemoryPushedAuthorizationRequestStore: () => PushedAuthorizationRequestStore;

package/dist/oidc/inMemoryVciStores.d.ts

@@ -1,3 +0,0 @@
-import type { CredentialNonceStore, CredentialOfferStore } from './vci';
-export declare const createInMemoryCredentialNonceStore: () => CredentialNonceStore;
-export declare const createInMemoryCredentialOfferStore: () => CredentialOfferStore;

package/dist/oidc/jar.d.ts

@@ -1,14 +0,0 @@
-import type { OAuthClient } from './types';
-export type JarParseResult = {
-    error: 'invalid_request_object';
-    ok: false;
-} | {
-    ok: true;
-    params: Record<string, string>;
-};
-export declare const parseSignedRequestObject: ({ client, expectedIssuer, jwt, now }: {
-    client: OAuthClient;
-    expectedIssuer: string;
-    jwt: string;
-    now?: number;
-}) => Promise<JarParseResult>;

package/dist/oidc/keys.d.ts

@@ -1,25 +0,0 @@
-export type SigningKey = {
-    kid: string;
-    privateJwk: JsonWebKey;
-    publicJwk: JsonWebKey;
-};
-export declare const generateSigningKey: () => Promise<SigningKey>;
-export declare const jwkThumbprint: (jwk: JsonWebKey) => Promise<string>;
-export declare const signJwt: (payload: Record<string, unknown>, signing: SigningKey, typ?: string) => Promise<string>;
-export declare const toPublicJwk: (key: SigningKey) => {
-    alg: string;
-    crv: string | undefined;
-    kid: string;
-    kty: string | undefined;
-    use: string;
-    x: string | undefined;
-    y: string | undefined;
-};
-export declare const verifyJwt: (token: string, publicJwk: JsonWebKey) => Promise<{
-    header: {
-        [k: string]: any;
-    };
-    payload: {
-        [k: string]: any;
-    };
-} | undefined>;

package/dist/oidc/logout.d.ts

@@ -1,38 +0,0 @@
-import type { OidcProviderConfig } from './config';
-import type { LogoutDelivery, OAuthClient } from './types';
-export declare const resolvePostLogoutRedirect: ({ client, requestedUri }: {
-    client: OAuthClient;
-    requestedUri: string | undefined;
-}) => string | undefined;
-export declare const verifyIdTokenHint: <UserType>({ config, idTokenHint }: {
-    config: OidcProviderConfig<UserType>;
-    idTokenHint: string;
-}) => Promise<{
-    audClientId: string;
-    sub: string;
-} | undefined>;
-type DeliveryFetch = (url: string, init: {
-    body: string;
-    headers: Record<string, string>;
-    method: string;
-    signal: AbortSignal;
-}) => Promise<{
-    ok: boolean;
-    status: number;
-}>;
-export declare const mintLogoutToken: <UserType>({ clientId, config, now, sub }: {
-    clientId: string;
-    config: OidcProviderConfig<UserType>;
-    now?: number;
-    sub: string;
-}) => Promise<string>;
-export declare const fanOutBackchannelLogout: <UserType>({ config, fetchImpl, now, onError, skipClientId, timeoutMs, userId }: {
-    config: OidcProviderConfig<UserType>;
-    fetchImpl?: DeliveryFetch;
-    now?: number;
-    onError?: (delivery: LogoutDelivery) => void | Promise<void>;
-    skipClientId?: string;
-    timeoutMs?: number;
-    userId: string;
-}) => Promise<string[]>;
-export {};

package/dist/oidc/mtls.d.ts

@@ -1,11 +0,0 @@
-export declare const computeCertThumbprint: (derBytes: Uint8Array) => Promise<string>;
-export declare const extractRfc9440ClientCert: (headers: Headers) => Uint8Array<ArrayBuffer> | undefined;
-export declare const resolveClientCert: ({ extract, headers }: {
-    extract: ((headers: Headers) => Promise<Uint8Array | undefined> | Uint8Array | undefined) | undefined;
-    headers: Headers;
-}) => Promise<Uint8Array<ArrayBufferLike> | undefined>;
-export declare const verifyCertificateBoundToken: ({ cnfThumbprint, extract, headers }: {
-    cnfThumbprint: string | undefined;
-    extract: ((headers: Headers) => Promise<Uint8Array | undefined> | Uint8Array | undefined) | undefined;
-    headers: Headers;
-}) => Promise<boolean>;

package/dist/oidc/par.d.ts

@@ -1,28 +0,0 @@
-import type { OAuthClient, PushedAuthorizationRequestStore } from './types';
-export declare const DEFAULT_PAR_TTL_MS: number;
-export declare const REQUEST_URI_PREFIX = "urn:ietf:params:oauth:request_uri:";
-export type PushAuthorizationResult = {
-    body: {
-        expires_in: number;
-        request_uri: string;
-    };
-    ok: true;
-} | {
-    body: {
-        error: string;
-    };
-    ok: false;
-    status: 400 | 401;
-};
-export declare const consumePushedRequest: ({ clientId, requestUri, store }: {
-    clientId: string;
-    requestUri: string;
-    store: PushedAuthorizationRequestStore;
-}) => Promise<Record<string, string> | undefined>;
-export declare const pushAuthorizationRequest: ({ client, now, params, store, ttlMs }: {
-    client: OAuthClient;
-    now?: number;
-    params: Record<string, string>;
-    store: PushedAuthorizationRequestStore;
-    ttlMs?: number;
-}) => Promise<PushAuthorizationResult>;